Extracted

• • Target

    SllikLoader.rar

  • Size

    5KB

  • MD5

    a4245882b38129599c357fc42514d43e

  • SHA1

    8e7046073d9016293927ce50728e5a02afbdbbeb

  • SHA256

    8a242453d9bc5fa5d59e7e2eb07ffabe4e91fc6a01cc7f9d7b0b44099a3dc753

  • SHA512

    9f366e0924d48ec54e178a9cbda001ab3535882dc1bc743184cce04a330ae2f688c40578d28e8102c30179331a295405f9a5992398105012a0a246731d45b4fe

  • SSDEEP

    96:8eBOk6GOpzN2CSP5iSZ61xuV3VpZ3gqJLDBrsgbHdTS9ql6YkvLEDp6y7M:8Dk6BpzN2fZ61i5tTIgDgwiLEDpt7M

  Score

  10^/10

  discoveryevasionpersistence

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Registers COM server for autorun

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops Chrome extension

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1

• • Target

    SllikLoader.exe

  • Size

    72KB

  • MD5

    d13afded2632cdb35dc2040eb756472d

  • SHA1

    b7f3ae148bb86dba2ca931fec70832db1d30eb22

  • SHA256

    956c5b3d309fa800491d4eacd24944f04bb1d8b2b49a85214ce38aac2778d40c

  • SHA512

    99b1a723a49b8dcc2f1808dcaf57d4461054a968d63118453ff498d61efe56aba393cd165c7b986a585c5ab2e7fa4af717d696e363e23555875cd1ceceb8d960

  • SSDEEP

    384:mN2zj316XYUF5r4NVX+oH38/1qmrc42mMPR45YHU/0/8IpzXePdCjiCNxKB2:NZKYUe

  Score

  10^/10

  evasionpersistence

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral2