General
- Target photov_036353162133.zip
- Size 1KB
- Sample260727-pftnfaag67
- SHA256 aac9fc9f690515a6aafe794f408fae74591575c50ff42fa472c497a584e45c72
Score
8/10
Malware Config
Targets
-
- Target photov_036353162133.lnk
- Size 1KB
- SHA256 04e671694c54641e83ec40beeac652b936d8179253351845d77a1d31027ad2eb
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target videoa_955435684352.mp4
- Size 962B
- SHA256 ed9d3b7b275af7523e0f32ef9c622bc50e81731fa86e8bd3ef15072fa472d53d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)