General
- Target Mcp.exe
- Size 10.3MB
- Sample261110-plc8msax3v
- SHA256 3bd3628e40a53414c945fdba55bd8e661f53bc111c35711c7d6bf96151e6c5f8
- MD5 881ba01fbeecf0a5233008ab150155d9
- SHA1 e99edb61541ac669a421e83a6e179c469eb90c51
- SHA512 6a268704715c3af11ef6dfc67dbf6cb173c23bc4a523c20ece905e1cf4518fea589266e8a21b9d94f504aafe8672e3a182b29a3fa139a6adcf0581e0e9ad3166
- SSDEEP 98304:SLxOahdReReZqkTeheUtFYgrTTTTio+4+nMed6paTLyKjQbz5i+QVFZ3qr0JDTDW:SVO+HOPkTAXtf+4+bd6paP5jQUfqkfv
- TLSH T16FB67C01A7A4D8D7E06A0B75D7F141A253F8AC019736C28BBB583F5BBB7270099D139B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Mcp.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target Mcp.exe
- Size 10.3MB
- SHA256 3bd3628e40a53414c945fdba55bd8e661f53bc111c35711c7d6bf96151e6c5f8
- MD5 881ba01fbeecf0a5233008ab150155d9
- SHA1 e99edb61541ac669a421e83a6e179c469eb90c51
- SHA512 6a268704715c3af11ef6dfc67dbf6cb173c23bc4a523c20ece905e1cf4518fea589266e8a21b9d94f504aafe8672e3a182b29a3fa139a6adcf0581e0e9ad3166
- SSDEEP 98304:SLxOahdReReZqkTeheUtFYgrTTTTio+4+nMed6paTLyKjQbz5i+QVFZ3qr0JDTDW:SVO+HOPkTAXtf+4+bd6paP5jQUfqkfv
- TLSH T16FB67C01A7A4D8D7E06A0B75D7F141A253F8AC019736C28BBB583F5BBB7270099D139B
- MD5 SHA1 SHA512 SSDEEP TLSH
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.