General
- Target Копия трудовой.docx.rar
- Size 1.6MB
- Sample240625-pre97ashqk
- SHA256 fb28ec498a67d1cf4ebcbb358d1cad0ab86eada614198bdd5dfe3c61e464c1e7
Score
10/10
Malware Config
Targets
-
- Target Копия трудовой.docx.rar
- Size 1.6MB
- SHA256 fb28ec498a67d1cf4ebcbb358d1cad0ab86eada614198bdd5dfe3c61e464c1e7
Score3/10 -
- Target Копия трудовой.docx.exe
- Size 1.8MB
- SHA256 60414e88a21df60b0caccdf498b41aa7c75c10d880ab61a620f5b13ba2faebd1
Score8/10-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
- Target $TEMP/Copy_trydovoj.docx
- Size 1.5MB
- SHA256 8646226f4b2b2b96d5e31d4daae0ac5484edc2a7759297e0f63a06358ea61a38
Score4/10 -
- Target $TEMP/putin_hyilo.exe
- Size 176KB
- SHA256 6e9d23e7b4a677651ccb362fa6833ca13deef184a45a801cb1d7d1f542210809
Score10/10-
DarkTrack
DarkTrack is a remote administration tool written in delphi.
-
DarkTrack payload
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext