Overview

overview

8

Static

static

3

GeforceNOW.exe

windows7-x64

1

GeforceNOW.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    GeforceNOW.exe

  • Size

    1021KB

  • Sample

    240625-r3d8dayfqj

  • MD5

    c8452c109b168c1f997cc164005cf304

  • SHA1

    8d7cea037b395034469e7b8809c16bf5e354ee67

  • SHA256

    ea0ed78d73dda601a8bf6d11944ed7e6be8bbae6d7c88a49197c3e3a4d19b041

  • SHA512

    8ee4701e5dcd185e0d457280034283a0c12ca37dbc5a3740b2d58e625b6dfab72f787c1cb36e155d9c32126bf3ef07e3929cbdbc06052f46699ad72e29431f11

  • SSDEEP

    24576:Vr+NMrk4KaRnlLJyg/gTfnVARmnjQP1sUI:Vr+u/lyWqVAonjNUI

Score
8/10
execution

Malware Config

Targets

    • Target

      GeforceNOW.exe

    • Size

      1021KB

    • MD5

      c8452c109b168c1f997cc164005cf304

    • SHA1

      8d7cea037b395034469e7b8809c16bf5e354ee67

    • SHA256

      ea0ed78d73dda601a8bf6d11944ed7e6be8bbae6d7c88a49197c3e3a4d19b041

    • SHA512

      8ee4701e5dcd185e0d457280034283a0c12ca37dbc5a3740b2d58e625b6dfab72f787c1cb36e155d9c32126bf3ef07e3929cbdbc06052f46699ad72e29431f11

    • SSDEEP

      24576:Vr+NMrk4KaRnlLJyg/gTfnVARmnjQP1sUI:Vr+u/lyWqVAonjNUI

    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks