10842b7cd41976ce0909f8e67e2f61e7b138c0b5c9b97d9fa4d6a77aa4688ab3

General

Target
WpizzaLOl.rar
Size 2.3MB
Sample260224-pajahscy3h
SHA256 10842b7cd41976ce0909f8e67e2f61e7b138c0b5c9b97d9fa4d6a77aa4688ab3
MD5 e8fb2809fd75fa0158395ac04e9c0009
SHA1 b3e53fae2379ec35ec0e4377524b092a6e18bda5
SHA512 20ad9be8de2eff4ee0ed70c75548c60cba19d662e0abc730bfcffb8911411d908374264a77fa9838c0200da8104922d9dae35749f1419bd3f2d87d02098bd282
SSDEEP 12288:fXP8CpXP8CzXP8CrXP8CoXP8ClXP8CrXP8CcXP8CWXP8C7XP8CF:G
TLSH
T191B58FCBAE4146B6C74CF93244A3733C036F987E6BE7AE5EA19F3DA45B7285C4846050
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WpizzaLOl.rar
- Size 2.3MB
- SHA256 10842b7cd41976ce0909f8e67e2f61e7b138c0b5c9b97d9fa4d6a77aa4688ab3
- MD5 e8fb2809fd75fa0158395ac04e9c0009
- SHA1 b3e53fae2379ec35ec0e4377524b092a6e18bda5
- SHA512 20ad9be8de2eff4ee0ed70c75548c60cba19d662e0abc730bfcffb8911411d908374264a77fa9838c0200da8104922d9dae35749f1419bd3f2d87d02098bd282
- SSDEEP 12288:fXP8CpXP8CzXP8CrXP8CoXP8ClXP8CrXP8CcXP8CWXP8C7XP8CF:G
- TLSH
  T191B58FCBAE4146B6C74CF93244A3733C036F987E6BE7AE5EA19F3DA45B7285C4846050
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

romcom storm_0978 apt discovery execution exploit persistence privilege_escalation cve_2025_8088
- Detects RAR archive exploited with CVE-2025-8088 ADS path traversal.
  exploit apt romcom storm_0978 cve_2025_8088
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
behavioral1 behavioral2