General
- Target Mandela.exe
- Size 15.2MB
- Sample260825-e72s1swhlh
- SHA256 c6818da28a36a7ed628e5a86ede3a642b609b34b2f61ae4dba9a4814d6822d2f
- MD5 68558a4a7df242046a8a7345501adcf7
- SHA1 eac84b6bc1be332af4bafc1bdac30b40041a1295
- SHA512 160f2d35cabd161c1bb4372de42dff907550b929675f8e450130de0a0f60e703bdad0eb6398437d92db4337b5c3d885dcca398c04af61ff8fe20757f6658dc08
- SSDEEP 393216:3S2Jj2w9YgIrP/gHase3j3LINmWuwd6CZ/OK4jXo/jH599s:Cm3YgIrXg6sELLIQWXsCZGKgY/jx
- TLSH T1C0F633EBA6D45F82E0921D74C0A3D57487E23C015A73E7091CE5BE537C79227ACAA3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Mandela.exe
Resource
win10v2004-20260513-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target Mandela.exe
- Size 15.2MB
- SHA256 c6818da28a36a7ed628e5a86ede3a642b609b34b2f61ae4dba9a4814d6822d2f
- MD5 68558a4a7df242046a8a7345501adcf7
- SHA1 eac84b6bc1be332af4bafc1bdac30b40041a1295
- SHA512 160f2d35cabd161c1bb4372de42dff907550b929675f8e450130de0a0f60e703bdad0eb6398437d92db4337b5c3d885dcca398c04af61ff8fe20757f6658dc08
- SSDEEP 393216:3S2Jj2w9YgIrP/gHase3j3LINmWuwd6CZ/OK4jXo/jH599s:Cm3YgIrXg6sELLIQWXsCZGKgY/jx
- TLSH T1C0F633EBA6D45F82E0921D74C0A3D57487E23C015A73E7091CE5BE537C79227ACAA3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1