General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHdqUXE0OGhxT2tDY2FLaHVtNVFrQXdwOE9LZ3xBQ3Jtc0tsUjcyNG91X0gyRWJyUGVEbThOZG50cVRfVUo1d2JVUmRjM1FpX1BDeDB4ZC13Sk1yVVpfTVl0S0JqbUJ4bjZPRWpQSTFkOGt4Q01SczAwdHVHNlpKeTRrNld1cGxmRktoRW1LOUl3MGtEMEx3N09taw&q=https%3A%2F%2Fflies.sh%2Fbsim&v=fIzwzTEX3x4

  • Sample

    230520-g8ytvsdf5t

Score
8/10

Malware Config

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHdqUXE0OGhxT2tDY2FLaHVtNVFrQXdwOE9LZ3xBQ3Jtc0tsUjcyNG91X0gyRWJyUGVEbThOZG50cVRfVUo1d2JVUmRjM1FpX1BDeDB4ZC13Sk1yVVpfTVl0S0JqbUJ4bjZPRWpQSTFkOGt4Q01SczAwdHVHNlpKeTRrNld1cGxmRktoRW1LOUl3MGtEMEx3N09taw&q=https%3A%2F%2Fflies.sh%2Fbsim&v=fIzwzTEX3x4

    Score
    8/10
    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks