Overview

overview

10

Static

static

1

IN___WSQBG...NK.lnk

windows7-x64

10

IN___WSQBG...NK.lnk

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    IN___WSQBGP374I.LNK.lnk

  • Size

    7KB

  • Sample

    240313-qgm3qadf9w

  • MD5

    6755cb95856bdfce9db92134022b4f27

  • SHA1

    1b2c6303e7e4ac5b85795e7f7a7ac5cc2e5bf44f

  • SHA256

    6323a5c638095516d7f050e2893a10bf7cfdf4b7d90b3483103cac8af1754956

  • SHA512

    4ef9ad2270f927c309f8890d677e060caba75fb51c3224e1f18b36b1213acb0c954e34845484b787eaefe21266a89f7a8bdd9a25f01c712249147448bc5717df

  • SSDEEP

    192:815sujfnaYgeK3dIFbSW8pBWUDAcZawb9NvW:w5BfaYA6moUMQakTW

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://nes.cosmopeople.in/desktop.txt

Targets

    • Target

      IN___WSQBGP374I.LNK.lnk

    • Size

      7KB

    • MD5

      6755cb95856bdfce9db92134022b4f27

    • SHA1

      1b2c6303e7e4ac5b85795e7f7a7ac5cc2e5bf44f

    • SHA256

      6323a5c638095516d7f050e2893a10bf7cfdf4b7d90b3483103cac8af1754956

    • SHA512

      4ef9ad2270f927c309f8890d677e060caba75fb51c3224e1f18b36b1213acb0c954e34845484b787eaefe21266a89f7a8bdd9a25f01c712249147448bc5717df

    • SSDEEP

      192:815sujfnaYgeK3dIFbSW8pBWUDAcZawb9NvW:w5BfaYA6moUMQakTW

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks