General
- Target 043d9003ab642a1382a4ca143dd33c498975a11cedb4ca80b748c8be4cb1d230
- Size 4.7MB
- Sample260908-q4meps1vay
- SHA256 043d9003ab642a1382a4ca143dd33c498975a11cedb4ca80b748c8be4cb1d230
- MD5 dda1b11ff085f43aff9e3e7643ef749b
- SHA1 b79b814e20e6fc1834432d68b76408c344ade479
- SHA512 109e667b50277f68b6013e8433928652b0d0fd587ab6e044da75ae2f2b0ba1cacc8dee511cd783659b9bbcbe55cbb9a313d97395fc32b73f29ca5442ee51c97f
- SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpvmGoY2r9I:+0s420bTjzGlBrJTJb8QAMQABY+9I
- TLSH T1AC3623D5785E7AABC10E1C7ACE178D6135AC5BB1C7605CA3FFD53EB60810C922763A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
043d9003ab642a1382a4ca143dd33c498975a11cedb4ca80b748c8be4cb1d230.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 043d9003ab642a1382a4ca143dd33c498975a11cedb4ca80b748c8be4cb1d230
- Size 4.7MB
- SHA256 043d9003ab642a1382a4ca143dd33c498975a11cedb4ca80b748c8be4cb1d230
- MD5 dda1b11ff085f43aff9e3e7643ef749b
- SHA1 b79b814e20e6fc1834432d68b76408c344ade479
- SHA512 109e667b50277f68b6013e8433928652b0d0fd587ab6e044da75ae2f2b0ba1cacc8dee511cd783659b9bbcbe55cbb9a313d97395fc32b73f29ca5442ee51c97f
- SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPpvmGoY2r9I:+0s420bTjzGlBrJTJb8QAMQABY+9I
- TLSH T1AC3623D5785E7AABC10E1C7ACE178D6135AC5BB1C7605CA3FFD53EB60810C922763A22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1