Extracted

• • Target

    6289a6f437dbe477d4648b112653a1e6de8c191489671d3e2fd51a31946103bd

  • Size

    93KB

  • MD5

    83f90cb80993c51fe93a9f341922a3c8

  • SHA1

    0fb07736f3a7be6f69e17525e32337bd88ff4fd6

  • SHA256

    6289a6f437dbe477d4648b112653a1e6de8c191489671d3e2fd51a31946103bd

  • SHA512

    7600ce9c8e603b2329c2fd98d36143ccb52ff6e11a2679c8cc47b1ce78938c752003c4d482c6fbfe5ad22f5e4594b72f5ed46443e9c2b0b7483116757a529c4f

  • SSDEEP

    768:4Y3TVfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3rTYsGdpv:TV5WhIUKcuOJhPhBjEwzGi1dD3gDPgS

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2