Overview

overview

8

Static

static

b0c2f0bed1...d9.exe

windows7-x64

1

b0c2f0bed1...d9.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0c2f0bed100fdbe9712236307e8e8c69750e1e3e9610ed6300610bc228150d9

  • Size

    160KB

  • Sample

    221205-vbayesca2z

  • MD5

    9e1c316fd4d283fbc1f1e854960d94a0

  • SHA1

    4628f0a0c0d7f21b03995b37c164ecdc188998bb

  • SHA256

    b0c2f0bed100fdbe9712236307e8e8c69750e1e3e9610ed6300610bc228150d9

  • SHA512

    8d9d6ab1320d08d326e0639c481cb06f26b1402f3adb5f43acf94f99a10452891be9ec173ea80a7c8b013d96c29b7ce4f09465702729b62ce43d3036c48e7471

  • SSDEEP

    1536:OJwHa3E5YW/io2C+I4LQ54z2B814KX6hN2DDwRCPERKHOJ+u:jHaE5/io2C+I4LQ54z2C14KK3W8RChy

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      b0c2f0bed100fdbe9712236307e8e8c69750e1e3e9610ed6300610bc228150d9

    • Size

      160KB

    • MD5

      9e1c316fd4d283fbc1f1e854960d94a0

    • SHA1

      4628f0a0c0d7f21b03995b37c164ecdc188998bb

    • SHA256

      b0c2f0bed100fdbe9712236307e8e8c69750e1e3e9610ed6300610bc228150d9

    • SHA512

      8d9d6ab1320d08d326e0639c481cb06f26b1402f3adb5f43acf94f99a10452891be9ec173ea80a7c8b013d96c29b7ce4f09465702729b62ce43d3036c48e7471

    • SSDEEP

      1536:OJwHa3E5YW/io2C+I4LQ54z2B814KX6hN2DDwRCPERKHOJ+u:jHaE5/io2C+I4LQ54z2C14KK3W8RChy

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks