General
-
Target
8378482dfb00608563257af10d70c96d.bin
-
Size
96KB
-
Sample
240626-dalj4azgpe
-
MD5
1e991c1eb57d77451aa0b05886bc44cf
-
SHA1
d04e6e4511065885140b87376e158a3b0f8ab215
-
SHA256
2699b06a6d4b6af500d76bdc83644cad1be40445d64b97a7b1acfdb0bd937d25
-
SHA512
31b524bbab764324d05ba3471320cf5bd283478d834165ce75088a4c6f348d15fcfc9d7af7c61671319d366079bf874ce1b1bc217a24f9d3bd4e96a9bb431507
-
SSDEEP
3072:b9IYYhhkUv3NX3wJW+5EOr2xI4e7onXrwC8v:b96hkUv9X3wDWe/4icXq
Static task
static1
Behavioral task
behavioral1
Sample
028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72.vbs
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72.vbs
-
Size
186KB
-
MD5
8378482dfb00608563257af10d70c96d
-
SHA1
493b67c86ea9ca8ecb60f0388356ff0b8c1b5f40
-
SHA256
028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72
-
SHA512
b31c395abe57132700c6056de274dbfa92fc105d0e35c73618ec004f0639acbd3411b252374ea4a14a805cb5e4dfd817e7ca7f9096a4931f22a060e7938ec3a7
-
SSDEEP
3072:BmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZz:B08GxbKja3+DCbKCvBB/WnHXC/sLJFJ2
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-