Extracted

• • Target

    Server.exe

  • Size

    93KB

  • MD5

    d43643e01d59c289b551c240242ea5cd

  • SHA1

    aa17e80aac2ca4e14297b0a7cf29c85b116882c6

  • SHA256

    e160f4bae8005bb78e9719ab69ce72ba4a9a8d0117498c6e0bafde9963eef460

  • SHA512

    4143358f507836da62db5f91fccf50d531b79bc5893d7f09d1929f597924a7e2f6b157ea0cec129c9d7c87853e19596714e918204e5ce074a0aa5dec523cbfdd

  • SSDEEP

    768:sY35xByZnDQMMpAZrGSt6udttXymsahkGJiXxrjEtCdnl2pi1Rz4Rk3YRsGdpUgM:NxUZD3rGWNd7DhkhjEwzGi1dD8DUgS

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2