fb3f32228c3b8e9c9016b504ddef8413eba72c8eb594553068ac720c7ba31ae2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb3f32228c3b8e9c9016b504ddef8413eba72c8eb594553068ac720c7ba31ae2
Size

296KB
Sample

221205-2jn9cagd9v
MD5

c5df453b210bcf43067b0579ec602a54
SHA1

e94b3ac2c5dd1fc5b7963dbacb0ffe25543fa884
SHA256

fb3f32228c3b8e9c9016b504ddef8413eba72c8eb594553068ac720c7ba31ae2
SHA512

949d4a5609881d8e5be48593eaac07c5975b64a081ae2e1efc4635b513a4fbfa5c259eb9c0ac75d0a266fb090b30d65ea4954924ab681fa8e5cdeaa9b8728707
SSDEEP

6144:EzM5xFRfhqb7IT4pO6JK/fObT/bGiWtBcMf1YUQiCgfAJDq2ijxLzOwGd:6AxFRy7IT4pO6JK/fObT/bGiWt/YUQiE

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  fb3f32228c3b8e9c9016b504ddef8413eba72c8eb594553068ac720c7ba31ae2
- Size
  
  296KB
- MD5
  
  c5df453b210bcf43067b0579ec602a54
- SHA1
  
  e94b3ac2c5dd1fc5b7963dbacb0ffe25543fa884
- SHA256
  
  fb3f32228c3b8e9c9016b504ddef8413eba72c8eb594553068ac720c7ba31ae2
- SHA512
  
  949d4a5609881d8e5be48593eaac07c5975b64a081ae2e1efc4635b513a4fbfa5c259eb9c0ac75d0a266fb090b30d65ea4954924ab681fa8e5cdeaa9b8728707
- SSDEEP
  
  6144:EzM5xFRfhqb7IT4pO6JK/fObT/bGiWtBcMf1YUQiCgfAJDq2ijxLzOwGd:6AxFRy7IT4pO6JK/fObT/bGiWt/YUQiE
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence