Extracted

• • Target

    MailUpdate.exe

  • Size

    93KB

  • MD5

    9269b1758a4151f9b49c11967ac76628

  • SHA1

    cdb7ede668e9f9b69950e29ca3e05b76daa1c0fc

  • SHA256

    abfcae799cbe35f002f71a15bea7e666654effbaa3a736a472beb98addb09c2d

  • SHA512

    0644e2fce92204f07172ecc7c36077784688c7c16cd97e121e8a0d3444c0c2507e765cb14b7421055731996de70de97785c518e60c3b4a2903bfc85496aefd32

  • SSDEEP

    768:GY3m84BMPdPwchQW6aGro1CRaXPKG548gmKXxrjEtCdnl2pi1Rz4Rk3ssGdpZgS7:s8GMlP6aGrwCCX4ljEwzGi1dDEDZgS

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2