General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHdqUXE0OGhxT2tDY2FLaHVtNVFrQXdwOE9LZ3xBQ3Jtc0tsUjcyNG91X0gyRWJyUGVEbThOZG50cVRfVUo1d2JVUmRjM1FpX1BDeDB4ZC13Sk1yVVpfTVl0S0JqbUJ4bjZPRWpQSTFkOGt4Q01SczAwdHVHNlpKeTRrNld1cGxmRktoRW1LOUl3MGtEMEx3N09taw&q=https%3A%2F%2Fflies.sh%2Fbsim&v=fIzwzTEX3x4
-
Sample
230520-g8ytvsdf5t
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHdqUXE0OGhxT2tDY2FLaHVtNVFrQXdwOE9LZ3xBQ3Jtc0tsUjcyNG91X0gyRWJyUGVEbThOZG50cVRfVUo1d2JVUmRjM1FpX1BDeDB4ZC13Sk1yVVpfTVl0S0JqbUJ4bjZPRWpQSTFkOGt4Q01SczAwdHVHNlpKeTRrNld1cGxmRktoRW1LOUl3MGtEMEx3N09taw&q=https%3A%2F%2Fflies.sh%2Fbsim&v=fIzwzTEX3x4
Resource
win10v2004-20230221-en
Malware Config
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHdqUXE0OGhxT2tDY2FLaHVtNVFrQXdwOE9LZ3xBQ3Jtc0tsUjcyNG91X0gyRWJyUGVEbThOZG50cVRfVUo1d2JVUmRjM1FpX1BDeDB4ZC13Sk1yVVpfTVl0S0JqbUJ4bjZPRWpQSTFkOGt4Q01SczAwdHVHNlpKeTRrNld1cGxmRktoRW1LOUl3MGtEMEx3N09taw&q=https%3A%2F%2Fflies.sh%2Fbsim&v=fIzwzTEX3x4
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-