General
-
Target
build.exe
-
Size
37.6MB
-
Sample
240524-qfystsfa6y
-
MD5
d0e4bc655959df41e148f19a2c1b7816
-
SHA1
7cc0936f84b9a2ff2d144a6abdf95cd4cb630f5f
-
SHA256
9acc476012296292864854963e305036cd464522e1f46e2cd00d8685e1b48ad9
-
SHA512
062a1a47db1548d7975e563260ccf0d91b2637c8199ec919946276dc0595596c9f938bdc5287d25f850e59ad008e4cbd4394c781cb0f0bedfec6602fd177acd6
-
SSDEEP
393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg096l+ZArYsFRlyP5:R3on1HvSzxAMN0FZArYs6Pv09F7OZB
Static task
static1
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
build.exe
-
Size
37.6MB
-
MD5
d0e4bc655959df41e148f19a2c1b7816
-
SHA1
7cc0936f84b9a2ff2d144a6abdf95cd4cb630f5f
-
SHA256
9acc476012296292864854963e305036cd464522e1f46e2cd00d8685e1b48ad9
-
SHA512
062a1a47db1548d7975e563260ccf0d91b2637c8199ec919946276dc0595596c9f938bdc5287d25f850e59ad008e4cbd4394c781cb0f0bedfec6602fd177acd6
-
SSDEEP
393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg096l+ZArYsFRlyP5:R3on1HvSzxAMN0FZArYs6Pv09F7OZB
Score8/10-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
An obfuscated cmd.exe command-line is typically used to evade detection.
-