Overview

overview

10

Static

static

c1129e176c...24.exe

windows7-x64

10

c1129e176c...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1129e176c471c9fad5d25605c2628af02449d422be69788e53501abfbbc7424.bin

  • Size

    416KB

  • Sample

    221220-nfzn1sce4y

  • MD5

    42100baf34c4b1b0e89f1c2ef94cf8f8

  • SHA1

    b3fff2af153383c85807db00522f81508b90c17c

  • SHA256

    c1129e176c471c9fad5d25605c2628af02449d422be69788e53501abfbbc7424

  • SHA512

    d20c2ce366072782a49a87d3244584fe94059383e52cd3c6c964b37dac911828ae332f84110ac3f88d42c287243eb4eff0dafc34b6079a291cbf211a5b2eae34

  • SSDEEP

    6144:+KSp7sxXMESXp+aTd+X7IJmSGPiu7ITsq9wVfG:+ZpvhoaTd+SmSGKu7Y

Score
10/10
onlyloggerloader

Malware Config

Targets

    • Target

      c1129e176c471c9fad5d25605c2628af02449d422be69788e53501abfbbc7424.bin

    • Size

      416KB

    • MD5

      42100baf34c4b1b0e89f1c2ef94cf8f8

    • SHA1

      b3fff2af153383c85807db00522f81508b90c17c

    • SHA256

      c1129e176c471c9fad5d25605c2628af02449d422be69788e53501abfbbc7424

    • SHA512

      d20c2ce366072782a49a87d3244584fe94059383e52cd3c6c964b37dac911828ae332f84110ac3f88d42c287243eb4eff0dafc34b6079a291cbf211a5b2eae34

    • SSDEEP

      6144:+KSp7sxXMESXp+aTd+X7IJmSGPiu7ITsq9wVfG:+ZpvhoaTd+SmSGKu7Y

    Score
    10/10
    onlyloggerloader

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • OnlyLogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks