Extracted

• • Target

    Umbrella.flv.exe

  • Size

    93KB

  • MD5

    e0c869b42c00f9a6f37200c870e410af

  • SHA1

    e8533ba02dff440c2ed561d012a5f7db931dbe63

  • SHA256

    5c854b85f62ea27660d8a371bd085771d17812e21ac1066a80f176dd5ee6e791

  • SHA512

    6f14952004d9df8d5b6c79b2afd669b4b75851ff72ddff49f5b8ebba5fc04a64716dcd77761a863bc3dfb1bcef00591b7431056774efd72c296fe29fcd3fce43

  • SSDEEP

    1536:GyIQIBlfGQFk2ZonmzlMxjEwzGi1dDhDIgS:GyOtFk2ZonmZMOi1dFx

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1