Overview

overview

10

Static

static

1

Mercadoria...EY.lnk

windows7-x64

10

Mercadoria...EY.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b8e8a1dedec74315b3df82d0d54925d_JaffaCakes118

  • Size

    1KB

  • Sample

    240516-rvtcbshd58

  • MD5

    4b8e8a1dedec74315b3df82d0d54925d

  • SHA1

    cad674d87da017d26903ab9594dfa17f3f7dd658

  • SHA256

    41aa6d3ed7b982e06a274710b154b51127526a58743784559daf4bd97cd80b46

  • SHA512

    f4ee8003f4f2f956d245ea4d2e198873715a5e078d5f9c0097e44c0a33775d36020937c588bc663c86db1ed8937c8f03c610df7bbd4281e9750af9a15d72ca7a

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://1361227624.rsc.cdn77.org/v2/gl.php?aHR0cHM6Ly8xMzYxMjI3NjI0LnJzYy5jZG43Ny5vcmcvdjJ8d3IzMQ%3D%3D%

Targets

    • Target

      Mercadoria_Devolvida-Correios-OFQL7QEY.lnk

    • Size

      3KB

    • MD5

      246e74b6fffb9d5994f7f70bb6509b45

    • SHA1

      4b7bdf4808ce987b9f94ea40bdd081217867483a

    • SHA256

      0db8cc27123c8bbd5ae0139980b604c514caeeed51da22d67d440e5369f8be1e

    • SHA512

      178cf1ff0d8213ff94de68f5c1c267d50c3a958126925a2c50a554a29229c6f6834d1bf140fdb9f7168352d068880c7730e047e177496af0a8b57dde62fd8e08

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks