Overview

overview

9

Static

static

3

Hot Girl F...0A.zip

windows7-x64

1

Hot Girl F...0A.zip

windows10-2004-x64

1

PlayFullVideo.exe

windows7-x64

8

PlayFullVideo.exe

windows10-2004-x64

9

WDSync.dll

windows7-x64

1

WDSync.dll

windows10-2004-x64

1

__MACOSX/A...Xp.exe

windows7-x64

3

__MACOSX/A...Xp.exe

windows10-2004-x64

3

__MACOSX/Unrealng.7z

windows7-x64

3

__MACOSX/Unrealng.7z

windows10-2004-x64

3

__MACOSX/i...eo.mp4

windows7-x64

1

__MACOSX/i...eo.mp4

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Hot Girl Full Video Sex New 2025-103041E0A.zip

  • Size

    30.4MB

  • Sample

    240914-1e1adaxemk

  • MD5

    a1a0762cfbf65fc174fc617f1adcb082

  • SHA1

    e65c4f3413378eec6f6b077e3cd343f967a8733a

  • SHA256

    0f15445acf50c0437d90e0a727a08ae7e563d21ff74a8c59de8b88618dff5ad4

  • SHA512

    000274a3f470694cf64dfd1068fbc803caf6c47da637f2f3745d7a818f5ac6bce7669701b6826309a79193dbe774cb5c61976d3a85f79f56fa9d2e0c969a6c4f

  • SSDEEP

    786432:iTTPDCncGf5sEy/8mS79st5DOkhvrZA0ohIP:SPOcGhsumrVvrZLkIP

Score
9/10
credential_accessdiscoveryexecutionstealer

Malware Config

Targets

    • Target

      Hot Girl Full Video Sex New 2025-103041E0A.zip

    • Size

      30.4MB

    • MD5

      a1a0762cfbf65fc174fc617f1adcb082

    • SHA1

      e65c4f3413378eec6f6b077e3cd343f967a8733a

    • SHA256

      0f15445acf50c0437d90e0a727a08ae7e563d21ff74a8c59de8b88618dff5ad4

    • SHA512

      000274a3f470694cf64dfd1068fbc803caf6c47da637f2f3745d7a818f5ac6bce7669701b6826309a79193dbe774cb5c61976d3a85f79f56fa9d2e0c969a6c4f

    • SSDEEP

      786432:iTTPDCncGf5sEy/8mS79st5DOkhvrZA0ohIP:SPOcGhsumrVvrZLkIP

    Score
    1/10
    behavioral1behavioral2

    • Target

      PlayFullVideo.exe

    • Size

      153KB

    • MD5

      37932fd952d6d845927f25f42cb3c628

    • SHA1

      d0d7e1b7cfb13a0999ef4c4733b83275a1de2440

    • SHA256

      cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c

    • SHA512

      403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b

    • SSDEEP

      1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

    Score
    9/10
    discoveryexecutioncredential_accessstealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Patched UPX-packed file

      Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

    • Target

      WDSync.dll

    • Size

      7KB

    • MD5

      91181fb3104d84296e10e7c5bdd6a2d1

    • SHA1

      468f0a352bbe3e75ac78c1bee563ca6d6f3fce8d

    • SHA256

      6dd1356ca9f788f6b7c62e4214baba66b2ac20a6cacf4216448edbf5e61dbf0a

    • SHA512

      ee3e20b06564865ce1f2aa554ade3fe8ddcdb0394f588a5f6cbb257b4365033786c7bae759332e58363af12eb02c7b03188ebe77ecb41f9a595f27a60d3d11de

    • SSDEEP

      96:7MLPIZi9fmaudeUL6s02sHp5b6CEYDKYXpGYhjKtmmK+TAE:sAZymaudjQ59EU1KYmK+c

    Score
    1/10
    behavioral5behavioral6

    • Target

      __MACOSX/ArcGISDXp.exe

    • Size

      574KB

    • MD5

      42badc1d2f03a8b1e4875740d3d49336

    • SHA1

      cee178da1fb05f99af7a3547093122893bd1eb46

    • SHA256

      c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    • SHA512

      6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

    • SSDEEP

      12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      __MACOSX/Unrealng

    • Size

      5.6MB

    • MD5

      5550ec6a2515a803ed632cc855f81abf

    • SHA1

      ea2672cbe241783306b96e2f82eb979a13570110

    • SHA256

      f586492362e1ab32e43c06dc69e81953ca59b09778fb420aa105c6a565d566e2

    • SHA512

      7416f77c75ee046e908b995d2bc9e78c964004bfff9b6fb5a2923b4b1abe26018e7977711b0a8cb9477cf60caf607c466334cd751d2f6c3cc9e3f9e9865ff40f

    • SSDEEP

      98304:7xAQSaLp6cQQOY5sSbIzzhQyXTDhl7ievQJqfayo1w:fSal6cuS/c/3xoeYJa9f

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      __MACOSX/img/PlayFullVideo.mp4

    • Size

      24.9MB

    • MD5

      8f26e790e6f13e0e32a5124c6b3632da

    • SHA1

      4432acbf9a61c9021c48bd1a0ffd57de14ba02da

    • SHA256

      47c32f2a49f669a10c00d71905a85503607192e014d5b38c78d9c3534fe08c43

    • SHA512

      d7d6d46b87273b4fef614936881d73cac40614805e9ca420e1e79fc28e62eee21cc0ad4541fae4c5d5a379688119bd37465dd9e1f48bfafc918ff9670bd11501

    • SSDEEP

      393216:tIX9TDggS+6UG6ofLuECcoKlSnH/Jnf/IRM9SBT9ktLN+lK8Uqy/0YIU8OfjY4mZ:tOZDgglNG5DuEHoxhn3l4T02K8P1wcN7

    Score
    6/10
    discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks