Extracted

• • Target

    Server.exe

  • Size

    93KB

  • MD5

    d4e69f46ac4bd8fb65d2fb60852708a4

  • SHA1

    92b82d575a7ec29727477f449b04c4a6e29e52a4

  • SHA256

    7197c0f6310135ffe9e34af0c013bce6443d705659ab35310b052f2f5ea43e0d

  • SHA512

    d90d5a09024a44a3e647081e5a1642c78b14061f41590f07e69b625a406397bac471091314f07d51c81d13c97625abdf787d0b6405125b9c38dc356ad6b0271f

  • SSDEEP

    1536:v5rnEoSnsqS5ut/YMR8SjEwzGi1dDqDEgS:v53SnsqS5uVYM+7i1d09

  Score

  8^/10

  evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2