General
- Target respocket.zip
- Size 58.0MB
- Sample260831-qw257agg83
- SHA256 7949e5047d4957eb78fb47a60308c69e517a55589cf681d314998908ff45ce26
Malware Config
Targets
-
- Target respocket.zip
- Size 58.0MB
- SHA256 7949e5047d4957eb78fb47a60308c69e517a55589cf681d314998908ff45ce26
Score1/10 -
- Target loader.exe
- Size 93.3MB
- SHA256 01232bc0dddfe523e6ccd390d2fffad8d90fcd65978f10abdd22130380a42db1
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
- Target x64/Bypass.dll
- Size 8.1MB
- SHA256 dec01fbb6941fd9a4856f38682a6ed7d90d04e66731e9589a80001b99ea7a6c2
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x64/ExtraBypass.dll
- Size 133KB
- SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
Score1/10 -
- Target x64/SQLite.Interop.dll
- Size 1.5MB
- SHA256 93b35c2c65f7eb739f8122ca09b58d0bf8a4653f772281c8c0be450146d32ba2
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x64/sciter.dll
- Size 18.6MB
- SHA256 77e82cdf92f908a75efc0aa28a5b92ba36837ca309972343930f96c00dab8f00
Score1/10 -
- Target x64/wintun.dll
- Size 417KB
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
Score1/10 -
- Target x86/Bypass.dll
- Size 6.4MB
- SHA256 2a29d2d9378a44e6ce051f072bbc79aa0ec6cfc6d4594499c3f60dce007f1382
Score3/10 -
- Target x86/ExtraBypass.dll
- Size 97KB
- SHA256 f96f8b66f2fb99077a4eff2cf55c1500f334d71ba425c3989453ab5dae190c6e
Score3/10 -
- Target x86/SQLite.Interop.dll
- Size 1.2MB
- SHA256 1a6845e27761e5c26c1cfa128d2d2360d24e05d229008bc2f0b4215a03366dc9
Score3/10 -
- Target x86/sciter.dll
- Size 14.7MB
- SHA256 acebb40ecd916a04d77ebc437a42d7287fe9250d4f24e4fdebae4507861253aa
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x86/wintun.dll
- Size 538KB
- SHA256 d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.