General
- Target fifty-optimizer-3.11.0-setup.exe
- Size 109.6MB
- Sample260711-hte9msfv9w
- SHA256 979b91583e5a0555f45f2a78e3833adad3e0aada246de6505311dad29d4e4669
Score
8/10
Malware Config
Targets
-
- Target fifty-optimizer-3.11.0-setup.exe
- Size 109.6MB
- SHA256 979b91583e5a0555f45f2a78e3833adad3e0aada246de6505311dad29d4e4669
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/app-64.7z
- Size 109.1MB
- SHA256 28c2f2c19f93f4a78a0cf6436a23f658035b795011f3a6f96d0c1c23600f1396
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.