General
- Target Server.exe
- Size 64KB
- Sample261027-l2dbsss1ds
- SHA256 4d6e9f8f51eb649438721d03607f18fc0375fde1c2fa6d7836b99944e3befad7
- MD5 5136ca0f3be8995a22c996500262ec30
- SHA1 ad4fddfce4cd31d784ff7421014d23e089f474dc
- SHA512 fc2e3ac5949d5891e1940326c0cb19b9b429507333981cf45648379ca8fcad010efa1a983f1f2cf46d9c48ed829b4f35f4d45336ea2b9bb7b2c9864bfc18beec
- SSDEEP 768:TrGJUpfLhqau6MHlzpuNugR7rZ3X99F4UhDbaVY+KC:Tq8MauvNpYuCVnLF4fhx
- TLSH T17F537F4717EC6D60D17D5B7A2773A3C187B9ED826903CA2F09D090996B3E203BD827D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260911-en
12 signatures
900 seconds
Malware Config
Targets
-
- Target Server.exe
- Size 64KB
- SHA256 4d6e9f8f51eb649438721d03607f18fc0375fde1c2fa6d7836b99944e3befad7
- MD5 5136ca0f3be8995a22c996500262ec30
- SHA1 ad4fddfce4cd31d784ff7421014d23e089f474dc
- SHA512 fc2e3ac5949d5891e1940326c0cb19b9b429507333981cf45648379ca8fcad010efa1a983f1f2cf46d9c48ed829b4f35f4d45336ea2b9bb7b2c9864bfc18beec
- SSDEEP 768:TrGJUpfLhqau6MHlzpuNugR7rZ3X99F4UhDbaVY+KC:Tq8MauvNpYuCVnLF4fhx
- TLSH T17F537F4717EC6D60D17D5B7A2773A3C187B9ED826903CA2F09D090996B3E203BD827D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1