Overview

overview

8

Static

static

3

GOLAYA-RUSSKAYA.exe

windows7-x64

8

GOLAYA-RUSSKAYA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    56a5bca1a2cc530d10f9798a1d8098c2

  • Size

    116KB

  • Sample

    240112-q97ylahcbr

  • MD5

    56a5bca1a2cc530d10f9798a1d8098c2

  • SHA1

    f8a8f9c86e59e5b3828f786e22140c86d01e612c

  • SHA256

    2d82d6c196bec4ccdddb610d4945f934cbc3583b7b2742ecfdb496f4aa24ba42

  • SHA512

    966ca8b107884fc698535b00035c4157a7eadd2a5f75cdf90a87978e3dcd985625d27654eace20848b50e8c50ce7cd0ff6dc9c40eef966357801569d9202fc0b

  • SSDEEP

    3072:2l0img13tG90HdQ3Sqt1k4e7iAJjU+hLMDgs2z4kF7fKz:2ljpD9Q3Tt1Le7iAVU+ODX2z4vz

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-RUSSKAYA.exe

    • Size

      239KB

    • MD5

      9ea5d4e300dd6c096812711fa3c677d2

    • SHA1

      91ae3f2c828d65fc1d862abda77c875a433a09f8

    • SHA256

      fa673f26eca0e92ae23fd52290a15fed2115c3cce647c93a9d52a069d3f82aaa

    • SHA512

      807886572612c5593192318f2ac65fc0d42a77989ac86ccfd730b9544f5fb14fb4aa54aa10bbc7c0f76cde779149da8662d5abba173a503fd942f9669985949e

    • SSDEEP

      3072:7BAp5XhKpN4eOyVTGfhEClj8jTk+0hWmKlv+Cgw5CKHK:mbXE9OiTGfhEClq9PTQJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks