General
- Target usfansmap.rar
- Size 6.9MB
- Sample260730-zlxbmafe89
- SHA256 d37fb31986cfd55ce23a8f4bb31210a653f7cd3b4124dcd980260b8d027b6a98
Malware Config
Targets
-
- Target usfansmap.rar
- Size 6.9MB
- SHA256 d37fb31986cfd55ce23a8f4bb31210a653f7cd3b4124dcd980260b8d027b6a98
Score7/10-
Loads dropped DLL
-
- Target assets/alpine/alpine.min.js
- Size 45KB
- SHA256 57b37d7cae9a27d965fdae4adcc844245dfdc407e655aee85dcfff3a08036a3f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/alpine/collapse.min.js
- Size 1KB
- SHA256 c7661d4e2cf0465e3cd693190debb5f592ac72dcc4cfe650581273767558b27b
Score3/10 -
- Target assets/css/style.css
- Size 11KB
- SHA256 280118ebe4b9e9fc7e23db1a402850c9eaf9ac8eb2063c4794e5b36e6bf23dab
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target assets/data/marks_part1.js
- Size 8.9MB
- SHA256 49ea246016a55b3bdb8749734cfa396d3af9a2e0df02b3cf5210d68c6a22a453
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/data/marks_part2.js
- Size 8.9MB
- SHA256 2ba05d61f623aba6b69bb0a5c85ff7a6011fc86cab5b0c4be5b9b7899ea5bf99
Score3/10 -
- Target assets/data/marks_part3.js
- Size 8.9MB
- SHA256 baa308e6e322b052b26c059463c84ec0682b1318c1a04d26451da0f6e98800fa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/js/app.js
- Size 11KB
- SHA256 f20cbe5341e242dcd1d2714cf573990297a1688615a0caf73da0504b29c9053a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/leaflet/leaflet.min.css
- Size 10KB
- SHA256 b570abbda963c60b4de4b4ff4b26f9326f53fb2ccf1461fdf0955ca094fb2539
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target assets/leaflet/leaflet.min.js
- Size 143KB
- SHA256 5c9aecfc30e4564519dbdcddcc53a418227dcc7568e619e9762ddcec7609ed47
Score3/10 -
- Target assets/markercluster/MarkerCluster.Default.min.css
- Size 1022B
- SHA256 b7df1ae0045ecc7d9b87aaa3ff8347bd2bbd97d60e9cdd315e3f1f4c3f56e3a7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/markercluster/MarkerCluster.min.css
- Size 688B
- SHA256 5ea4d37ba829f27588ed3c9f85b156b03b23db14f70dadd4b48c5fe9f8370e5a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/markercluster/leaflet.markercluster.min.js
- Size 33KB
- SHA256 020a517be9a15b99cf2033cd420b561e0f27b1b6ddd49cbb60a057f335327fb4
Score3/10 -
- Target assets/nouislider/nouislider.min.css
- Size 4KB
- SHA256 9dc9155cfd6331d1f5629881ac0bc63928243fa4c1d83b17ce4921b5200be0ae
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target assets/nouislider/nouislider.min.js
- Size 27KB
- SHA256 79222927cb7695f403144b58e31da6a7082d82e08d310b0cd776264d311abe7d
Score3/10 -
- Target filelist.txt
- Size 23.0MB
- SHA256 22639c6570a832aa38033b087a64ad9cd02b9249aabce865d547f7687de5c931
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.