808ff584426d52cc775ad6406da00622f454be95bd4c8fbca42eef4b7235ad5c

General

Target
Locale.Emulator.2.5.0.1.zip
Size 150KB
Sample260820-ddr62sydnd
SHA256 808ff584426d52cc775ad6406da00622f454be95bd4c8fbca42eef4b7235ad5c
MD5 6e1a6cb34e33966befef0ae119c532b8
SHA1 755a554e3f15104707d979a56c8e7ed46e469c0d
SHA512 7752cce25c2516bc8d94b7dac7b5c44c86e3bfaa1cd4e38359fef40eff34f906e8b06429069b16355fda559796f643ae7970b7c904d9d081e6a79c1b0c86aabb
SSDEEP 3072:+aK/apjnii8xnxBqafEw+VoHoIGgkQAqQP7YhMV9k7pE+h2iClpkuyoot6bGKKzY:8/Ajnit7TEw+jzJL7YzEiOC5ootYGKKc
TLSH
T193E31204C104955ED0F3337462574BFAB23DBEAC629890BF53A396987D998B60E87F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  Locale.Emulator.2.5.0.1.zip
- Size 150KB
- SHA256 808ff584426d52cc775ad6406da00622f454be95bd4c8fbca42eef4b7235ad5c
- MD5 6e1a6cb34e33966befef0ae119c532b8
- SHA1 755a554e3f15104707d979a56c8e7ed46e469c0d
- SHA512 7752cce25c2516bc8d94b7dac7b5c44c86e3bfaa1cd4e38359fef40eff34f906e8b06429069b16355fda559796f643ae7970b7c904d9d081e6a79c1b0c86aabb
- SSDEEP 3072:+aK/apjnii8xnxBqafEw+VoHoIGgkQAqQP7YhMV9k7pE+h2iClpkuyoot6bGKKzY:8/Ajnit7TEw+jzJL7YzEiOC5ootYGKKc
- TLSH
  T193E31204C104955ED0F3337462574BFAB23DBEAC629890BF53A396987D998B60E87F1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  LEGUI.exe
- Size 214KB
- SHA256 39c11a121ac63c6662d77486d5d3a6ba0a80ec98fec08f5bcbe87069735ca825
- MD5 9a93c283cd5f34ea188601e0d1225724
- SHA1 f9926a1f08358d055f0bbc59cd6d78fa792a5841
- SHA512 6ffb00dd677dfab0c938f36dfde5112bf3ac642956d66a4caf8f2c1ad4aed1af3ff584d92ff30d1315a2ae3c7c866c536578f40e895099bf3ec60f9d44acf7fc
- SSDEEP 1536:NQNHFBaFMwVPlibkpDgOjuE152j3xFklEcZJNM5MT3xFkGEkZbB:NQNHFBa2wVPobJOjx15ZfP
- TLSH
  T1992433E2BCDC96A2FF074E7E8749424246332F9243496E97BF8E3F9102B51745B05E68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  LEInstaller.exe
- Size 167KB
- SHA256 b2f3e09ba732c0daf5c51e802b888fb158f9025dd6e8ce4cb03c5dc21048dfda
- MD5 460f7b9447fd6ad7eebf26a049961046
- SHA1 ef9cc23a21c6754ea10fed81b360b98aed14daae
- SHA512 1a685aed178c4eb4dffc24b44e1ba39251c90192bc70afbf70231e4b6a3df08d65d941fe9a8235affe760b1bde9b7eef1a9c91f9c7b3041efedf030cc0d377f6
- SSDEEP 1536:2anbF285ea8OnO6yJqDLjndUUZn/DfrAX3xFkVEAZS3kn:2anbF28VK6yJULjndUURfrakn
- TLSH
  T16CF3F9E1BDCDD252FB165EFE664905460233AFC213285E977F8D3F8926B11760700EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
behavioral5 behavioral6