General
-
Target
2b627f1870515d948d0af33071ce47f5
-
Size
682KB
-
Sample
231231-gzkkwafda6
-
MD5
2b627f1870515d948d0af33071ce47f5
-
SHA1
85482e3f57f14a4ed3e8fba18da829f6137be974
-
SHA256
b58fb9bd6b55a360da1af08e8aa18752cbdc32525b92658376d1e3bbd5b732d3
-
SHA512
b71d47ec63d32374fd3757389d9f45adc42bf239beafcb534d7805c37b733e3d7343c2972874907f1a009b9660f24b43a540d474e9f9bb236cf6d76573d65ef8
-
SSDEEP
12288:uSJsWPOGw+qY+n5wSHwnltGmmTY4mkGHzc3HGEslGM68LulbZB7nMpGbKw:uSAn5vHewmkGHCH1slGvqul1is2w
Behavioral task
behavioral1
Sample
2b627f1870515d948d0af33071ce47f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b627f1870515d948d0af33071ce47f5.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
http://rerererererere.com/inst.php?id=forbidden
Targets
-
-
Target
2b627f1870515d948d0af33071ce47f5
-
Size
682KB
-
MD5
2b627f1870515d948d0af33071ce47f5
-
SHA1
85482e3f57f14a4ed3e8fba18da829f6137be974
-
SHA256
b58fb9bd6b55a360da1af08e8aa18752cbdc32525b92658376d1e3bbd5b732d3
-
SHA512
b71d47ec63d32374fd3757389d9f45adc42bf239beafcb534d7805c37b733e3d7343c2972874907f1a009b9660f24b43a540d474e9f9bb236cf6d76573d65ef8
-
SSDEEP
12288:uSJsWPOGw+qY+n5wSHwnltGmmTY4mkGHzc3HGEslGM68LulbZB7nMpGbKw:uSAn5vHewmkGHCH1slGvqul1is2w
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-