Overview

overview

10

Static

static

1

Doc_02cec1...5b.lnk

windows10-2004-x64

10

Doc_02cec1...5b.lnk

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    24042026_0214_Doc_02cec1f0-fd22-41c1-9ea1-ce378e010a5b.lnk.zip
  • Size 1KB
  • Sample260424-cpffyscx2t
  • SHA256 db898ce5b33bc17e31281f6e0edff5e84cf924e65b62ad0422f8d327a82b2d0e
  • MD5 SHA1 SHA512 TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    https://243.180.62.50.host.secureserver.net/02cec1f0-fd22-41c1-9ea1-ce378e010a5b/e25af26d-4f0b-4e98-92ec-dd467ea173b7

Targets

    • Target
      Doc_02cec1f0-fd22-41c1-9ea1-ce378e010a5b.lnk
    • Size 2KB
    • SHA256 6dde62d2b11b1ca2a331881eafa66c3aea32747c40a588c160fb55b5607b8a56
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks