General
- Target XDR_ResponseApp_CollectFile_RM-20260619-00013_8216ae9a-c87d-4a28-9c99-c37032d36349_20260619T160619Z.7z
- Size 1021B
- Sample260619-vxpnpsbs2v
- SHA256 379a220afc6776be04069404dac681b825f371e288fbde4402b0e45bc6232dcc
- MD5 b697340667e597aab72f27313068f84f
- SHA1 4454dbb2e0bf2e650e79fcbc6556a1cde39a8ba3
- SHA512 9756a1d84d43ce72d21ee60ebc942f00afc52f861ae69f9a509f6d3c333563b902cec4be932c1b459690df0fab246c864445a5b4418ae58fccc4de17b97a2854
- TLSH T184119438A1429281EC6A0373304A82308ED78D61888F53556E4CB68329325A2AF8E9D3
- MD5 SHA1 SHA512 TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
Beware/bomb.bat
Resource
win10v2004-20260513-en
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
Beware/bomb.bat
Resource
win11ltsc2024-20260618-en
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
Beware/capaDaInvisibilidade.vbs
Resource
win10v2004-20260513-en
5 signatures
300 seconds
Behavioral task
behavioral4
Sample
Beware/capaDaInvisibilidade.vbs
Resource
win11ltsc2024-20260618-en
4 signatures
300 seconds
Malware Config
Targets
-
- Target Beware/bomb.bat
- Size 1KB
- SHA256 97a77202b83844706847df6954fcec44b27e109ca087be97403810326191f185
- MD5 41319256648a99fb13f87f11965e25db
- SHA1 6219b03fdb9d40f8cb46173289eae5dd6c490237
- SHA512 69000aef9d94a603bb3a82282aa3dbee20f739386d960a06345f1885f2da879ebc125f2f7cf3eb195ef3235a65daa80ba804ff977cfb633bb8518f1238b751eb
- TLSH T15821120C78C609219FA128217D3EE3C1B44648C78868EEEDA43B1228A0968F830ED057
- MD5 SHA1 SHA512 TLSH
Score1/10 -
- Target Beware/capaDaInvisibilidade.vbs
- Size 79B
- SHA256 7862c7c96b1378f477bd68302a523d1e64667840bf117db5e926fc3cce038e48
- MD5 7475aa9a52b4e4a46add887ba4892548
- SHA1 52b08ee51f747db06d8f9d3afc4ce82dda2aa2b0
- SHA512 5ba4e3be4e0c085274d43f3743a6631c76740b97e4b1484f923f329b704fe5b01b544af9d7bb0088ba95cf8834e6394ae1427c0318926dc0226c5640e4c5f4b6
- TLSH T158A0222AEC2EC22088CEC2F303B00B088BECA02200228C220B20C0C8A3280800320223
- MD5 SHA1 SHA512 TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.