Overview

overview

8

Static

static

3

d5439d80cd...7b.exe

windows7-x64

8

d5439d80cd...7b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5439d80cd34b60583820934503ecf7b

  • Size

    591KB

  • Sample

    240319-fnpvsabb2z

  • MD5

    d5439d80cd34b60583820934503ecf7b

  • SHA1

    3ddae9d758eecedbd6210672636c1ddbf932e8de

  • SHA256

    2cab6c4426e4acf84083c30440f5063dc36e72b6c2106434c9f3ba9f5679b514

  • SHA512

    3f95f72f9c3363c8bc5b331c8f81b516277628943736454d560444f5ec8b10765cb36c3bd797bbdd8286f69be6aa3499e2e196012ace8a32241321b648a9fac8

  • SSDEEP

    12288:n5fWAhZJTuTL2ts+RrUY9OQbJOCY+31acxpDIN48Rkk/t:5+mZxQ2t1RdOQdOCPFacjINbk

Score
8/10
persistence

Malware Config

Targets

    • Target

      d5439d80cd34b60583820934503ecf7b

    • Size

      591KB

    • MD5

      d5439d80cd34b60583820934503ecf7b

    • SHA1

      3ddae9d758eecedbd6210672636c1ddbf932e8de

    • SHA256

      2cab6c4426e4acf84083c30440f5063dc36e72b6c2106434c9f3ba9f5679b514

    • SHA512

      3f95f72f9c3363c8bc5b331c8f81b516277628943736454d560444f5ec8b10765cb36c3bd797bbdd8286f69be6aa3499e2e196012ace8a32241321b648a9fac8

    • SSDEEP

      12288:n5fWAhZJTuTL2ts+RrUY9OQbJOCY+31acxpDIN48Rkk/t:5+mZxQ2t1RdOQdOCPFacjINbk

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Modifies AppInit DLL entries

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks