19062026_0342_Payment copy (HSBC A2rKEW3FwXGU).bat.rar
- SHA256 394de28d05af9d6674ebca205278b9581eb4fe5cb42b7790805c6488abd2fc84
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Payment copy (HSBC A2rKEW3FwXGU).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
Payment copy (HSBC A2rKEW3FwXGU).exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
15 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
General
- Target 19062026_0342_Payment copy (HSBC A2rKEW3FwXGU).bat.rar
- Size 273KB
- Sample260619-d9dnjadw2q
- SHA256 394de28d05af9d6674ebca205278b9581eb4fe5cb42b7790805c6488abd2fc84
- MD5 3b3a2cb42ccd35b0bf5ba3d02b5b6ae9
- SHA1 036208c45e005557fec8816288012eef807d764a
- SHA512 6bf67b8f9d3f2c9458532ea8066a215b1bc2b23e85367f31a0b2f0812fe91ab5acd2574900896dabd65faafc5aea45ade54dc03a75eaca999e2190d1fc886243
- SSDEEP 6144:x8ep7UNxDQD/3tP50LoZSw1hQzqgaWMlxGKj/AOZgW+guI4KbvD/ErJ:jINxED/3P0LoZS5zqgaWIIKjHgdguI4B
- TLSH T19A54236D0B658B1182E5365AB3E4307B44708332E97A568F4E1C092D3ECDB56E3B53BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Payment copy (HSBC A2rKEW3FwXGU).bat unpack002/$PLUGINSDIR/System.dll
File Explorer
-
19062026_0342_Payment copy (HSBC A2rKEW3FwXGU).bat.rar.rar 273KB
-
Payment copy (HSBC A2rKEW3FwXGU).bat.exe 359KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Bolection/brndslerne.cue74KB
-
Bolection/cytoplast.dis59KB
-
Cigaretrrets/skriblere.afs78KB
-
Cigaretrrets/strmsvigtenes.sam30KB
-
Coasterne166KB
-
Rebox/frynsende.kom68KB
-
Rebox/homoiousious.ver50KB
-
Rebox/maskinchefers.kab7KB
-
Rebox/myrianida.ttt40KB
-
Webwork.pap55KB
-
abigeat.tae21KB
Payment copy (HSBC A2rKEW3FwXGU).bat
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 b82f9e8db8498f52fe986a31acc6ec7ba2de38c4c7a1aa69f043f577497d87e0
- MD5 d022205d82dd10c284166ad80d5c9d22
- SHA1 cd94d67990828d7ea5513c1faf0ea3fc047c9b8c
- SHA512 a006f733a6b2a09e9ee1935784c05becf8bda822be737c523fcfa2af12ed072da4e6485378faecc38b4f2cf761256adb077abdefa4398827cbda50ef60f539db
- SSDEEP 6144:zQ606xy+J5ulYpE7AamO/hv/ZsoOYLPix+VTH3jNYdBWOHku:o+3ZamOpHSzaL3jNYdMaku
- TLSH T15174F113B330D963C628073144D76B768739EE242E1F8B471358BF5F3DB6282A91B299
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
13171
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
163KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
- MD5 8b3830b9dbf87f84ddd3b26645fed3a0
- SHA1 223bef1f19e644a610a0877d01eadc9e28299509
- SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
- SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
- TLSH T10D325D06235081F3E1914138846B3E175B7A15069BF58E97DFD38646BE30BE7BD79503
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bolection/brndslerne.cue
- SHA256 497df785dc95fe961e4ae9b9ac89a72205d05cd614ac6d82dc80749b16ac988e
