Extracted

• • Target

    1dde43cdcb278b5fe4d8970da4fb31cf.bin

  • Size

    93KB

  • MD5

    1dde43cdcb278b5fe4d8970da4fb31cf

  • SHA1

    98d8bdf90eda8545e6674033932af4443cf072ac

  • SHA256

    2ffc5d7602a7c79b149f2dc4fe9d4ae8f1e38bf8ebc5a07029451871e243de10

  • SHA512

    f199cce436129133bcdb39aca5ecf393a7fadc0a10bc38978dad94c3a41429299b49973796edeffb8b016182ca1c213ec1f175085c381adaa807190d6287f27a

  • SSDEEP

    1536:N+RnEoSnsqS5ut9YDR8SjEwzGi1dDeDVgS:N+tSnsqS5uTYD+7i1dwi

  Score

  8^/10

  evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2