General

  • Target

    791cc8b5150b5d224858062fecee0b202bc1dda178c428dbf99987fd0e46c46fN

  • Size

    1.9MB

  • Sample

    241112-ny6v2svnfj

  • MD5

    d30c418dd9828690dd8d7cd6f8eacde0

  • SHA1

    2cec53c79697648abbbc78587f879093d1640e77

  • SHA256

    791cc8b5150b5d224858062fecee0b202bc1dda178c428dbf99987fd0e46c46f

  • SHA512

    6e6c9629d711c5af37e0ad60f22c3d2158b5b0ce4a4de49bff1b3ebdc8d456c8b6f66d3875858ee1e20ab1609018d207f05358ce88c1638cbd0d6104ecaffef7

  • SSDEEP

    49152:CLIUXQgBiI6i2KFU0yBfM7a9QDosGeo403e0CpcKYGIDlWIwRBOn5PvGYKMf/1Zx:SIUXQgBiI6i2KFU0yBfM7a9QDosGeo40

Malware Config

Targets

    • Target

      791cc8b5150b5d224858062fecee0b202bc1dda178c428dbf99987fd0e46c46fN

    • Size

      1.9MB

    • MD5

      d30c418dd9828690dd8d7cd6f8eacde0

    • SHA1

      2cec53c79697648abbbc78587f879093d1640e77

    • SHA256

      791cc8b5150b5d224858062fecee0b202bc1dda178c428dbf99987fd0e46c46f

    • SHA512

      6e6c9629d711c5af37e0ad60f22c3d2158b5b0ce4a4de49bff1b3ebdc8d456c8b6f66d3875858ee1e20ab1609018d207f05358ce88c1638cbd0d6104ecaffef7

    • SSDEEP

      49152:CLIUXQgBiI6i2KFU0yBfM7a9QDosGeo403e0CpcKYGIDlWIwRBOn5PvGYKMf/1Zx:SIUXQgBiI6i2KFU0yBfM7a9QDosGeo40

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks