8e4103fae0561343706e7753574224bca5a1b28bdf6697f5cd1180824559412c

General

Target
11052026_0923_08052026_April Statements.zip
Size 1KB
Sample260511-lcfevsd19s
SHA256 8e4103fae0561343706e7753574224bca5a1b28bdf6697f5cd1180824559412c
MD5 a1f4d403cef587aa603691f24957bf07
SHA1 166e8911dfaa0875e2120cdd6e241f63a879aacc
SHA512 912d2054dce994cdd2ee2585f7231ceb4db3aaeade64a04a730a2895659fe8409444fd2bab5ecc77ef640a4fc884b89cb0ec10618109da33437faa1b6a5bd16a
TLSH
T177319451E90F9C51EC1D447AEABF6A1F5CE7C9026CE8141D2AD0CE003FDA24A04EC289
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  Remittance/Invoice_02901.cmd
- Size 1KB
- SHA256 e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007
- MD5 bb9dae4911183126b57542b83651cb4c
- SHA1 4f711c6d3bd62c252e0fc9d5b7e70639e3644643
- SHA512 1a94d25d1950c2c28c3104b7a89d9d118b46febcc487992556c9d9fe7fc9293b4da83dcbc1219ee70a01d29f4134e800093a19d6b8989091c5d77aa9db2820e9
- TLSH
  T1513100E12465381DDA279A50C80A03B2E7C26711CB013ADFB0E8E194BE057D5CBC7D8D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Remittance/Statement.cmd
- Size 1KB
- SHA256 e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007
- MD5 bb9dae4911183126b57542b83651cb4c
- SHA1 4f711c6d3bd62c252e0fc9d5b7e70639e3644643
- SHA512 1a94d25d1950c2c28c3104b7a89d9d118b46febcc487992556c9d9fe7fc9293b4da83dcbc1219ee70a01d29f4134e800093a19d6b8989091c5d77aa9db2820e9
- TLSH
  T1513100E12465381DDA279A50C80A03B2E7C26711CB013ADFB0E8E194BE057D5CBC7D8D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral3 behavioral4