- MD5 cb38c9c8260995ba37ef436883a0f482
- SHA1 83c7e12d474fcd4829274dea9ca03b197b277571
- SHA512 5f02dcdc73242bfab7d9c621579974c890ae8ffaeefd025b991b3dc6d4b2579f7ae1d5336a5c6276ffd0575dcc696253e636fb5298d44d43030a1e773fa221c0
- SSDEEP 48:RCicnpKKqLg1Du8nAkC+LoFgVHUzIiqvYyXeB1B:RCicpKKqUDlm7mVHUsSB1B
- TLSH T183735B02B8111302A7760140FC9B25B180D2F481E2EB889F6C6D632C7F7D970E819AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Bolection/cytoplast.dis
- SHA256 bb34d36226dd5c346bb61795912f1d024886dc0b99ed044cc89d414a2242fbda
- MD5 e9c792ca0792f4435394e1caf89f8dc9
- SHA1 2fc94f4114fad1f6c3ebe38e3fcc59f63d61d875
- SHA512 6d9f54fa24e760042ad9bb2b3da25e3673adf1848079cf0af7d04a064f371114bbbbd0ef9bb6976786d473a3733e58bc6f36e29e4ff9a9e7c131e7156935d9c0
- SSDEEP 96:IMcOhU8dQh0v+R4jGUXZGEBtDK1KUjM2h/:/QLR4jGUJ3I1
- TLSH T101530AC14B356B8960C54DC8762CAB0A67AA43761F7CCBAD7305509E72D1EA2FB21D18
- MD5 SHA1 SHA512 SSDEEP TLSH
Cigaretrrets/skriblere.afs
- SHA256 9aa5bfeb472533a04254645aae208a6d8de1d942246495e47b56fc3213ccbabd
- MD5 72a22f233545cea82173271341817c11
- SHA1 045d4b39074dbe064be1ecabd97cc823fbf3b738
- SHA512 42f3640a752f36bf2454196bff0e29d012968e4f8604374c548789d981ad6fd549c0728286438a4dd60a4bebcafd6173b4ec1b5115733dfc91a2e9b6a3655171
- SSDEEP 96:K0mtotHEHw1eVnkPG/wYZgUJAYzZ+fLpqtU1fVPXK0IKSIARVO:ctohErREGoYZ9aY0pqq1fV/K/I7
- TLSH T1CE733A1FEA14AD0EBC596E84A3DF7C64720C76516F62D32A1B88C9036DE3F4F445E291
- MD5 SHA1 SHA512 SSDEEP TLSH
Cigaretrrets/strmsvigtenes.sam
- SHA256 ceb9e7a88444f4577ae54e63db8bcbcc7bc82ce6469e783e0556baaaa4503ece
- MD5 46c4659a91145b35cb0a1d0f47cdfa40
- SHA1 fe6506b37cee3f049435282bdcf478e4748ea65e
- SHA512 17c392e1f427ad4e711e0a76f7c80ae7dbae84309d9a8482ebdb49d7e1d8016c12e8bc79fde0dee43f9ba218cb0c8149add52ce90d1b4de2cbc77050f1c6a4a0
- SSDEEP 48:5WKVBf00hTgy+c6HH0PcukJ38ZquV134dS0Sh83wp:/9gyz6/ukJ89vXFp
- TLSH T1BBE2C851B6C41C2A195F7035E3434093CD0FFCB2817B112A38BD00D08F4714C4259B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Coasterne
- SHA256 8c3586d4bf7b57059c60d6c159fa0d9b7de3b3f01fd00996f5ff7f18fa455612
- MD5 b979c72e609a0cc463884d1b0d9a57b4
- SHA1 c353b083165249d46c61f66e084b17c2751539ef
- SHA512 0e6efb4c8da33b174adbb12f7ad5e62da49d0bec378a5b547ebadf441582097e68df49582fc7eaa80b9cb3743f0c9da7af820830a6800f531335454f061322fe
- SSDEEP 3072:cA7ewqXV3b+Kf2o92exSVAMTEZLldFiDWTAjQnegD:cwLqFX12ySeMTILldFiDWTMQegD
- TLSH T1EEF3F158975BFFE5D4034538A9BEB2E71A00680B5204C6E9C1B29F9783FB1DBB360384
- MD5 SHA1 SHA512 SSDEEP TLSH
Rebox/frynsende.kom
- SHA256 5d4dfdb27819a79c9f7e4c7a6f78fbcc6972b29c3da840c0af2a4c88d7be3870
- MD5 c0e98af1bf4c94bb5c46da2ea317ec7d
- SHA1 7503a102e62ccfb4060d6bd6966f2ee0854977f6
- SHA512 b2f24287aa575bff0a109b7b0b19baf73f41cc3160a3a06e03d2bdc924f6f21bb4b5150c303c998cba89a1f2de44ed335a3f501dcb7733691441ca4dde4faa5b
