Extracted

• • Target

    4ccacea000c555b1a333175803ba0af5

  • Size

    691KB

  • MD5

    4ccacea000c555b1a333175803ba0af5

  • SHA1

    8e919e3a04036ee3b5122d3fb047d907d23d1e3d

  • SHA256

    f81cea3cf23dc2d75ad5c9deb707b07807c90a55520e441a7630aa7573f95bb0

  • SHA512

    0bca51112c16fe66ac910289bf665168f25d71c4101123987c0afafdc698b93549eaf82e64be315ff9296cb3710a7d6375543952ab8e13f8d0aaf8de795d13ea

  • SSDEEP

    12288:MSJsWPOGw+qYwxPsw5gubWPRJ+wsHdLgRU3M7tToSGRpQ7E5x36NuP:MSnwKwauipJXlCc7tkSGRWix36

  Score

  10^/10

  upxpersistence

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2