General
-
Target
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356
-
Size
559KB
-
Sample
241223-erwbaswjex
-
MD5
fa390993690c321f7b6d91b55888695a
-
SHA1
0eb8074db8a0d0fa794bb1e33d1d4a56695948f1
-
SHA256
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356
-
SHA512
42967942e180d14eef1baa346cc6c6fea370831efefa51c4b2cadfafc232ffc20d15fbb1ce4f95f2350609a15f89fa1942754465ce97e57c212cecdd467974f7
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSE:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl2
Behavioral task
behavioral1
Sample
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356
-
Size
559KB
-
MD5
fa390993690c321f7b6d91b55888695a
-
SHA1
0eb8074db8a0d0fa794bb1e33d1d4a56695948f1
-
SHA256
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356
-
SHA512
42967942e180d14eef1baa346cc6c6fea370831efefa51c4b2cadfafc232ffc20d15fbb1ce4f95f2350609a15f89fa1942754465ce97e57c212cecdd467974f7
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSE:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl2
-
Darkcomet family
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-