a9b386c14496e07dd591f0cb020eedd96c4f5b63a8e813e23e7215f89a67690a

General

Target
28062026_0917_VER_BOLETA-60757.bat.zip
Size 677KB
Sample260628-k87zbagw2p
SHA256 a9b386c14496e07dd591f0cb020eedd96c4f5b63a8e813e23e7215f89a67690a
MD5 07b689580991f665b126f47316bbf26e
SHA1 9974f53e57a92d28e11b5dce9e5c724734689a74
SHA512 6ac4d10d53e3019971b394af3af6443abbc1287a8e15a4d74e4b555fed5eefa5bd221db3f9bd38dceeea76cd660cc9cf0589fd193bb4c32fa9fe5d4a9555e16b
SSDEEP 12288:FmUCZgZI5PgZUoJTPMWACRN3BPuw+iGhL0TTaYvvZ3okxprRIEFc+U:FmvgOxYdJYJC/B8HKaQFhRIEFc+U
TLSH
T13BE423C431DB7AC9C1E07DFE7C31B9256104AEEE67088BCD001AB9BCC4A855AB7C56B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VER_BOLETA-60757.bat
- Size 1.1MB
- SHA256 b23291e5db0154d18b10570632eb39bcf22f916b4fefee5cce35ba48493d2daf
- MD5 9734c7954de476115177aae848f93c04
- SHA1 53f6530b7df547a921a92fe623cef6041aeefea1
- SHA512 937fdfd3581819ccf652c78428808fa1f6302c09a4d819c92a12a9e42d1d95104a30c07944b0833343dfcecb8b389fd7c473115186273b2a9d65b19a4ccd87c3
- SSDEEP 12288:6BdM0EpI1I37rhBVoDMj5IoQKOXRyBIiTGGVsgf8i8AUHiCRt5u6B37xA5HjXGyJ:Pn+GZMDMj5IoQHRyh6UsnAYa61xkDXiO
- TLSH
  T1E5455DE72EC00E4A94993AE9BB175CCC03479C45AE75CD9D3CF0E94622A6778ED1E831
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution installer spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2