cb90ae9b9eb53456847cba73293ba9a39f9182384155802813f1f10fbf452d8b | Triage

Sharing

General

Target

cb90ae9b9eb53456847cba73293ba9a39f9182384155802813f1f10fbf452d8b
Size

216KB
Sample

221205-26tscaff47
MD5

434cf148c899e6d8b28ced352ccd06fb
SHA1

f811f3ef90f987e4d22aae2a6faac80efd441ee5
SHA256

cb90ae9b9eb53456847cba73293ba9a39f9182384155802813f1f10fbf452d8b
SHA512

788cc39260ec49d0e3ed7bad34e75c80d8473df8da01c230eaa76767062e2eb354bdd9179171bc3d3e7e3e4f26be752150213f8aa336c7d9f4cf9ac3ce3bba71
SSDEEP

6144:u2hrbA1x5PZZKnvmb7/D26g4upEoadEXUqgVWLIg7gd:7A1x5PZZKnvmb7/D26GadEXUqgDg7gd

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  cb90ae9b9eb53456847cba73293ba9a39f9182384155802813f1f10fbf452d8b
- Size
  
  216KB
- MD5
  
  434cf148c899e6d8b28ced352ccd06fb
- SHA1
  
  f811f3ef90f987e4d22aae2a6faac80efd441ee5
- SHA256
  
  cb90ae9b9eb53456847cba73293ba9a39f9182384155802813f1f10fbf452d8b
- SHA512
  
  788cc39260ec49d0e3ed7bad34e75c80d8473df8da01c230eaa76767062e2eb354bdd9179171bc3d3e7e3e4f26be752150213f8aa336c7d9f4cf9ac3ce3bba71
- SSDEEP
  
  6144:u2hrbA1x5PZZKnvmb7/D26g4upEoadEXUqgVWLIg7gd:7A1x5PZZKnvmb7/D26GadEXUqgDg7gd
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence