af52bedddad36e7e337e046b1d0f292a5ab8f8ed3f23756dc2e483790b20b7e8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af52bedddad36e7e337e046b1d0f292a5ab8f8ed3f23756dc2e483790b20b7e8
Size

184KB
Sample

221204-nqasmsec94
MD5

5fd4bad831bf8734ad9788af331cac82
SHA1

0b75fb426592e96036aa31122c3e7c96afa3abbd
SHA256

af52bedddad36e7e337e046b1d0f292a5ab8f8ed3f23756dc2e483790b20b7e8
SHA512

97d75c1c54f33f09c9483d1039cbbc11142b6fd026c25f79999141d9372795759cc3269b9f12a2d97c1ed4247562c2eed4adb2850e651e58d648c598cc4626ca
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3t:/7BSH8zUB+nGESaaRvoB7FJNndn4

Score

8^/10

Malware Config

Targets

- Target
  
  af52bedddad36e7e337e046b1d0f292a5ab8f8ed3f23756dc2e483790b20b7e8
- Size
  
  184KB
- MD5
  
  5fd4bad831bf8734ad9788af331cac82
- SHA1
  
  0b75fb426592e96036aa31122c3e7c96afa3abbd
- SHA256
  
  af52bedddad36e7e337e046b1d0f292a5ab8f8ed3f23756dc2e483790b20b7e8
- SHA512
  
  97d75c1c54f33f09c9483d1039cbbc11142b6fd026c25f79999141d9372795759cc3269b9f12a2d97c1ed4247562c2eed4adb2850e651e58d648c598cc4626ca
- SSDEEP
  
  3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3t:/7BSH8zUB+nGESaaRvoB7FJNndn4
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2