General
- Target 832bd5fedf54636a81a782ba2ffec52c2d865cb5300e894fb929870dcfa10fc9
- Size 1.0MB
- Sample260722-eye8navycx
- SHA256 832bd5fedf54636a81a782ba2ffec52c2d865cb5300e894fb929870dcfa10fc9
Score
10/10
Malware Config
Targets
-
- Target 101164C - ACMV Works OF Chong Pang City Mall Project.js
- Size 1.8MB
- SHA256 8270175338da58a74f53146509e13c63d6ea2d41238ea4752a89343891c431e4
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.