General
-
Target
02bf70831ab4e561285a6848289999767982af261d477f275fc4d77e7868509a
-
Size
223KB
-
Sample
231123-fr6mpsgb49
-
MD5
3f1ed476bceeca442393f5e36fa68cd8
-
SHA1
03a302374522db1d8b66286c53cc6b6d6089584f
-
SHA256
02bf70831ab4e561285a6848289999767982af261d477f275fc4d77e7868509a
-
SHA512
34162a317612547bfee962d3536f42a58e6e2ed10d4c9658154e93c960608df6544222fe03d28893afd15f0fab42593be371aff2954f850afc5e3d0a67cae03c
-
SSDEEP
6144:KwPSUONLNsuWA7koN+boRN3i4CbRcyXLAE:KOuW5o/+Rc
Malware Config
Targets
-
-
Target
02bf70831ab4e561285a6848289999767982af261d477f275fc4d77e7868509a
-
Size
223KB
-
MD5
3f1ed476bceeca442393f5e36fa68cd8
-
SHA1
03a302374522db1d8b66286c53cc6b6d6089584f
-
SHA256
02bf70831ab4e561285a6848289999767982af261d477f275fc4d77e7868509a
-
SHA512
34162a317612547bfee962d3536f42a58e6e2ed10d4c9658154e93c960608df6544222fe03d28893afd15f0fab42593be371aff2954f850afc5e3d0a67cae03c
-
SSDEEP
6144:KwPSUONLNsuWA7koN+boRN3i4CbRcyXLAE:KOuW5o/+Rc
Score8/10-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory
-