Resubmissions

10-11-2024 01:42

241110-b41vrswgrj 8

10-11-2024 01:38

241110-b2c1xswkft 8

10-11-2024 01:32

241110-bx637swjhx 8

General

  • Target

    fnaf plus restored.exe

  • Size

    937KB

  • Sample

    241110-b41vrswgrj

  • MD5

    10fccccf042d47d4bf56bb1bc5e04273

  • SHA1

    42268e93106a8b9831f1750dbda236137d37542c

  • SHA256

    60ccfd2af3e5f68d1b1fa36140e97a65411f0ce26da19768933cd5128fe342fb

  • SHA512

    ef5f4cca065311aae4b3d35c74de5d2daeebb36396e0a15fa5a544460ccb8ef82dd2efa7efae1afa0bb76468e9986c2e3dfa37cfbca1c01ca212c9379b3b36a9

  • SSDEEP

    12288:qUDU9hdC/8PqDaPcUewtn10Gkt+Tu8mTLUyitik5ZEXhttD:qIU9hB5Bkt+TmYti8ZErtD

Malware Config

Targets

    • Target

      fnaf plus restored.exe

    • Size

      937KB

    • MD5

      10fccccf042d47d4bf56bb1bc5e04273

    • SHA1

      42268e93106a8b9831f1750dbda236137d37542c

    • SHA256

      60ccfd2af3e5f68d1b1fa36140e97a65411f0ce26da19768933cd5128fe342fb

    • SHA512

      ef5f4cca065311aae4b3d35c74de5d2daeebb36396e0a15fa5a544460ccb8ef82dd2efa7efae1afa0bb76468e9986c2e3dfa37cfbca1c01ca212c9379b3b36a9

    • SSDEEP

      12288:qUDU9hdC/8PqDaPcUewtn10Gkt+Tu8mTLUyitik5ZEXhttD:qIU9hB5Bkt+TmYti8ZErtD

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks for any installed AV software in registry

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks