General
- Target 2f96c7ea943b2cc41220bacec9aa81056588db580c9d4b486133614107e5ea1b
- Size 3.4MB
- Sample260808-zql2fsywds
- SHA256 2f96c7ea943b2cc41220bacec9aa81056588db580c9d4b486133614107e5ea1b
- MD5 c9750e8781b801388a354e13a09f145e
- SHA1 e880c9cb303605d10e52223c90a251f4471d42f2
- SHA512 2eaf9017f6e6b7913832f0258a56fd941d0df758bad86b4dfdccdf5cd9a5b2ae4ddd852539d5109e16c2978930434f4e1d733642381fc06a0ee33b19a4f24505
- SSDEEP 98304:kf7r9I6hPlOF+5qDjIynB7PI55BQSjI4my5lgbHeZylbD:YDpUF+ujIynB7PI55BQSjI4my5loHeO
- TLSH T12BF57C4B63AD11D4DAABD07DC6434A0BD7B1F8254335C7DF01A48B9A2F632620E3E766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f96c7ea943b2cc41220bacec9aa81056588db580c9d4b486133614107e5ea1b.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f96c7ea943b2cc41220bacec9aa81056588db580c9d4b486133614107e5ea1b.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2f96c7ea943b2cc41220bacec9aa81056588db580c9d4b486133614107e5ea1b
- Size 3.4MB
- SHA256 2f96c7ea943b2cc41220bacec9aa81056588db580c9d4b486133614107e5ea1b
- MD5 c9750e8781b801388a354e13a09f145e
- SHA1 e880c9cb303605d10e52223c90a251f4471d42f2
- SHA512 2eaf9017f6e6b7913832f0258a56fd941d0df758bad86b4dfdccdf5cd9a5b2ae4ddd852539d5109e16c2978930434f4e1d733642381fc06a0ee33b19a4f24505
- SSDEEP 98304:kf7r9I6hPlOF+5qDjIynB7PI55BQSjI4my5lgbHeZylbD:YDpUF+ujIynB7PI55BQSjI4my5loHeO
- TLSH T12BF57C4B63AD11D4DAABD07DC6434A0BD7B1F8254335C7DF01A48B9A2F632620E3E766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.