General
- Target setup.exe
- Size 4.8MB
- Sample261024-ym3pcs1x4j
- SHA256 7c1d65ed2ad431da2d7dfe9a0fca03e00e57588c903f4b6b8ffb1fdc9af4aef4
- MD5 bec1842ded3a188e65e35b99bc3c0804
- SHA1 c77abca67086fc7d6cae3f331ef1c2265905f2f1
- SHA512 96bc4acb1364cba02c8440f336925c16809d7405ecc37b7847cb8be63c16e2bfb4d6b1e82bf92884df4295880f613b08194c1526c575e8a70be8f631010d454d
- SSDEEP 98304:nf7wCQInrje/CAVMJy1WGsF38rbmoK0txRCMlt1+8jN:nfn6/VSlGC38rbmoKoxRFf
- TLSH T169363341F3C3183AF4600D791D27D9A82E13F6B619D560262EF8DB9F06752C2BEBA570
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Targets
-
- Target setup.exe
- Size 4.8MB
- SHA256 7c1d65ed2ad431da2d7dfe9a0fca03e00e57588c903f4b6b8ffb1fdc9af4aef4
- MD5 bec1842ded3a188e65e35b99bc3c0804
- SHA1 c77abca67086fc7d6cae3f331ef1c2265905f2f1
- SHA512 96bc4acb1364cba02c8440f336925c16809d7405ecc37b7847cb8be63c16e2bfb4d6b1e82bf92884df4295880f613b08194c1526c575e8a70be8f631010d454d
- SSDEEP 98304:nf7wCQInrje/CAVMJy1WGsF38rbmoK0txRCMlt1+8jN:nfn6/VSlGC38rbmoKoxRFf
- TLSH T169363341F3C3183AF4600D791D27D9A82E13F6B619D560262EF8DB9F06752C2BEBA570
- MD5 SHA1 SHA512 SSDEEP TLSH
Drops file in Drivers directory
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.