General
- Target setup.exe
- Size 4.4MB
- Sample260603-ymst6aes3x
- SHA256 3d68db23cf4c1cb78bd8ac5b713ea32da061ae48e6798dc660568d5c09db89b9
- MD5 943e9ee0f41214004e23b2ed85d412b8
- SHA1 76426039670915cd4f9a9c4f278e1d78c9356954
- SHA512 b4fbee24e3d2234bc3ae2ea443467505a95446d7238dd20e357bb3860987b5aef5609342b2cfd6d55acbe6714bc4ad59bab28f230e093df044a62e0e51e39e01
- SSDEEP 98304:Wf7wCQInrje/CAVMJy1WPkzXdUAQ2iRTN:Wfn6/VSlPkpUrTJ
- TLSH T1DD263300E7D32435F87108385E01A5787E13B7B665C5A0661FBCDF9F0EB9287B9B69A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Targets
-
- Target setup.exe
- Size 4.4MB
- SHA256 3d68db23cf4c1cb78bd8ac5b713ea32da061ae48e6798dc660568d5c09db89b9
- MD5 943e9ee0f41214004e23b2ed85d412b8
- SHA1 76426039670915cd4f9a9c4f278e1d78c9356954
- SHA512 b4fbee24e3d2234bc3ae2ea443467505a95446d7238dd20e357bb3860987b5aef5609342b2cfd6d55acbe6714bc4ad59bab28f230e093df044a62e0e51e39e01
- SSDEEP 98304:Wf7wCQInrje/CAVMJy1WPkzXdUAQ2iRTN:Wfn6/VSlPkpUrTJ
- TLSH T1DD263300E7D32435F87108385E01A5787E13B7B665C5A0661FBCDF9F0EB9287B9B69A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Drops file in Drivers directory
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.