General
-
Target
599a81d9341df0b2b3afb39660432209ee2b5a17093e54335bb0f2decbd3d56a
-
Size
223KB
-
Sample
231123-freh8agh9x
-
MD5
1781c76fe559d90b86da07f8eeebb23e
-
SHA1
2ff8f740a28b18a151835773a85ec9441e33e77d
-
SHA256
599a81d9341df0b2b3afb39660432209ee2b5a17093e54335bb0f2decbd3d56a
-
SHA512
43ec8cee741279f33129913a607db70c3eba44cf837ea0116916298734570cf1d48bd0d701644610f96afc412c1cab3173300f98b79a6f87a59dadf53ff31b5a
-
SSDEEP
6144:7wPSUONLNsuWA7koN+boRN3i4CbRcyXLAE:7OuW5o/+Rc
Malware Config
Targets
-
-
Target
599a81d9341df0b2b3afb39660432209ee2b5a17093e54335bb0f2decbd3d56a
-
Size
223KB
-
MD5
1781c76fe559d90b86da07f8eeebb23e
-
SHA1
2ff8f740a28b18a151835773a85ec9441e33e77d
-
SHA256
599a81d9341df0b2b3afb39660432209ee2b5a17093e54335bb0f2decbd3d56a
-
SHA512
43ec8cee741279f33129913a607db70c3eba44cf837ea0116916298734570cf1d48bd0d701644610f96afc412c1cab3173300f98b79a6f87a59dadf53ff31b5a
-
SSDEEP
6144:7wPSUONLNsuWA7koN+boRN3i4CbRcyXLAE:7OuW5o/+Rc
Score8/10-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory
-