General
- Target SKM-#N904800120-076452SK.zip
- Size 10KB
- Sample260720-k59nqsft3y
- SHA256 73068412cff6721967c821d10028c0a34387f65cdb20512dbf7c3879ccdf5823
Score
8/10
Malware Config
Targets
-
- Target SKM-#N904800120-076452SK.js
- Size 22KB
- SHA256 75c0fa23c4993e3e4d1a9953dd71037896d7b552812f68438076b13996dbe42a
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger