654fbd3d31dc845859f9c861bc9ec8e706095c2dac169a09ed15826caac710a4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PO # 6330001438 - AL SAHOO.zip
Size

595KB
Sample

230605-tmekbaab21
MD5

c8e341bd881f34f7855f61fdda0ef92a
SHA1

bb8838b1425392a8d7d5cda8412872ff44454538
SHA256

654fbd3d31dc845859f9c861bc9ec8e706095c2dac169a09ed15826caac710a4
SHA512

33b62f6aa9515d10bb4787ead1a913b31fef0b15580e238ca9982a0f7b1e7b0b485da74acb27c3cbac962f370638ed0c0599928bbc9ff28eb6593147656c0a54
SSDEEP

12288:dMuP6Bg1ouUPpR7ngrXt6R5daiEt1nZg6h4ZA3bvRImc4ZzrD/kc:GuP6dPf7nKq5Yt1Zg60Arzsc

Score

7^/10

Malware Config

Targets

- Target
  
  New Order-PO # 6330001438 - AL SAHOO .xlx.exe
- Size
  
  788KB
- MD5
  
  a5738b38954652be0305feb0f9a3f7a6
- SHA1
  
  0ea9f45bea777717364c4190d40947407791135d
- SHA256
  
  0ba6fc11a90f8a2e25dd33dbd2ad766eadc5895e21d1b115b42dfbf3ee3e1328
- SHA512
  
  2cc48b0a6c4eecc75797b7c3d5736e1a5dc65bac7f40fbdb091c935f3c18ce5e95840ba0a74e28fff9a8a7b2f2f2d0738576b892c999ee09afbfef64d2b8b607
- SSDEEP
  
  24576:W2N8jiZ4zypIPVJTDEvjnK0/yrjl4qlQ2UIXQ:W2N8jiZ4zypIPVJTDETK0GTQ2UIXQ
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2