Overview

overview

8

Static

static

3

PHOTO-DEVOCHKA.exe

windows7-x64

8

PHOTO-DEVOCHKA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    773ad3bdf31628ea444146153ac43b4b

  • Size

    116KB

  • Sample

    231226-sa2zeabda4

  • MD5

    773ad3bdf31628ea444146153ac43b4b

  • SHA1

    14815d5bfa092060e7f63b5fddecc4680f93cd91

  • SHA256

    51e4783d6b7aa4e27c7a42beae9ba0dd453ac52648452f4a9b685c79492d6d5c

  • SHA512

    f2f8041dc2704b6c8b8afb0f455ecdecb5fd668f7f6efd201a9ab1bf6d2bf2d4e5bd9310b82afa5468628930a9e98861e970ff060f9cafd44bfc6308f11f111c

  • SSDEEP

    3072:al0img13tG90HdQ3Sqt1k4e7iAJjU+hLMDgs2z4kF7fKW:aljpD9Q3Tt1Le7iAVU+ODX2z4vW

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-DEVOCHKA.exe

    • Size

      239KB

    • MD5

      9ea5d4e300dd6c096812711fa3c677d2

    • SHA1

      91ae3f2c828d65fc1d862abda77c875a433a09f8

    • SHA256

      fa673f26eca0e92ae23fd52290a15fed2115c3cce647c93a9d52a069d3f82aaa

    • SHA512

      807886572612c5593192318f2ac65fc0d42a77989ac86ccfd730b9544f5fb14fb4aa54aa10bbc7c0f76cde779149da8662d5abba173a503fd942f9669985949e

    • SSDEEP

      3072:7BAp5XhKpN4eOyVTGfhEClj8jTk+0hWmKlv+Cgw5CKHK:mbXE9OiTGfhEClq9PTQJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks