Extracted

• • Target

    Payload11.exe

  • Size

    36KB

  • MD5

    8b01ebe394a150cceeeff126c468d63d

  • SHA1

    0426461755be9784fcfc69a4103b77d7069d4436

  • SHA256

    4111f9ff25410257b04574397c758b2aed91523f5d4bc82f3d5e5c5e302c8db0

  • SHA512

    5dcfae074d537ff27950cef6029dfffaf6ef0457f7c8af5edc5f95e1377b81cca3fdb2723a5ec0d2f30364adb0f9b54f6b48b854c9d228c2a999203575a933ba

  • SSDEEP

    384:ILmBh0yOAUf9p7fAvWSJyP934WaUMNAQk93vmhm7UMKmIEecKdbXTzm9bVhcanhM:2i493UTNA/vMHTi9bDnqn

  Score

  7^/10

  discoverypersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1