c6d351798633b4fad9637ab9f59beb9aa802e90ae3eee68e5c24847ca494e199 | Triage

Sharing

General

Target

c6d351798633b4fad9637ab9f59beb9aa802e90ae3eee68e5c24847ca494e199
Size

3KB
Sample

241119-v9l4catnel
MD5

f2f8d4549dd0dd0f7ec798a754638847
SHA1

ce36594b2a50400f2ca89ad9680b47cd414d4412
SHA256

c6d351798633b4fad9637ab9f59beb9aa802e90ae3eee68e5c24847ca494e199
SHA512

cc601bc63a6b3564f2c4fbbe37b121671a1a35d200e67ce9b355fba01b0e50c58dc1f5c159d2379445219692a3b8d8d945e2fd53cef15d18ddb56a004dc9b0d4

Score

8^/10

execution

Malware Config

Targets

- Target
  
  c6d351798633b4fad9637ab9f59beb9aa802e90ae3eee68e5c24847ca494e199
- Size
  
  3KB
- MD5
  
  f2f8d4549dd0dd0f7ec798a754638847
- SHA1
  
  ce36594b2a50400f2ca89ad9680b47cd414d4412
- SHA256
  
  c6d351798633b4fad9637ab9f59beb9aa802e90ae3eee68e5c24847ca494e199
- SHA512
  
  cc601bc63a6b3564f2c4fbbe37b121671a1a35d200e67ce9b355fba01b0e50c58dc1f5c159d2379445219692a3b8d8d945e2fd53cef15d18ddb56a004dc9b0d4
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2