35e81f455373447f991f811447f20359383a62f0ec9ddc241f410741c38d3460 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6fcab22e5b250b7d8d063c8dd52facf8
Size

134KB
Sample

231226-p2y52sega3
MD5

6fcab22e5b250b7d8d063c8dd52facf8
SHA1

192fae66002dd5ce076380859dc3f161438d0633
SHA256

35e81f455373447f991f811447f20359383a62f0ec9ddc241f410741c38d3460
SHA512

0bdd4f0c38303fdada728a563c0cef5beae275c62c14c4ab9e2d5399454e7ab5b476c25d1959882d2b722aaf9f37a9610be5ce6980512f291d5e7c86fc93accf
SSDEEP

3072:oUVmbvp3HKwTkgvLS04JwPS/j5kPnibDpED4:a3/vL54mPm1SD

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  6fcab22e5b250b7d8d063c8dd52facf8
- Size
  
  134KB
- MD5
  
  6fcab22e5b250b7d8d063c8dd52facf8
- SHA1
  
  192fae66002dd5ce076380859dc3f161438d0633
- SHA256
  
  35e81f455373447f991f811447f20359383a62f0ec9ddc241f410741c38d3460
- SHA512
  
  0bdd4f0c38303fdada728a563c0cef5beae275c62c14c4ab9e2d5399454e7ab5b476c25d1959882d2b722aaf9f37a9610be5ce6980512f291d5e7c86fc93accf
- SSDEEP
  
  3072:oUVmbvp3HKwTkgvLS04JwPS/j5kPnibDpED4:a3/vL54mPm1SD
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence