Extracted

• • Target

    New Client.exe

  • Size

    167KB

  • MD5

    51a555ab580218adcc9475aff3e8225a

  • SHA1

    2f3d05a20edfcd9b9ab3962fb8d236bc24c34414

  • SHA256

    b7b4040fde663dbae8f15ea47561d1259007c519532289d6fb4f9f6555ac5666

  • SHA512

    e9e1e3cdca3c2019a27d0ecc220528ed8e01c9607bfeab01a6671c55551d9731ce395aa9c8227e2b8f8b391fb4a631ad26e8a215c5c500100d30e3eb0356f78e

  • SSDEEP

    3072:O6MADoN36tnQviFCtABnqfWl9zxaF9blYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:O/i9zDvM1/JdSI5eb

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2behavioral3