General
- Target photov_556068467832.zip
- Size 1KB
- Sample260727-pfymdsssfw
- SHA256 aa554791dce9a6ccda13dbd3af97e167e03a4e1b34c3a83baaac5627e35de26b
Score
8/10
Malware Config
Targets
-
- Target photov_556068467832.lnk
- Size 1KB
- SHA256 985441997ce6b33c9826c119398f00c9d9e44942e9afb0a9722471ef851893fe
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target videoa_662208608560.mp4
- Size 1KB
- SHA256 418726d29f919fea0f8e45bd4435782990dc6d0cf867cf7a940d080efe97616a
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)