General
-
Target
Logon_overwriter.exe
-
Size
266KB
-
Sample
231116-19stsabf6t
-
MD5
08d52877fd68e4de576b54515330a900
-
SHA1
2404b3245e591b3e55badd8addf78f18ae8ff3b7
-
SHA256
1f934e5ee7286e177226e282041c445cd88060032edb4f2ff0cd9a10c26b0722
-
SHA512
3164c40f644a6bd4c955a66e83ac0dc84780963c97aa7001dc734b8e2e0579bb768de0820465ca6fed6b89ce19897b44dc30d072663ac9bdda59d35ea14b2cf1
-
SSDEEP
6144:pbpdyCIzMEZ4DQ0SsG4+7WO7WfdyCIzMEZ4DQ0SsG4Nq:glzMKwKaOaIlzMKwQ
Static task
static1
Behavioral task
behavioral1
Sample
Logon_overwriter.exe
Resource
win7-20231020-en
Malware Config
Targets
-
-
Target
Logon_overwriter.exe
-
Size
266KB
-
MD5
08d52877fd68e4de576b54515330a900
-
SHA1
2404b3245e591b3e55badd8addf78f18ae8ff3b7
-
SHA256
1f934e5ee7286e177226e282041c445cd88060032edb4f2ff0cd9a10c26b0722
-
SHA512
3164c40f644a6bd4c955a66e83ac0dc84780963c97aa7001dc734b8e2e0579bb768de0820465ca6fed6b89ce19897b44dc30d072663ac9bdda59d35ea14b2cf1
-
SSDEEP
6144:pbpdyCIzMEZ4DQ0SsG4+7WO7WfdyCIzMEZ4DQ0SsG4Nq:glzMKwKaOaIlzMKwQ
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Modifies file permissions
-
Drops file in System32 directory
-