Extracted

• • Target

    2162d29eb849e9c799f3a951e52c9d4d.exe

  • Size

    93KB

  • MD5

    2162d29eb849e9c799f3a951e52c9d4d

  • SHA1

    386cb6a7cf616dbce0823f6ff23c1cbcb1d302e5

  • SHA256

    150046fc66a80e4668fc08417e422c5f97489831823c898b50ca4ed6bc5a6f12

  • SHA512

    64ce9074fe48c0a7bd640ff9f00f56da340f0cc2d13e34c3aa5bccf00f675287b02e7aaa73252669ff9591d646b9c400e0af11efe710ccceca4aeed59d7a323a

  • SSDEEP

    1536:oGlTr1IDavlZhbSc39YdjEwzGi1dDhDrgS:oGlSDavlZI8mqi1dtk

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2