General
-
Target
https://cdn.discordapp.com/attachments/1239664136208646184/1272013828774957119/CeleryInstaller.exe?ex=66b96eb1&is=66b81d31&hm=e6328c786775a541be817db34b17ecc6b72dcb286be58333ac0587e237e140b1&
-
Sample
240811-f1qmva1blc
Score
8/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1239664136208646184/1272013828774957119/CeleryInstaller.exe?ex=66b96eb1&is=66b81d31&hm=e6328c786775a541be817db34b17ecc6b72dcb286be58333ac0587e237e140b1&
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Network Service Discovery
Attempt to gather information on host's network.
-