General

  • Target

    2558cd99c6fa8abd182ae420d3a5075e.bin

  • Size

    712KB

  • Sample

    240530-b79l3sbb67

  • MD5

    f5b3a9b56e0badb9b55be397922e5a33

  • SHA1

    87d00a3061437e0620b7e6a0afb4daffa6dc55df

  • SHA256

    4e4cbc79d5ab678bad2ae7528c350c5f93ef3e0b386aa1a15676210946c545da

  • SHA512

    bfcfe4be3fddd83e01321b2d4ee3e35f7260312f90fafb299cc2b2f145321b43ff9debbbb08862db063ad81ffbb5d12b733b68d1e9548c2d7bddf7a4d0c3f952

  • SSDEEP

    12288:iH69J4fMRNb+Iq2OUc9AI5St+ZttOO79lRRtgzBqocIF16:4bMPBOn9AJ0T1rBgz4orw

Score
8/10

Malware Config

Targets

    • Target

      843ec377bec0fb98d65731d8825f8f71c6c01208550b8a9babfeb472626aed32.exe

    • Size

      741KB

    • MD5

      2558cd99c6fa8abd182ae420d3a5075e

    • SHA1

      393a942e3d5c50accd55d862e174fa51c4037070

    • SHA256

      843ec377bec0fb98d65731d8825f8f71c6c01208550b8a9babfeb472626aed32

    • SHA512

      aeec230b5c2787be2f5a516d2b5844415b5e9d174414e237c23de5a11d8b992415d809f02d66615dc3979d7a9378186700327fa0988bcb72233b31ec0c520032

    • SSDEEP

      12288:txL0uDa7QYb1uZED8qrl5dYTFTDwV019sN43NrsZFKSFfYT4:LfasaYZ68qZOTv19ImsDKSF1

    Score
    8/10
    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks