General
- Target photov_763028390865.zip
- Size 1KB
- Sample260727-pgwt7astbx
- SHA256 a4fb08502584cef608e7ae33861ae1e28aa8c28929f431c0cc35c5b53f786af5
Score
8/10
Malware Config
Targets
-
- Target photov_763028390865.lnk
- Size 1KB
- SHA256 c354367b524d7b0573f3bdf351d78b0128a62567f4ac8aaee9cef6970e94b181
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target videoa_337744622682.mp4
- Size 982B
- SHA256 8c7d5655749d514428e0afde4a988cbce8f20b8a989138aa52101bb225e77a90
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)