Overview
overview
8Static
static
30_russia_u...le.cmd
windows7-x64
80_russia_u...le.cmd
windows10-2004-x64
81_russia_b...st.cmd
windows7-x64
11_russia_b...st.cmd
windows10-2004-x64
11_russia_b...BE.cmd
windows7-x64
11_russia_b...BE.cmd
windows10-2004-x64
11_russia_b...LT.cmd
windows7-x64
11_russia_b...LT.cmd
windows10-2004-x64
11_russia_b...ir.cmd
windows7-x64
11_russia_b...ir.cmd
windows10-2004-x64
12_any_country.cmd
windows7-x64
12_any_country.cmd
windows10-2004-x64
12_any_coun...ol.lnk
windows7-x64
32_any_coun...ol.lnk
windows10-2004-x64
72_any_coun...ir.cmd
windows7-x64
12_any_coun...ir.cmd
windows10-2004-x64
1service_in...st.cmd
windows7-x64
1service_in...st.cmd
windows10-2004-x64
1service_in...BE.cmd
windows7-x64
1service_in...BE.cmd
windows10-2004-x64
1service_in...LT.cmd
windows7-x64
1service_in...LT.cmd
windows10-2004-x64
1service_in...ir.cmd
windows7-x64
1service_in...ir.cmd
windows10-2004-x64
1service_remove.cmd
windows7-x64
1service_remove.cmd
windows10-2004-x64
1x86/WinDivert.dll
windows7-x64
3x86/WinDivert.dll
windows10-2004-x64
3x86/WinDivert32.sys
windows10-2004-x64
1x86/WinDivert64.sys
windows10-2004-x64
1x86/goodbyedpi.exe
windows7-x64
1x86/goodbyedpi.exe
windows10-2004-x64
3Analysis
- max time kernel
118s - max time network
124s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
09/11/2024, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
0_russia_update_blacklist_file.cmd
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
0_russia_update_blacklist_file.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
1_russia_blacklist.cmd
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
1_russia_blacklist.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
1_russia_blacklist_YOUTUBE.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
1_russia_blacklist_YOUTUBE.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
1_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1_russia_blacklist_dnsredir.cmd
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
1_russia_blacklist_dnsredir.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2_any_country.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
2_any_country.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
2_any_country_dnsredir - Kısayol.lnk
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
2_any_country_dnsredir - Kısayol.lnk
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2_any_country_dnsredir.cmd
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
2_any_country_dnsredir.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
service_install_russia_blacklist.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
service_install_russia_blacklist.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
service_install_russia_blacklist_YOUTUBE.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
service_install_russia_blacklist_YOUTUBE.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
service_install_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
service_install_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
service_install_russia_blacklist_dnsredir.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
service_install_russia_blacklist_dnsredir.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
service_remove.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
service_remove.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x86/WinDivert.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
x86/WinDivert.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x86/WinDivert32.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
x86/WinDivert64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x86/goodbyedpi.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
x86/goodbyedpi.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target x86/goodbyedpi.exe
- Size 98KB
- Sample241109-2vqljstja1
- SHA256 66e202c9fce9e769e2bc791b7fd6f56f21eab59f607f4ed0724e0c68c430dd1f
- MD5 9c3f16d5a0aff180f9d04ae6c0fe1f28
- SHA1 c0febd0e54c2a335ee348233e9555eef4816663e
- SHA512 746ccd373f025d95ca4f55cb212ba6b259a6f17d7e2c5807940cc0d1d31ea61c943a6aa4fc91b2ec432ed1d04ffee4b4c3b78db2cdbb474399313bf26f56a4ac
- SSDEEP 3072:wjnafjFO9vbnTrjP7HzfLXDvnTr3jP7HzfLXDvbnT/rjI3XLS84mUgIDJO:46RO9vbnTrjP7HzfLXDvnTr3jP7HzfL2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found