Overview

overview

8

Static

static

3

GOLAYA-DEVOCHKA.exe

windows7-x64

8

GOLAYA-DEVOCHKA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    4965d3021b7aba502f7f3f8c049d531d

  • Size

    80KB

  • Sample

    231226-bwgrxscfg2

  • MD5

    4965d3021b7aba502f7f3f8c049d531d

  • SHA1

    8ecaaba76cc73853211b1ecf286bb2b3a6a401c3

  • SHA256

    031b3ab03bf6172e80c32a413ea75f89846fc0def222bc8c21e47299ab6aa33a

  • SHA512

    3f88afd0f1724d8958124b92130016261348c9eac21a8ea557dd528b1cfd3115c6d67e9c8cf08f91c25d9295dd72568dc720f4467e7db817adab97683447a433

  • SSDEEP

    1536:qkDro9Ash6VQZtlRtQlQ7pYw/zQymCJVVBZu3BHp231vcaLCCfVVG6sxa2:RDvsEU8lGpD/NZBZF1vcaLCsT/M5

Score
8/10

Malware Config

Targets

    • Target

      GOLAYA-DEVOCHKA.exe

    • Size

      180KB

    • MD5

      731790f96390935dcf6c9451c7b80c68

    • SHA1

      92e152be11147d807725aa55aea4825675f654f5

    • SHA256

      58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9

    • SHA512

      76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515

    • SSDEEP

      3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks