Extracted

• • Target

    596d70406bbdb48846e0cf664fad89280c3db7ec1962f6ba81f94959068e23deN

  • Size

    92KB

  • MD5

    50dc90e5deb892a3ce56a22ea460da30

  • SHA1

    98bcb8f0077f0a053a0ef3de0f4db61af9788d06

  • SHA256

    596d70406bbdb48846e0cf664fad89280c3db7ec1962f6ba81f94959068e23de

  • SHA512

    5a0cd62538fbf998c0e7406b5832c897c09835e80de7cb078882640cd8e78d75f9a178392fe565c7786b0db831f0c4e4f9869b6d9ca8cb28596398fae03d02b2

  • SSDEEP

    1536:HVyoNlCss8VB/IckKynaBG7ctwPHetky:H3Sss8VB/7maBG7QwPet

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2