General
- Target if your seeing this i got head.zip
- Size 171.7MB
- Sample260708-jqq3eady4k
- SHA256 f93b1a7b34d44945cc826092bb3dfef34c68f3730e8dd283362cec646dc10ec0
Malware Config
Targets
-
- Target OverlayDLL/OverlayDLL.sln
- Size 1KB
- SHA256 4f13bbc92e99d2d2175470d58ba772a7eba98cd1b53cb63a8fa41ad311fcbf47
Score3/10 -
- Target OverlayDLL/OverlayDLL.vcxproj
- Size 6KB
- SHA256 d9233dfef7969f477cadc0df481973e710e5c536d1d85827acac8f346009a39a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target OverlayDLL/OverlayDLL.vcxproj.filters
- Size 977B
- SHA256 c06a15e597a68a248263c0e417b21b4b5f32fbd6685871d10e8cc5a22db2cfc3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target OverlayDLL/OverlayDLL.vcxproj.user
- Size 168B
- SHA256 c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target OverlayDLL/main.cpp
- Size 13KB
- SHA256 874453df3204f2037c1a4cb40b40a3a858e3fdbf82a63dc3023d4286e7203c5c
Score3/10 -
- Target Redock/Redock.sln
- Size 1KB
- SHA256 84d61db0ebf0178ae884ec18a6b996386e82d72be9cdfdfef8942ffbd0ce9572
Score3/10 -
- Target Redock/Redock.vcxproj
- Size 9KB
- SHA256 aa26c6f491d3466af10bcf0816f4e23d731b99eab0e7dff588293233de32b6d3
Score3/10 -
- Target Redock/Redock.vcxproj.filters
- Size 1KB
- SHA256 cdb6bd4a7ac958d9c94c5e30a5bd0578b9ad554a29261074162b970826f510b9
Score3/10 -
- Target Redock/Redock.vcxproj.user
- Size 225B
- SHA256 a0c24e8908c9bcc5eb33cdd38762da3a86013fe87f0c681238ec4bcee56d15e1
Score3/10 -
- Target Redock/Redock/x64/Release/Redock.log
- Size 164B
- SHA256 d16ad146d95934460efebf3bb1ce255a259d9141dbd950ce5543e3fb3f47b87d
Score1/10 -
- Target Redock/Redock/x64/Release/Redock.tlog/CL.command.1.tlog
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
Score3/10 -
- Target Redock/Redock/x64/Release/Redock.tlog/Redock.lastbuildstate
- Size 175B
- SHA256 37cd82cfb76c5823717db2ac66905e009f369209386a4a0ad53463019b09b369
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Redock/Redock/x64/Release/vc143.pdb
- Size 425KB
- SHA256 67d75d78406b79e18517756ab082760e10c57abd9db14cfaf8f94047ba66b7dd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Redock/main.cpp
- Size 36KB
- SHA256 f1ff69e15ade76b63c93863538f454ebe3bc9c6471fc7b9ac23c0801916ad3f1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Redock/packages.config
- Size 246B
- SHA256 e09fcb3cd5a69bf3e35521001979f4b1c3aad9f43476d1ec3922d121c7e9f837
Score3/10 -
- Target Redock/packages/Microsoft.AI.DirectML.1.15.4/.signature.p7s
- Size 25KB
- SHA256 3f12038e78f0cb27cfb2ca60979e8bc8f1e3c7500b6e1ebd696660c0c8a019a7
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory