Extracted

• • Target

    0x000b00000001225f-4.dat

  • Size

    48KB

  • MD5

    2c8e6b45f0113b45f9187b60df114fef

  • SHA1

    7e7b6f59fced74c16bef14f03f19eeecb5d34103

  • SHA256

    476328c1ba85a1df9b0e678b9219dd1d5e529596303896049797683f20ad23e2

  • SHA512

    3a415e14ce61e0dfbdd1064f39b129f11ee1419442c49209e62c90d54d57b4a9ef8544f2108bf562ec9d8c9dd3daa3221a4b670918ba48af68ca439921301337

  • SSDEEP

    768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ohPC:Ub1MsHz3JDwhyWr+N95OTga6L

  Score

  8^/10

  discoverypersistence

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2