General
- Target 98aa699914ecfb3a7210e39ea9b135c6806a4fd725c33d20029446be4ff2885b
- Size 4.6MB
- Sample260912-ld9p4atarf
- SHA256 98aa699914ecfb3a7210e39ea9b135c6806a4fd725c33d20029446be4ff2885b
- MD5 ba74abb6da8bc2c81409047962a6cc91
- SHA1 b8841f3960aecd2605261bb920f1f5e736be671b
- SHA512 25a2bc157a68ae719ea99f7d705c0ce97f55cbe9883b616a79ef89b3950b2b3d429d0b373f451b5826951f1a7af7300193fcc71175d0bb40a024add1621680b6
- SSDEEP 49152:04xat1ooBHcOwimtZHt4xat1ooBHcOwimtZHt4xat1ooBHcOwimtZHt4xat1ooBF:0yYYnNyYYnNyYYnNyYZ
- TLSH T1E326E126F6F14437D1236EB8DC1F576CA8267E502D3464863BE82C48AF39781753B29B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98aa699914ecfb3a7210e39ea9b135c6806a4fd725c33d20029446be4ff2885b.exe
Resource
win10v2004-20260911-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 98aa699914ecfb3a7210e39ea9b135c6806a4fd725c33d20029446be4ff2885b
- Size 4.6MB
- SHA256 98aa699914ecfb3a7210e39ea9b135c6806a4fd725c33d20029446be4ff2885b
- MD5 ba74abb6da8bc2c81409047962a6cc91
- SHA1 b8841f3960aecd2605261bb920f1f5e736be671b
- SHA512 25a2bc157a68ae719ea99f7d705c0ce97f55cbe9883b616a79ef89b3950b2b3d429d0b373f451b5826951f1a7af7300193fcc71175d0bb40a024add1621680b6
- SSDEEP 49152:04xat1ooBHcOwimtZHt4xat1ooBHcOwimtZHt4xat1ooBHcOwimtZHt4xat1ooBF:0yYYnNyYYnNyYYnNyYZ
- TLSH T1E326E126F6F14437D1236EB8DC1F576CA8267E502D3464863BE82C48AF39781753B29B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1