Extracted

• • Target

    New Client.exe

  • Size

    65KB

  • MD5

    ed689865c39b6ef12d27909bad36afe0

  • SHA1

    f6e672c9a38ff700a8eda0ec996db345a1b2cb69

  • SHA256

    93f13afc6fb08fbc77cf965e24af63a3d62826946df4e7c89d1a159c7f6a2791

  • SHA512

    c1438eef5909e753f332129ca5ca66f12f91e14e82ae41482b987e6cfc3355861815fb59571afb629293b1c7327c44ca8034716bd74c4db0251f933dc6c287d8

  • SSDEEP

    1536:zWnyCIUoN36tXQviFw1IssUBnvAQIfLteF3nLrB9z3nQaF9bES9vM:zWnyCIUoN36tXQviFCbRBnNIfWl9zAa0

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1