d9262966df4b28d8ae9c39de4ac7ee5c5106bf7956aa45c60f27e817cee3819d | Triage

Sharing

General

Target

d9262966df4b28d8ae9c39de4ac7ee5c5106bf7956aa45c60f27e817cee3819d
Size

232KB
Sample

240327-bhck2sgf25
MD5

601282dc4e45fa953a87fe49d6930059
SHA1

54ca96e2da0f04a1865fd122bd7d7d2213ebb149
SHA256

d9262966df4b28d8ae9c39de4ac7ee5c5106bf7956aa45c60f27e817cee3819d
SHA512

3114203c32784cfbae140dc81b1815f16333b732bbaa0aadd7616be28ef11f1ab0d58ee982a59462224be998c01febd94d4bba61c8a6f8bb645deaf873a143ea
SSDEEP

6144:yYASJKenie2xT2NU2OTFQb8Fb0IQUfFmn:yk5nilTFQbI0v+o

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  d9262966df4b28d8ae9c39de4ac7ee5c5106bf7956aa45c60f27e817cee3819d
- Size
  
  232KB
- MD5
  
  601282dc4e45fa953a87fe49d6930059
- SHA1
  
  54ca96e2da0f04a1865fd122bd7d7d2213ebb149
- SHA256
  
  d9262966df4b28d8ae9c39de4ac7ee5c5106bf7956aa45c60f27e817cee3819d
- SHA512
  
  3114203c32784cfbae140dc81b1815f16333b732bbaa0aadd7616be28ef11f1ab0d58ee982a59462224be998c01febd94d4bba61c8a6f8bb645deaf873a143ea
- SSDEEP
  
  6144:yYASJKenie2xT2NU2OTFQb8Fb0IQUfFmn:yk5nilTFQbI0v+o
Score

9^/10

persistence
- Detects executables packed with aPLib.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2