mispadu | d480bc9dedf434194a97a250ca8f13ea05b3ea50945a6dbb4e886c09f7cafbe8

General

Target
doc-20260627-207729.zip
Size 14KB
Sample260629-sn3svsgv61
SHA256 d480bc9dedf434194a97a250ca8f13ea05b3ea50945a6dbb4e886c09f7cafbe8
MD5 1d32dc0588e296c4373477b1c022d657
SHA1 bc1f065550726498608b2dc5423628d6aad78330
SHA512 378e42f1823a6d924fdbd67b9bea2d2899687eedb4e7ee61d18b384f5341ed7644bcf6390e1b5b232315018f164d145021333dd2a4c45fb3a02674d0d5102e85
SSDEEP 384:BREPnfdHgk5qqrSLH7BxRWph+4p6ZiPCHVMCqbkzN:sfdA7sSLH7BxUZ66ySkzN
TLSH
T1ED62C098F23848B62231F63D136380E017B76AB1E70E75FB37C5E3D9250945186B275A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
https://tpldftybmovnmgbswpnh.supabase.co/storage/v1/object/public/c8c76ce9/03.jpg

Targets

- Target
  doc-20260627-207729.zip
- Size 14KB
- SHA256 d480bc9dedf434194a97a250ca8f13ea05b3ea50945a6dbb4e886c09f7cafbe8
- MD5 1d32dc0588e296c4373477b1c022d657
- SHA1 bc1f065550726498608b2dc5423628d6aad78330
- SHA512 378e42f1823a6d924fdbd67b9bea2d2899687eedb4e7ee61d18b384f5341ed7644bcf6390e1b5b232315018f164d145021333dd2a4c45fb3a02674d0d5102e85
- SSDEEP 384:BREPnfdHgk5qqrSLH7BxRWph+4p6ZiPCHVMCqbkzN:sfdA7sSLH7BxUZ66ySkzN
- TLSH
  T1ED62C098F23848B62231F63D136380E017B76AB1E70E75FB37C5E3D9250945186B275A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  archivo/Archivo-20260627-262641.zip/Archivo-20260627-262641.zip
- Size 14KB
- SHA256 b20cfd16536eb4512223afb20dbdb668115032b0b4dd0f7533bf348745598bc2
- MD5 60a242398a2dae3d50dd4b5c2c56ed28
- SHA1 c1556bfb4a83d2ffb18020541126734e00701dd8
- SHA512 38c614994c224da9880301397ad82fe6aeae67412f0999178c4c0e155f498a1116a4e896e14c5d39bf069f38e6f41e08ae7ef995d1c29a92fc4bccccd3c1b608
- SSDEEP 384:COnlElLlDVHE3CxPI/rCkI5qvxjD05oRFrzQ0tUo:XEFTHuCxPI/rCk55D0YfR
- TLSH
  T15B52C0C1CE144E5C29F81EBB78E60ADC3F78B1A696B69FDE2872102FE7019530C32116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  archivos-20260627-183926.hta
- Size 20KB
- SHA256 855cbb5bb8ff851e11e72af9b1b729107ea60bee7326ebc8c79524986037e1c5
- MD5 50fc14b1bbb0317866624775c499d710
- SHA1 627152925d42b38f4dec6e19a32e23e63025b4a5
- SHA512 fe63ff6768564fe4ac72e45bb3e6c92ad1c24c520b6976c169626a67623517837a9053c0588394df3438f18b9b25a1a6723b442ac642ab41a7360bb756f41b72
- SSDEEP 384:GgrAGqDqE/7vFZx3LBZQlX7cWsaxUxlQn2zM5jZvVy4hv5ITxzW0EfluHPf1ubT:CILZsX3zMTdT5ITRXgc1u3
- TLSH
  T149926D3CC039F715C1C5E206DD79F32BCC62074FC514BA9F26622639759B2D586A91E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution mispadu spyware stealer
- Detects Mispadu
- Family: Mispadu
  Mispadu is a stealer written in Delphi.
  stealer mispadu
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Suspicious use of SetThreadContext
behavioral5 behavioral6