91d5b515b82fc61a6fcc7d433a1fd2434d2d9ff0dbb4da9a25fb972ac700ac3a

General

Target

4f2d5a27ee6f339e33372d35bf04de8a
Size

3KB
Sample

240110-bgrctaahep
MD5

4f2d5a27ee6f339e33372d35bf04de8a
SHA1

9d88b8709f59d498896651e002961c931d74735c
SHA256

91d5b515b82fc61a6fcc7d433a1fd2434d2d9ff0dbb4da9a25fb972ac700ac3a
SHA512

cdb3b9d0fe5f911570bc1969c4c8b3981132e92b517c336165bddd0622b06f1a62725a5bed34a434776351000f8c61ce9458b22327fd9d94267527a03ecc5c18

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://archive.org/download/amro1_202108/amro1.txt

exe.dropper

https://archive.org/download/amro2_202108/amro2.txt

exe.dropper

https://archive.org/download/def_20210812/def.txt

Targets

- Target
  
  4f2d5a27ee6f339e33372d35bf04de8a
- Size
  
  3KB
- MD5
  
  4f2d5a27ee6f339e33372d35bf04de8a
- SHA1
  
  9d88b8709f59d498896651e002961c931d74735c
- SHA256
  
  91d5b515b82fc61a6fcc7d433a1fd2434d2d9ff0dbb4da9a25fb972ac700ac3a
- SHA512
  
  cdb3b9d0fe5f911570bc1969c4c8b3981132e92b517c336165bddd0622b06f1a62725a5bed34a434776351000f8c61ce9458b22327fd9d94267527a03ecc5c18
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2