Extracted

• • Target

    New Client.exe

  • Size

    167KB

  • MD5

    ea8325729b4d3ad91721963c248f4f14

  • SHA1

    7762ab41a36fb2fbebfa571a24cab2615fe0f8ff

  • SHA256

    1347beb5a4dc0986d497024cce174137c51d74b7bcaca7a038ac39389b8a0f84

  • SHA512

    bad7f93110a6788a193f7d1e888901853f25796fa5d1386e1275770949b50b2a1f54667c4baf00df04ca939424dd17abe37a4260d518df242313b4967e0f0da7

  • SSDEEP

    3072:vCmG/oN36tcQviFC1xCBn6fWl9zWaF9b6YvMhUJ8T2SXZyrgoBJtbN/3MCK2kev0:v+xw9z1vMN/JdSI5eb

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1