General
- Target photov_424701176963.zip
- Size 1KB
- Sample260727-pfq8ba1gpb
- SHA256 8d90e90104e40c211a7ff3dddfc4196f3141200e80048f4c09c1fa86c7b2fd62
Score
8/10
Malware Config
Targets
-
- Target photov_424701176963.lnk
- Size 1KB
- SHA256 618524d281d20a4ae71b0b13614f4067d1bd606ae92fcbb3dd4a474858cac51c
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target videoa_863738701530.mp4
- Size 1KB
- SHA256 6d5d013e664493368315e662a1e483864cdb22bc79b07e921c6464ba9272851d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)