General
-
Target
https://drive.usercontent.google.com/download?id=1br31_joVUJFoOuh_TDJLp45EGzCF-Nh5&export=download&authuser=0&confirm=t&uuid=8b560d0d-c44a-49ee-85c5-7897855de2ab&at=APZUnTVLUD-68WmdQ4pgw_r02jUV%3A1723098302251
-
Sample
240808-g648vstgqh
Score
8/10
Malware Config
Targets
-
-
Target
https://drive.usercontent.google.com/download?id=1br31_joVUJFoOuh_TDJLp45EGzCF-Nh5&export=download&authuser=0&confirm=t&uuid=8b560d0d-c44a-49ee-85c5-7897855de2ab&at=APZUnTVLUD-68WmdQ4pgw_r02jUV%3A1723098302251
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-