General
- Target EMModLoader_v1.0.1.zip
- Size 1.7MB
- Sample260809-lvyn6ayvgz
- SHA256 3112ee8ff32e5d2c8ee4964a58e361c62f9b6a8768f154481d312a15d6414d36
Score
8/10
Malware Config
Targets
-
- Target EMModLoader_v1.0.1.zip
- Size 1.7MB
- SHA256 3112ee8ff32e5d2c8ee4964a58e361c62f9b6a8768f154481d312a15d6414d36
Score1/10 -
- Target EMModLoader_v1.0.1/EMModLoader.deps.json
- Size 478B
- SHA256 cbdc5fdced9f94171c5dda3a8f33526357486062afedd50c3b51a956cbaa9668
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target EMModLoader_v1.0.1/EMModLoader.dll
- Size 1.6MB
- SHA256 ad4c07ef574249815957d9a55416c717253fd3172f41d0aa290319fd09a4d203
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target EMModLoader_v1.0.1/EMModLoader.exe
- Size 255KB
- SHA256 98a13b88a3eb77efefebf8c951766eaa1060139edc3a7e775e12693836a4fc2d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target EMModLoader_v1.0.1/EMModLoader.pdb
- Size 37KB
- SHA256 7d5dcb7538ef37e065918bb690c15677262bb4ad2e5bab5be28a9f58d4f346a4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target EMModLoader_v1.0.1/EMModLoader.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
Score3/10