Extracted

• • Target

    Server.exe

  • Size

    37KB

  • MD5

    b3d12b297a856103adb57f5492cd6851

  • SHA1

    2a6ebc4e929ed73ecc3720ae01d3d16e8f7b6089

  • SHA256

    83b66e30244b1729ebbaf9f0921fd51c0337e638665fa1ab01e8d8237a7fe80c

  • SHA512

    54d38f293feb0cb43dbcd9c8ac3b787e087ce471ced0a0ce7aa72a24d43acdf4d5210633832a68def43fd5c6561069353fdb6eb29ced28cbebbf27c302481cb8

  • SSDEEP

    384:b1tcaCisx/WRdL5kyc/Tant5ngCmxorAF+rMRTyN/0L+EcoinblneHQM3epzXCNV:RtcmD5nc/TaPNmyrM+rMRa8Nucpt

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1