Extracted

• • Target

    a4cdb56a6b905ad47a796da718a187e862fee0e713755f97cc197838f3111e28.exe

  • Size

    48KB

  • MD5

    bfa4248005947726368f38380aab0158

  • SHA1

    bf5d8ea3d634bd1b7ec164a2e3659c7ba8f96148

  • SHA256

    a4cdb56a6b905ad47a796da718a187e862fee0e713755f97cc197838f3111e28

  • SHA512

    78071ca4b44c193eae004519a4d2777e4bd1fbd277bbd860d07186d165e86328b3b8af903c1846068e4d4852bb7ef37256bac364f97363b150b717413c9a0d64

  • SSDEEP

    768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67xhPC:Ub1MsHz3JDwhyWr+N95OTga6C

  Score

  8^/10

  discoverypersistence

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2