General
- Target 3662970693aed3e805ade0b251e8f4982cb1c52f259c6a69405ee2c41588a784
- Size 43KB
- Sample260724-we78rsvekc
- SHA256 3662970693aed3e805ade0b251e8f4982cb1c52f259c6a69405ee2c41588a784
Score
8/10
Malware Config
Targets
-
- Target RFQ Universidad Indoamérica 240726·pdf.js
- Size 489KB
- SHA256 8495720643213a9ddb5c9cd13ed5d94a782fdc70d1396ee1650d90a6af29362a
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger