General
- Target e6f402e04b80d4028f554e2d6a1413d7907385d66f5eb4ed400b39bf3bacaced
- Size 53KB
- Sample260803-tl7jpsvvby
- SHA256 e6f402e04b80d4028f554e2d6a1413d7907385d66f5eb4ed400b39bf3bacaced
Score
8/10
Malware Config
Targets
-
- Target RFQ University of Kelaniya·pdf.jse
- Size 106KB
- SHA256 d7dd486a07b96b1189d98a83dfd676157aa44ea19522539284bcb4262903ba60
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger