Extracted

• • Target
    Factura_N20260619-133003.lnk
  • Size 2KB
  • SHA256 9234a04f279e2fef3fda39060a15728c761a10c29349c00bb88ce38eb0c8277f
  • MD5 cf96b8977ee851a3b50d2b81e6707f31
  • SHA1 2b51e47bdfeeb30792551c008e4c8e59e32e51fc
  • SHA512 0fd193aa1f5ad780db499a7225194a024c933434113aed06ca10d308adb64bfc91c70b848cb1bfe217baa2e253b4516d8d8b1d1cc2a9f1719e154648a022e865
  • TLSH
    T14441C01023FD4318F2F39F7969BAA6600BB6FC65DA21C76D0240519C84A1B40EDB0F37
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionadwarediscoverymispadupersistenceransomwarespywarestealer

  • Detects Mispadu

  • Family: Mispadu

    Mispadu is a stealer written in Delphi.

    stealermispadu

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2