General
- Target How To Spoof Like A Pro.png
- Size 76.0MB
- Sample260715-gnwtrscy3m
- SHA256 9ab93f1f3ee2bf02bafd80a39c35e797a84f6b5f86646e0ec19bc58ceba9df36
Score
10/10
Malware Config
Targets
-
- Target How To Spoof Like A Pro.png
- Size 76.0MB
- SHA256 9ab93f1f3ee2bf02bafd80a39c35e797a84f6b5f86646e0ec19bc58ceba9df36
Score10/10Modifies visibility of hidden/system files in Explorer
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Drops file in System32 directory
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
3Hidden Files and Directories
3Modify Registry
2