General
-
Target
Start.exe
-
Size
37.6MB
-
Sample
240509-mebecsfe26
-
MD5
2ddc35c140fbb180b9ef8f9c3919b35a
-
SHA1
24f39a775725c4d198d4af45d109a9262a13dd9a
-
SHA256
e6dd8ab3bc1cd4facba0a3c4e98abe0acbe88f52457e709e1f57935662ec5c59
-
SHA512
02c645f72752148929ad5c4ef546956b0d5839949940976f9b3d6bbd5f73840edc840845f29018e8488b3550469f5f4e57671502661245d26cc80cccffe28463
-
SSDEEP
393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg296l+ZArYsFRldj5:R3on1HvSzxAMN2FZArYsVjPvQ7OZ06j
Behavioral task
behavioral1
Sample
Start.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Start.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
Start.exe
-
Size
37.6MB
-
MD5
2ddc35c140fbb180b9ef8f9c3919b35a
-
SHA1
24f39a775725c4d198d4af45d109a9262a13dd9a
-
SHA256
e6dd8ab3bc1cd4facba0a3c4e98abe0acbe88f52457e709e1f57935662ec5c59
-
SHA512
02c645f72752148929ad5c4ef546956b0d5839949940976f9b3d6bbd5f73840edc840845f29018e8488b3550469f5f4e57671502661245d26cc80cccffe28463
-
SSDEEP
393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg296l+ZArYsFRldj5:R3on1HvSzxAMN2FZArYsVjPvQ7OZ06j
Score8/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
An obfuscated cmd.exe command-line is typically used to evade detection.
-