General
- Target WhaleBots_1015.zip
- Size 3.5MB
- Sample260903-x8a1ssvbqc
- SHA256 6aad97727005165fb14809a7bb705a3604d1d88d2e297f74e4558554d7ad2002
Score
8/10
Malware Config
Targets
-
- Target WhaleBots.dll
- Size 7.7MB
- SHA256 d95dc8bd886f6336a1dc10931ee99e4956a69cc3908718d41807c13cc71702a5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target WhaleBots.exe
- Size 187KB
- SHA256 707248ab41c78ad13d2a3c76c3ea8c8ec489420e46387f1c6cb6a1ebda636e34
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL