Overview

overview

8

Static

static

3

GOLAYA-PHOTO.exe

windows7-x64

8

GOLAYA-PHOTO.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09ef1da32ee2e29e6b6ab7fb80b31f41

  • Size

    89KB

  • Sample

    231224-wjm4dscedr

  • MD5

    09ef1da32ee2e29e6b6ab7fb80b31f41

  • SHA1

    9a94ada2352b233c4044d420bd2f84d41a7ac7e8

  • SHA256

    ccbe567ea06bdf8770f70c7e8deb6911778cb3f44ccb7a9d7a5f879f939a92e2

  • SHA512

    5e07c8f938509c134d483215424c75efc62f3bbd57a2abf2941eb4ce3cab1f67f9f0a2fec966129a3f8f55971e5723ed3aa824ab4cb671c5136aae9fce4faf14

  • SSDEEP

    1536:VUnVN5HOHUEs6iqcuyIJ4fnb07w3317NbesR3SRXAlO+aSPVTtHvsGiKle:VUnLYCq/Fufnb07YPe8CJADDNtkRKo

Score
8/10

Malware Config

Targets

    • Target

      GOLAYA-PHOTO.exe

    • Size

      180KB

    • MD5

      956e2b490c56f641e1ec22001a6c8390

    • SHA1

      4cc154694540b69f848c6508996c964981f1c6dc

    • SHA256

      4b6a3c6b886086fbe58630f2742813b2fe79bf89b047551ddd9560a5f40839e8

    • SHA512

      03c3b0e411f5f77f4164e1070884bb60b7a8e7948f142c2ddf574aac6178643522f8ab2ec221e8dd6dd243ff98129e6a9f8446a4dbec92dbe01c7da67c6714d0

    • SSDEEP

      3072:rBAp5XhKpN4eOyVTGfhEClj8jTk+0hR4udk4RjbC5:WbXE9OiTGfhEClq9Xuvjb4

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks