Overview

overview

8

Static

static

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    986211af8206aca6ce7df334278765c02bf93ea9fd36cca6ad7c96ac84db3dc8

  • Size

    111KB

  • Sample

    221205-262g7aff64

  • MD5

    3ed2bc36f03b42436068d08bc7b62de5

  • SHA1

    5f451924fed8831c94b37227f534670574df0ffd

  • SHA256

    986211af8206aca6ce7df334278765c02bf93ea9fd36cca6ad7c96ac84db3dc8

  • SHA512

    bb1f1f64c0b471a7e87aa56a20e755dc5319f4113e0e707889736fba343229464eab22b278ece15c6eecb80dd2d3b1b8fedcf60c73967af1cbbedfc761d70e18

  • SSDEEP

    3072:vl0img13tG90HdQ3Sqt9YacAHRmpuf32KAj4S9vU:vljpD9Q3Tt9Sp4ovU

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      239KB

    • MD5

      9932b8424ae1bc1663264d490bddf2ac

    • SHA1

      7d0ae571d6b5d549d81e8490d9345caae621b912

    • SHA256

      83cbcd25b74ebb00e5bee3d97b1152469d662b35e224f892b5456bbf7d529196

    • SHA512

      070214beaccada100d55d83b11cb7c749a509c9b95a781828acef32bf76ac06fe6382b8020c258d5ca750be6fb0548f826bf4d925cd3604f80d9f8b7624f5c9c

    • SSDEEP

      3072:XBAp5XhKpN4eOyVTGfhEClj8jTk+0hgd5rY4J9UqztfJ4t0873l8ACHxDgeTmzgA:abXE9OiTGfhEClq9Td5roJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks