General
- Target https://asana.com/de/download?utm_campaign=emea_de_de_mlti_signup_search_google_b_general&utm_source=google&utm_medium=pd_cpc_br&utm_content=emea_de_de_mlti_signup_search_search_google_mix_3p_all_low_funnel_asana_herunterladen&utm_term=asana%20download&gclsrc=aw.ds&gad_source=1&gad_campaignid=6757446367&gclid=Cj0KCQjwsMLSBhD9ARIsAIpUTDqmYbOh0KY5AMHiNd2GgWJKvpIo83f78dnytW-vdkaw4ZRI-f3_QVEaAtVDEALw_wcB
- Sample260710-kl49xaf18m
Score
8/10
Malware Config
Targets
-
- Target https://asana.com/de/download?utm_campaign=emea_de_de_mlti_signup_search_google_b_general&utm_source=google&utm_medium=pd_cpc_br&utm_content=emea_de_de_mlti_signup_search_search_google_mix_3p_all_low_funnel_asana_herunterladen&utm_term=asana%20download&gclsrc=aw.ds&gad_source=1&gad_campaignid=6757446367&gclid=Cj0KCQjwsMLSBhD9ARIsAIpUTDqmYbOh0KY5AMHiNd2GgWJKvpIo83f78dnytW-vdkaw4ZRI-f3_QVEaAtVDEALw_wcB
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.