General
- Target digital-magicians.zip
- Size 3.0MB
- Sample260629-ph2rtsez3l
- SHA256 6c4601ef63fa80419a4abc0ff20338200201b08beb44ab04f91f57ab73497eb5
Score
7/10
Malware Config
Targets
-
- Target libiconv-2.dll
- Size 1.1MB
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
Score1/10 -
- Target libidn2-0.dll
- Size 251KB
- SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
Score1/10 -
- Target libintl-8.dll
- Size 301KB
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libpsl-5.dll
- Size 2.4MB
- SHA256 c9ff9a1c70d0326468eebfb6c6edfe5dc7350a9e79c3c3e14d7f93b0893c3565
Score7/10-
Executes dropped EXE
-
- Target libunistring-5.dll
- Size 2.1MB
- SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
Score1/10 -
- Target psl.exe
- Size 64KB
- SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
Score6/10-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1