General

  • Target

    MyPhoneExplorer_Setup_2.1.exe

  • Size

    20.1MB

  • Sample

    241112-sbdyzayjbj

  • MD5

    1ef4269e582ecf2e1fcd839687a0cf11

  • SHA1

    f5c985ae1bcddccaab3eb18332601a760d8e5123

  • SHA256

    78089dfa12809b5886609bcf20f31c57897da796d17b696a902179a2397addfa

  • SHA512

    a23158a52e8cbe059fa57dee029f2f2d7b2e094e64cb3ba5fa664fff0a7348850e487c70bf663332423586990ce73caaa3eb28336bfe8d191f9a57fe5239bce8

  • SSDEEP

    393216:tJpqFildOU4dmEN4Mu3Qxd4n/NMmMOUYJI8AfPo5HEsS5rnnYzYGkY+nVvY9U:tSudsBnd4nCaUYJI8cg5Hg5rnnYzncVf

Malware Config

Targets

    • Target

      MyPhoneExplorer_Setup_2.1.exe

    • Size

      20.1MB

    • MD5

      1ef4269e582ecf2e1fcd839687a0cf11

    • SHA1

      f5c985ae1bcddccaab3eb18332601a760d8e5123

    • SHA256

      78089dfa12809b5886609bcf20f31c57897da796d17b696a902179a2397addfa

    • SHA512

      a23158a52e8cbe059fa57dee029f2f2d7b2e094e64cb3ba5fa664fff0a7348850e487c70bf663332423586990ce73caaa3eb28336bfe8d191f9a57fe5239bce8

    • SSDEEP

      393216:tJpqFildOU4dmEN4Mu3Qxd4n/NMmMOUYJI8AfPo5HEsS5rnnYzYGkY+nVvY9U:tSudsBnd4nCaUYJI8cg5Hg5rnnYzncVf

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks