Overview

overview

10

Static

static

61ed6a1b4f...24.exe

windows7-x64

10

61ed6a1b4f...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024

  • Size

    332KB

  • Sample

    221205-xl1ypsff36

  • MD5

    1c087e4778199ab95e4f7c0ceff40f0e

  • SHA1

    f8766e9df570a3a641c52ec98d2c0b5c87e5f969

  • SHA256

    61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024

  • SHA512

    d6a0785a6e121c977ba6188d2b8d434424afddb9f30295825c1d9077cf2eb480d48a48d2ffcefc7a944ca21915edf1b9fa4dbf9b4e417e53501fe0bf2c2d8c2e

  • SSDEEP

    3072:Vq9jSeaNxBuD7mEVSuekhGkYrQRVZq3eFo4ejLnlQISQLpyhZu6qyKtrlbHrs2OI:R5NxO2WGk1Y3nmQcuyKdFrs2OXuHNz

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024

    • Size

      332KB

    • MD5

      1c087e4778199ab95e4f7c0ceff40f0e

    • SHA1

      f8766e9df570a3a641c52ec98d2c0b5c87e5f969

    • SHA256

      61ed6a1b4f40b31bc00d66d145b3a19f883d6f1a8e3dffc6ea6394e783af6024

    • SHA512

      d6a0785a6e121c977ba6188d2b8d434424afddb9f30295825c1d9077cf2eb480d48a48d2ffcefc7a944ca21915edf1b9fa4dbf9b4e417e53501fe0bf2c2d8c2e

    • SSDEEP

      3072:Vq9jSeaNxBuD7mEVSuekhGkYrQRVZq3eFo4ejLnlQISQLpyhZu6qyKtrlbHrs2OI:R5NxO2WGk1Y3nmQcuyKdFrs2OXuHNz

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks