General
- Target Server.exe
- Size 31KB
- Sample261113-e1by1sfw2t
- SHA256 b5686ec5d4ef368183485ddf3d27d374721e7589597284914e0174967e840d00
- MD5 cebdb19465c864e1a8247424417ee9a4
- SHA1 20c31b7d69e2f04ab959a78d267c19707b3fa1c7
- SHA512 64f76163b555cc924aa4a5b47f6fe3a011eb980a655d273c0e5ea6562c665b47650c1000edeb1a10e85be6f3f2ef62222fb1ca317c0cbaafc29fd492b66d5326
- SSDEEP 384:6kLKr7fQucYLCqjNFeZdzdW2ZzOFkapZhoVR7StgSgQf0rqVUDThYHYCFEvIyPza:6yKr7fQGLCNZyyVNvYquO7Yn1R
- TLSH T1C5E2080537EA4703C66D13B90916871607B1CE83452BEB6F4CD9F4ED1D7B7848B82AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target Server.exe
- Size 31KB
- SHA256 b5686ec5d4ef368183485ddf3d27d374721e7589597284914e0174967e840d00
- MD5 cebdb19465c864e1a8247424417ee9a4
- SHA1 20c31b7d69e2f04ab959a78d267c19707b3fa1c7
- SHA512 64f76163b555cc924aa4a5b47f6fe3a011eb980a655d273c0e5ea6562c665b47650c1000edeb1a10e85be6f3f2ef62222fb1ca317c0cbaafc29fd492b66d5326
- SSDEEP 384:6kLKr7fQucYLCqjNFeZdzdW2ZzOFkapZhoVR7StgSgQf0rqVUDThYHYCFEvIyPza:6yKr7fQGLCNZyyVNvYquO7Yn1R
- TLSH T1C5E2080537EA4703C66D13B90916871607B1CE83452BEB6F4CD9F4ED1D7B7848B82AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1