df39e30f987a58e34b1b83c0ba97a735eb51a72aa9f5ed7eb4a9f1efea825be3 | Triage

Sharing

General

Target

df39e30f987a58e34b1b83c0ba97a735eb51a72aa9f5ed7eb4a9f1efea825be3
Size

1.9MB
Sample

240810-tslwksxdjk
MD5

a636e96b87f34849e78e7ef05dac1c64
SHA1

c4ef5a41c3d6dfea343aa5ce4d0bdc3c9ac1b772
SHA256

df39e30f987a58e34b1b83c0ba97a735eb51a72aa9f5ed7eb4a9f1efea825be3
SHA512

789a537876cd0036bed00e5aba6253c3160a40839427e938af3ad8e3f8b2e35ab7f4a9aeeb1bc845ae9d08b5103d99a99358f73aadd7aad0d94c91bd0bf0624d
SSDEEP

49152:apTyLCk/1X7z/45tBTW0qKN+1zhb1XLHactnbJA44RxkcU5A:apTIf26nrYxkb5

Score

7^/10

Malware Config

Targets

- Target
  
  df39e30f987a58e34b1b83c0ba97a735eb51a72aa9f5ed7eb4a9f1efea825be3
- Size
  
  1.9MB
- MD5
  
  a636e96b87f34849e78e7ef05dac1c64
- SHA1
  
  c4ef5a41c3d6dfea343aa5ce4d0bdc3c9ac1b772
- SHA256
  
  df39e30f987a58e34b1b83c0ba97a735eb51a72aa9f5ed7eb4a9f1efea825be3
- SHA512
  
  789a537876cd0036bed00e5aba6253c3160a40839427e938af3ad8e3f8b2e35ab7f4a9aeeb1bc845ae9d08b5103d99a99358f73aadd7aad0d94c91bd0bf0624d
- SSDEEP
  
  49152:apTyLCk/1X7z/45tBTW0qKN+1zhb1XLHactnbJA44RxkcU5A:apTIf26nrYxkb5
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2