General
- Target [Bypassfrpfiles.com]KING Soft new update v 5.8.rar
- Size 540.8MB
- Sample260623-k7xf7aby8v
- SHA256 08128aa8cab792ed7adada2308397c6db47c4fa6c3e1387d33a289c36ff87ae2
- MD5 defd9b8c1143b51fba1795143d7bb571
- SHA1 b325222839f9b511cb473207955b1f547049cdd2
- SHA512 8661aab0cba87d4603baee71e79c8dfb12632ef322bb913152f44f51c769c868f6ed99ade7209edc5b8b0baeb9ad205dbc37a2dfe905447da879fedeff2cf57a
- SSDEEP 12582912:uX2CEnTwz0VEfSX2mq3M2mMuzuuJFeRH5pFofgH0lyhBIf:eWESX2mg9uJFeigUMsf
- TLSH T15C4933D6631C32758CE58EDE165EC9FE77F14E5421B73CA08CE289BA2ADB44543343A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
[Bypassfrpfiles.com]mysetup.exe
Resource
win10v2004-20260513-en
21 signatures
300 seconds
Malware Config
Targets
-
- Target [Bypassfrpfiles.com]mysetup.exe
- Size 551.5MB
- SHA256 503f97f191cafeeb79f05a8540d4e55250f4244c0973426cca0da126bc4de359
- MD5 5e8e60ef970d0ce3c75b3727b0fe8d58
- SHA1 171abd93ec417e93b8de11c45d4f7e504410184a
- SHA512 587bbde14c10f8d5808dd437af0414bbb9c7641c834c68a93ce693c8692f5f03eaae32cf525da862e050ed92b709356211a98c97e4b1a3ddcc42a5520149e2d6
- SSDEEP 12582912:U4CJQdG+4Fy9OGDuCW8DGnsLnFGzR/+Fgr4NoPWgtj2LOv:U4CJQd4FIOyDcsrFGzR/+mePLOv
- TLSH T10659332DA5023E2CD1A9D1BB6E69816028B313357F238F1E37F1095FCF62496663964F
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.