Overview

overview

7

Static

static

5

libiconv-2.dll

windows10-2004-x64

1

libiconv-2.dll

windows11-ltsc_2024-x64

1

libidn2-0.dll

windows10-2004-x64

1

libidn2-0.dll

windows11-ltsc_2024-x64

1

libintl-8.dll

windows10-2004-x64

1

libintl-8.dll

windows11-ltsc_2024-x64

1

libpsl-5.dll

windows10-2004-x64

7

libpsl-5.dll

windows11-ltsc_2024-x64

7

libunistring-5.dll

windows10-2004-x64

1

libunistring-5.dll

windows11-ltsc_2024-x64

1

psl.exe

windows10-2004-x64

6

psl.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    jenniferloeffler.zip
  • Size 3.0MB
  • Sample260809-pj3era1sc1
  • SHA256 ae9bbc99186978c554d943b81ebbd88ee08d605c3401c1b28d3a330eafb319eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Targets

    • Target
      libiconv-2.dll
    • Size 1.1MB
    • SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      libidn2-0.dll
    • Size 251KB
    • SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      libintl-8.dll
    • Size 301KB
    • SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      libpsl-5.dll
    • Size 5.4MB
    • SHA256 85c60e58e827d88421e0c3647da9897d33af13f436678df7f4ed433610760052
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10

    • Executes dropped EXE

    behavioral7behavioral8
    • Target
      libunistring-5.dll
    • Size 2.1MB
    • SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      psl.exe
    • Size 64KB
    • SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12

MITRE ATT&CK Enterprise v16

Tasks