Overview

overview

6

Static

static

1

CurseForge...er.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    CurseForge - Installer.exe

  • Size

    2.0MB

  • Sample

    230527-xhlplsdc2s

  • MD5

    9b280de6deeacca16cbf3333970eed83

  • SHA1

    6576c6b8ef3d79854ede4b301a63f485635325f7

  • SHA256

    9f466b9bc8f99178187f44f66fc1fa7a8501596e91d20e26102b753f2f942932

  • SHA512

    354e1cee093e45e72bea58e7fd6679ea9caff5d8810afe28531f63cd5c3d653082b44054910b49be7630ef2b144bd9f5f02f2a9035fc8182fb600e258418f256

  • SSDEEP

    49152:n1Rce6xE87vxpsrFpIvgV7Rlh4TrAzPYnsBYkjLRUcM:nj4PN+TIvWOywn/4C

Score
6/10
discoverypersistence

Malware Config

Targets

    • Target

      CurseForge - Installer.exe

    • Size

      2.0MB

    • MD5

      9b280de6deeacca16cbf3333970eed83

    • SHA1

      6576c6b8ef3d79854ede4b301a63f485635325f7

    • SHA256

      9f466b9bc8f99178187f44f66fc1fa7a8501596e91d20e26102b753f2f942932

    • SHA512

      354e1cee093e45e72bea58e7fd6679ea9caff5d8810afe28531f63cd5c3d653082b44054910b49be7630ef2b144bd9f5f02f2a9035fc8182fb600e258418f256

    • SSDEEP

      49152:n1Rce6xE87vxpsrFpIvgV7Rlh4TrAzPYnsBYkjLRUcM:nj4PN+TIvWOywn/4C

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks