cdff57212816c50f3fd6c8dd8f9614be91028c40a571af87a8528e22ce571ee4 | Triage

Sharing

General

Target

cdff57212816c50f3fd6c8dd8f9614be91028c40a571af87a8528e22ce571ee4
Size

3KB
Sample

241120-re6byssmal
MD5

c4c3380493698fd58c4d74f60221523d
SHA1

3c4496c4956db5dc7706810591ea07fb62f4f763
SHA256

cdff57212816c50f3fd6c8dd8f9614be91028c40a571af87a8528e22ce571ee4
SHA512

e7d228d49d0abcb15af741eb57cd2068eb086a1d7e292fde326fd8d37f4dbe916acb27a6f99431e4c0bf64de7d86a2913bf40338274cfd6930d50cd68a2cd6cb

Score

8^/10

execution

Malware Config

Targets

- Target
  
  cdff57212816c50f3fd6c8dd8f9614be91028c40a571af87a8528e22ce571ee4
- Size
  
  3KB
- MD5
  
  c4c3380493698fd58c4d74f60221523d
- SHA1
  
  3c4496c4956db5dc7706810591ea07fb62f4f763
- SHA256
  
  cdff57212816c50f3fd6c8dd8f9614be91028c40a571af87a8528e22ce571ee4
- SHA512
  
  e7d228d49d0abcb15af741eb57cd2068eb086a1d7e292fde326fd8d37f4dbe916acb27a6f99431e4c0bf64de7d86a2913bf40338274cfd6930d50cd68a2cd6cb
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2