General
-
Target
2febe1eeb716956d195f49dd1a5cf0b8e5e967cec788b08b2ce64b48c5ae40e7
-
Size
25.6MB
-
Sample
230321-j439wshc99
-
MD5
f3e8eaa7cd8f044d04e5b794862d29dd
-
SHA1
1040c1d5666eeab5f4d23fe58b928b6b9f04a16f
-
SHA256
2febe1eeb716956d195f49dd1a5cf0b8e5e967cec788b08b2ce64b48c5ae40e7
-
SHA512
ac318191054e60946c8a61adf6f5ac643b43cd6f3640c0b5633960f0ef2af4e21f1532fcca6c971fc16e047e2008769c9c995d6a58f2ab1685cad1015920b285
-
SSDEEP
786432:sKbkdN1HwemvqP6RXPvmQsZn4oxtVpVWtRQm:zAb1k/sZn4oxtVpVWt9
Static task
static1
Behavioral task
behavioral1
Sample
2febe1eeb716956d195f49dd1a5cf0b8e5e967cec788b08b2ce64b48c5ae40e7.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
2febe1eeb716956d195f49dd1a5cf0b8e5e967cec788b08b2ce64b48c5ae40e7
-
Size
25.6MB
-
MD5
f3e8eaa7cd8f044d04e5b794862d29dd
-
SHA1
1040c1d5666eeab5f4d23fe58b928b6b9f04a16f
-
SHA256
2febe1eeb716956d195f49dd1a5cf0b8e5e967cec788b08b2ce64b48c5ae40e7
-
SHA512
ac318191054e60946c8a61adf6f5ac643b43cd6f3640c0b5633960f0ef2af4e21f1532fcca6c971fc16e047e2008769c9c995d6a58f2ab1685cad1015920b285
-
SSDEEP
786432:sKbkdN1HwemvqP6RXPvmQsZn4oxtVpVWtRQm:zAb1k/sZn4oxtVpVWt9
-
Creates new service(s)
-
Sets service image path in registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-