Extracted

• • Target

    Server.exe

  • Size

    93KB

  • MD5

    fccac9bf6c83173de191751a3cc75688

  • SHA1

    5a5f6db3aa85d921707822af7be0f749c00699f6

  • SHA256

    c33fd04b22feb761253055d2674a112d6b527aa3f78e585d1f2d26df3e8512e7

  • SHA512

    db453c4df92e6c274a6e558ed2a95ab4b22d17887dcebaf4760f9e7f2e0d6fc7e2cbe05f4e52690a54414bb466e39f85550535bede6e0979fe7e3499f19c487b

  • SSDEEP

    1536:xkAY3SUFKnOr70txlZbgoGXejEwzGi1dDQDJgS:xkt7KnOr70txIXni1d+G

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2