Overview

overview

7

Static

static

3

Portable P.../Prezi

macos-10.15-amd64

1

probabilis...ws.exe

windows10-2004-x64

7

probabilis...ws.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    9-Probabilistic_Models_API_ItsAPreziPresentationConvertingItToPDFRequiresThePaidVersion.zip
  • Size 41.8MB
  • Sample261110-hrdm2ahs3w
  • SHA256 4b0f1b0caa0a0c850f3085e2d89fc8fe5bed00537167b1cbb2b1a9ad1471c913
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverymacos

Malware Config

Targets

    • Target
      Portable Prezi/.Portable Prezi Viewer.app/Contents/MacOS/Prezi
    • Size 17.4MB
    • SHA256 ed6b40c03c12653e1a063831697e9dab3790241323d8a6cb4b070c9f27209b1f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      probabilistic-m5d67bbe7/prezi-windows.exe
    • Size 32.8MB
    • SHA256 b6201b35cfaa05996558173c4df1a801d2fd9b1aae495ee8c409c4ab50cefe4f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes a Windows system DLL name to a user directory

      A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

      defense_evasion
    behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks