General
- Target https://h5.g123.jp/game/ryoran?lang=en&platform=auto&utm_source=google&utm_campaign=ryoran_en_NewDiscoveryAttributionOptimize0812_adn_all&utm_adgroup=cr_normal_pay_similar_alltitle&utm_content=ryoran_en_ai-white-ra106-1205ce_1080-1080.jpg&gad_source=2&gad_campaignid=24128479589&gclid=Cj0KCQjw--7UBhCpARIsAGJBptgUYV2wZcwckiyGTaSRIBFtuvw7oBvSx0pcYRdhqckA1Lv5uFOiq44aAjG2EALw_wcB
- Sample260907-nededsvhmf
Score
8/10
Malware Config
Targets
-
- Target https://h5.g123.jp/game/ryoran?lang=en&platform=auto&utm_source=google&utm_campaign=ryoran_en_NewDiscoveryAttributionOptimize0812_adn_all&utm_adgroup=cr_normal_pay_similar_alltitle&utm_content=ryoran_en_ai-white-ra106-1205ce_1080-1080.jpg&gad_source=2&gad_campaignid=24128479589&gclid=Cj0KCQjw--7UBhCpARIsAGJBptgUYV2wZcwckiyGTaSRIBFtuvw7oBvSx0pcYRdhqckA1Lv5uFOiq44aAjG2EALw_wcB
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.