General
-
Target
wallpaper (1).jpg
-
Size
28KB
-
Sample
240508-xw823adc84
-
MD5
bdd8868b21390b0f69a5a0dc956a492e
-
SHA1
c1aab129d3c0f73a143fbbce40de80b12cc4a003
-
SHA256
4165a8ea1f11af46b2ac475c41bce70b498007c31e366707c81c8890afdd77e4
-
SHA512
865347cc8637c1282aa737c1012ee05ddd2e50b255b75191f0179f7b28ee04e2fe00320b51f8cb5a9e3de640528531726a296f0b30b16b828451e7d42864362e
-
SSDEEP
384:glIaWtdyGKa+GorT05y/KVNC1+YwcPPmAJyyZsw4575Dwf9fsdYHl5Bp1GlT7EHj:kInd52yCPPPm97mFkmLp1m7ED
Static task
static1
Malware Config
Targets
-
-
Target
wallpaper (1).jpg
-
Size
28KB
-
MD5
bdd8868b21390b0f69a5a0dc956a492e
-
SHA1
c1aab129d3c0f73a143fbbce40de80b12cc4a003
-
SHA256
4165a8ea1f11af46b2ac475c41bce70b498007c31e366707c81c8890afdd77e4
-
SHA512
865347cc8637c1282aa737c1012ee05ddd2e50b255b75191f0179f7b28ee04e2fe00320b51f8cb5a9e3de640528531726a296f0b30b16b828451e7d42864362e
-
SSDEEP
384:glIaWtdyGKa+GorT05y/KVNC1+YwcPPmAJyyZsw4575Dwf9fsdYHl5Bp1GlT7EHj:kInd52yCPPPm97mFkmLp1m7ED
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Legitimate hosting services abused for malware hosting/C2
-