- SSDEEP 48:wvZOEgabSUvAVwyshpoqVhZx1RBkL+lPvkCr1GQzaK9b:wQE9bSUvJrlVpRkL+lEw1GHab
- TLSH T10D631AB82355DCB379B84E72841A99CB80D349A9AE53024326087F58890DF035EA1863
- MD5 SHA1 SHA512 SSDEEP TLSH
Rebox/homoiousious.ver
- SHA256 55a838c1e1b60bb87ba2f9f604a2a5d122483aebb6254fbd2a64d7583f7b2dea
- MD5 f81c904b552e29ce3722daafdf0c4890
- SHA1 258ad48e9b26a767638c99a2ae2da3884a81eca7
- SHA512 44bbe98f31aa4cbfb60bd6ac8eb43d10e3f1a0fb74eb3b45b9f50e16ed118487e0642f252f968c13417475c32c94209d8da87939a121e5fbe8f8309b3648c00b
- SSDEEP 48:+NJ8Ajkgncr2ztnwGrerFHOWlnZ0DHzHw2Xvhr2W:+YQz9b08TQCVn
- TLSH T1E933D6515905B928DD2733E01E14EFCED82A0A99E865EE2DB260A45D356B82F680A84C
- MD5 SHA1 SHA512 SSDEEP TLSH
Rebox/maskinchefers.kab
- SHA256 7a381883b4cd471f8730a333a7ccd07e4989a40fe327bc8cd33a210f2d6d17bc
- MD5 ade1ec2a20a22c0fcf55ddfdc344b034
- SHA1 689950ed1b3608451b8fc77e4f48db47d0112529
- SHA512 1523201bca19bcbfe1534b2ee20099107bf717abd87186f70f0ccea63adb89c6c56ba245d1bbb874e31a5e63d33690635f5541bb6b08f39d3e156b94f6f5855b
- SSDEEP 6:DZHNbkDEdNNmLlAD/sNNj4mzNE/12HrNN8:D93TI5BDc8CQD8
- TLSH T157F122EE4CE7237E8E3FED7B02E2290A038A80C0E36C840A9CA2678C51080910C04A12
- MD5 SHA1 SHA512 SSDEEP TLSH
Rebox/myrianida.ttt
- SHA256 a57ac9a6a6168495de7ccb0a884ac5d368bf73a51a650b0ffe9cba09fe26c234
- MD5 026f4f652b075ed694d813f8dc1b8cca
- SHA1 1a6416edfa6109ac53d72bb1fc16174eb5bc1bb8
- SHA512 27e91c984e9a9387bf7d8a91697e5a86ebaa4079597015060d5b21214975049e9bb1f389b73004067628cfe9302b731b4a2c21cbf3f9d97d0346bc1d0c27ba75
- SSDEEP 48:JOvZKJ5A+UKQTmY9v2KWEUv6b6LvlNYuS2/xa:JOvoJ5A+9QTmY92LEm6b6LvTYuD/w
- TLSH T13B03B77746C7734B2004DC2F15E62B87C3711BB411BB673C582D0A0983EDA13AB26BD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Webwork.pap
- SHA256 4916b19a56d0555fa32d8c404de1caf260d35bdae910fa917fb8d96376ff01a2
- MD5 4a1e525197e916af56417cd6201ef62c
- SHA1 8c5ef1254c8073feeecb4e659f0a72e796c9c758
- SHA512 64ddcf143a9be0bde6eb06e9f859fe362bf648b4e7d971df90c1397d22774ced1f197943f5c96c7c68dd3ac09d3f3b9504e837f1d99b4e2f8462003244ba748b
- SSDEEP 96:CU9Oqw0nJk/pwI6QNmCpZ9Pg3/7EeChNxsIMI9gJS9DoZ2Q0Sx:CsOq5kZdDdg3zEDhNxlX4SVqF
- TLSH T1CD432805CFCA72171F42C1A626258B1E402F6EA8A5AB23C9673B2F9599BD305843A537
- MD5 SHA1 SHA512 SSDEEP TLSH
abigeat.tae
- SHA256 7d1c98c2c5692e0cab8cf3c2d0b6bd019c84f6021d3ccde3061703188cae7b6a
- MD5 dd924c6d51def381d2a00d58156a9507
- SHA1 bcc61198b0c7556bfa7c15bbfd1b36814fc8f729
- SHA512 f78cbe86c0e24be04624890f1f0cc5ed5d5aff4f8be350c891804ea9f42ebbf73e8cdbe7891997b7ab1c27e3d0ae11d96e9613e8a39d5eabb6e78379cd39268c
- SSDEEP 24:ojhBpnV8KuUdfKxmYadJNMYbdvIEYvYORUh/Lxas:ojjpnVRuI0YbebvYOOks
- TLSH T1CEA2B07A6270133983C4F48BBF82001E84B78682340133CCAA372BEE2841200824AAA8
- MD5 SHA1 SHA512 SSDEEP TLSH