Extracted

• • Target
    New Client.exe
  • Size 65KB
  • SHA256 30d2f34c8d8200a516b0fd2693ca8614782b50ce71ec05112a663a376caef29d
  • MD5 775ca382fbf8317b2ddceaceb2a22194
  • SHA1 92567c9e4660986f21a3ccac9ffffa4348c0ea91
  • SHA512 f800ab390e054e6939cafb9c316819fe767457cc43d1a45f4c2d9ed8f29708fbab668141ee4c8e829d73c355a119323415a013a69a586650a61a1648cb06038b
  • SSDEEP 1536:gjAUQoN36tuQviFw1zG5KBnvb8fLteF3nLrB9z3nFaF9bRS9vM:gjAUQoN36tuQviFCSIBnAfWl9z1aF9bF
  • TLSH
    T115633A4877958A15D2BD2E7844F296518730E60B6D03F72E4CD170FAABB3EC44A42BE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryexecutionpersistenceadwarebootkitspyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2