General
-
Target
Zero_Loader.rar
-
Size
25.4MB
-
Sample
240125-tapvhsaaf8
-
MD5
c580dfe3332809bd1ca9a3d4bb49d88a
-
SHA1
10178dfd7b7db5b9f9b67088bb9b94e4173b1658
-
SHA256
894c046b185fff2c40af6afd117148e54b830383224f387ed2f389c0556fcf92
-
SHA512
a120a196fec58bd074e0d87def93c8d9eb6caafcb44699082a49425802bf8369d26acb3062c74941b5cdf4b0220180474376d5de9e5edd606f2cb1f614bb2b42
-
SSDEEP
786432:WiMcRM/s7jVkBJXoCVym1v/BSsyXXGhWgs3h:Wi+U7hkPXoCVJuRGhW/3h
Static task
static1
Behavioral task
behavioral1
Sample
Zero_Loader.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Zero_Loader.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
Zero_Loader.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
Zero_Loader.exe
-
Size
51.3MB
-
MD5
0216e67c988fe280add3a09e262dac03
-
SHA1
4c0a6dec8c8cd2745c5306c5e660afe39263c5b0
-
SHA256
a5fd77cf9ba05e9c133f773665a66fc84cd8d50e11949fd9d578836dc2e4222e
-
SHA512
1eeab94cfd5d3570d840e39366eca900fe16763e5b2a2d499a6defd521cf2c95b4f01fcbd7cd1c9bc70bdf9b7f3480e5372d908530dcd01743a87e1e245626ee
-
SSDEEP
786432:fMguj8Q4VfvIqFTrYI2mkZlNc2cqmDAZUU2nE2:fiAQIHIkHb2pZU98ZyE2
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-