Overview

overview

10

Static

static

3

17c18b7c26...5c.exe

windows7-x64

10

17c18b7c26...5c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    17c18b7c2614f06559f9f69b2c8cdc4706b469975d4ee860f78240a4b9a2ea5c

  • Size

    104KB

  • Sample

    240419-xrbwrsdf3v

  • MD5

    30826e896ce0e0871d7d9a73f4475934

  • SHA1

    45ba59df82a8d162a01f5c3e9c17212a0e150b66

  • SHA256

    17c18b7c2614f06559f9f69b2c8cdc4706b469975d4ee860f78240a4b9a2ea5c

  • SHA512

    4755fb0ee43a1d2bb19c3be4f57f8014e858a9d11fbe76bb28c90739975cf6fd88a7a778b81f7dba68dc593d1d2065ba6d093b61f28536ef9ba7ff0e48b5226a

  • SSDEEP

    1536:wT4ID3Onpgkiu3ug6x9uGB+2LG4h5crgqebMdUHhizIgp2zy9qhTLFNIjnZZS:vR/uZO+ICYbzIgp2mqpFCn7S

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      17c18b7c2614f06559f9f69b2c8cdc4706b469975d4ee860f78240a4b9a2ea5c

    • Size

      104KB

    • MD5

      30826e896ce0e0871d7d9a73f4475934

    • SHA1

      45ba59df82a8d162a01f5c3e9c17212a0e150b66

    • SHA256

      17c18b7c2614f06559f9f69b2c8cdc4706b469975d4ee860f78240a4b9a2ea5c

    • SHA512

      4755fb0ee43a1d2bb19c3be4f57f8014e858a9d11fbe76bb28c90739975cf6fd88a7a778b81f7dba68dc593d1d2065ba6d093b61f28536ef9ba7ff0e48b5226a

    • SSDEEP

      1536:wT4ID3Onpgkiu3ug6x9uGB+2LG4h5crgqebMdUHhizIgp2zy9qhTLFNIjnZZS:vR/uZO+ICYbzIgp2mqpFCn7S

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks