General
-
Target
FanControl.zip
-
Size
6.3MB
-
Sample
241121-wqmq7svjdz
-
MD5
542253310b141f47cd141665a3bb4324
-
SHA1
c07dd32580155be69278ee7526b08d547c61dd02
-
SHA256
c416db4cda367c4e1f8d45bc3e308bcfde7e958bdd8029d92e31599e0d764dd1
-
SHA512
0f7b7cde0980aed7f7f0780188a072326ce0885124e741f4f8d3a49ecd6e9b9cc2dabc77a21c04655e0019a9e72aacb45ca2b8ea2979bdd266838eff368ac686
-
SSDEEP
196608:XV0h0C9RGiXit6Al9gGsMlcXh/O+o+H2zo5kSI8VHkGm:XVIGiXiNgGsvhW+o+HMo5kSFkN
Malware Config
Targets
-
-
Target
FanControl.exe
-
Size
1.3MB
-
MD5
9b94d3f94fae042147cbe5dc8009370f
-
SHA1
3116e6fa60f5cd0d580ff748d6ae0499e7534ff2
-
SHA256
6d99e5b8af7bd2312f7d3aa2e42514ceb40ed3203dfc669558e8d5d0879c724b
-
SHA512
1ee4b0a0d5a5eee964f20f875b6c0254086b4ac2925e47be64e943e4bff97be2b536ebb787dd9390160649ccda6a29f3134800901880458c407695186c5dab71
-
SSDEEP
6144:ny2M4ziRCIr+bDy/oUMs2p+pGv1xPGUD5p7aQNwul3k8+uiOiK6kU2SPSC5rII2e:ny2M/CIr+bG/oE2cI/uUjtNu/rf/3pP
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-