Overview

overview

10

Static

static

1

Doc_8b8efe...1c.lnk

windows10-2004-x64

10

Doc_8b8efe...1c.lnk

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    04052026_1508_Doc_8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c.lnk.zip
  • Size 1KB
  • Sample260504-sh684aev2y
  • SHA256 c9d7a2a49382ffb97b27aee9497e38c81ff343ecca0acf00eca61a8a58c0d68e
  • MD5 SHA1 SHA512 TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    https://243.180.62.50.host.secureserver.net/8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c/4d2c1f00-36b3-42f9-9c96-d5e6fee257cf

Targets

    • Target
      Doc_8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c.lnk
    • Size 2KB
    • SHA256 672276ff3a86783dcd56a706dd931ebcd0023e63f5cdb8fe0f865335a5b9d74e
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks