General

  • Target

    source.exe

  • Size

    78.6MB

  • Sample

    231129-wm15esbe3y

  • MD5

    cd0ac9444f8c1af2da0ca2b18d38b916

  • SHA1

    0dad43e186a4208a5a49bccdcd49fea7cc967ef2

  • SHA256

    3a5fc37142b10cae16e14fd10abb8a45b939ee1ce46cac8f72e4c8d787c85940

  • SHA512

    cd023073436c3ab1815a2d7be49c6f8f79dd5de2e7a0c8ace2653881f86aa7ee955eb642d5264673c5e7421fce5ab26d32d34b53536fbfe6d38289d075942c12

  • SSDEEP

    1572864:K2MbiJR5Q3jZDISk8IpG7V+VPhq+ME73jC/WlsnghowmaOllkWIawZBxWBqX:KZbC++SkB05aw+tuOsghfxOllkdawZnb

Malware Config

Targets

    • Target

      source.exe

    • Size

      78.6MB

    • MD5

      cd0ac9444f8c1af2da0ca2b18d38b916

    • SHA1

      0dad43e186a4208a5a49bccdcd49fea7cc967ef2

    • SHA256

      3a5fc37142b10cae16e14fd10abb8a45b939ee1ce46cac8f72e4c8d787c85940

    • SHA512

      cd023073436c3ab1815a2d7be49c6f8f79dd5de2e7a0c8ace2653881f86aa7ee955eb642d5264673c5e7421fce5ab26d32d34b53536fbfe6d38289d075942c12

    • SSDEEP

      1572864:K2MbiJR5Q3jZDISk8IpG7V+VPhq+ME73jC/WlsnghowmaOllkWIawZBxWBqX:KZbC++SkB05aw+tuOsghfxOllkdawZnb

    • Enumerates VirtualBox DLL files

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks