General

  • Target

    https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFqeWvYHVfpmeIco-2B1zw2oD0DM6zn-2BOxCInlKISI-2FqKcYZW3-_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZNth4Kd3RSajrpNQi5TahQeSHUSRCkabA5pmrvt8Ym8KP6YSofpLDf62S1dumgdcNqSmoJGpzfhAKMO-2F7vD-2BU5j9oS5T4nMfRUZGIX17WXZH61fijzwN1b-2BN5g1Tn9TSoGQyw-2Fe0xjfWUbYJ8rfNUBQ5fcy31zw4iNRlLEuFJrPqzRC-2FDmIkWnO9vb0-2BREQXD5HIDk0iiT57wIZR-2F3rAQXiKH7eUYcuZrUHOuxksqXJe69kowZ0ufAnKOAfQ5UfcAU-3D#dHJpaW4ucGV0dGFpQHlvbG8uY29t

  • Sample

    250217-qj83zazjdz

Malware Config

Targets

    • Target

      https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFqeWvYHVfpmeIco-2B1zw2oD0DM6zn-2BOxCInlKISI-2FqKcYZW3-_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZNth4Kd3RSajrpNQi5TahQeSHUSRCkabA5pmrvt8Ym8KP6YSofpLDf62S1dumgdcNqSmoJGpzfhAKMO-2F7vD-2BU5j9oS5T4nMfRUZGIX17WXZH61fijzwN1b-2BN5g1Tn9TSoGQyw-2Fe0xjfWUbYJ8rfNUBQ5fcy31zw4iNRlLEuFJrPqzRC-2FDmIkWnO9vb0-2BREQXD5HIDk0iiT57wIZR-2F3rAQXiKH7eUYcuZrUHOuxksqXJe69kowZ0ufAnKOAfQ5UfcAU-3D#dHJpaW4ucGV0dGFpQHlvbG8uY29t

    • Detected google phishing page

    • Downloads MZ/PE file

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks