General
- Target photov_606583489143.zip
- Size 1KB
- Sample260727-pel7zaek4s
- SHA256 b9d5637edb3b651988d53407ccf4c5b916cfda59fab4d01a69e93213b5243cb4
Score
8/10
Malware Config
Targets
-
- Target photov_606583489143.lnk
- Size 1KB
- SHA256 83ddaa033590c38ae51414a527f5f2914c4c2d792c2f4f3cdce8fbfd745734da
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target videoa_456969784125.mp4
- Size 1015B
- SHA256 509d4acc6fea9676837c7b86d5bf31df17318a0dd7ad3e6842ccc7b87252b4b7
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)