Overview

overview

8

Static

static

3

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d28cb1c7c40719fef95a9dee07654cb

  • Size

    117KB

  • Sample

    231226-n96z7aabb3

  • MD5

    6d28cb1c7c40719fef95a9dee07654cb

  • SHA1

    3fad5d90814b829f1359ff99afb997e8ae2f4949

  • SHA256

    7145589a650b5ca5c63f4f7096bc7759ccb15137581f2514533fe40d5c848b79

  • SHA512

    c65299e6e4c07406dabe86f1b3573b62797eaa920c2b1d201d1c36c26a58a5f5933ca2b10282f58cd141fa97605670e3687dead11ca9eee1078fd79432792343

  • SSDEEP

    3072:ll0img13tG90HdQ3SqtER11DhcriIg/8Jb1/lNQEzWWXcZAdePuk:lljpD9Q3TtA1tcg8JnNLFXIAI2k

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      239KB

    • MD5

      5ddfe645d3cbe2590b34e5afa2deb822

    • SHA1

      df310df675c59e8958aef6ce041e78118696ad5e

    • SHA256

      b13c0037e3ac532d246bd13e0e096509fd2fe9fa688de1bea39596368fa3341a

    • SHA512

      ccd3706dcd7dba5543187ef6375d34eee6a07807046386f7ab0540583a9f583f583bcd7157f2c756dbb0c08f399c65aca20652ee698378d2e255cd41ce7e4ed4

    • SSDEEP

      3072:cBAp5XhKpN4eOyVTGfhEClj8jTk+0h1Rqsrf6XFfuoyTNwTJSFya+Cgw5CKHG:LbXE9OiTGfhEClq9+6btJJUG

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks