General
- Target ohlzi4akozcdoblr.rar
- Size 296KB
- Sample260701-kzb6aact7z
- SHA256 5f94db2c5c5e5b8df99debbc75782e263f37fa20f401fd345de437f796576831
- MD5 52adc79c05fac23fd135456b13c27543
- SHA1 cacb261f879ad0644287defe6b9b8cf77bca5444
- SHA512 0017f6c101852ce0c71cde9e214e5c81c76f4a7ce03124cb9da5f839994437608585b0f3d5c4d80b035eafcc98c61e044476f77f1b65a00b7626761e99bf77b8
- SSDEEP 6144:E0E/Da7nBepKSOEhmWDXC3Wm2vED6J/w/oouPeQdOYZ79pcXIa47Y1atcV8C:EB/DaZSxhmQ0Wm2c2/+SW21Z79yXIp7a
- TLSH T1D154236663702D07CF94413ACA5DD0765ACE3E47F243BA92C63BA2245A3FC60D5DD31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ohlzi4akozcdoblr.rar
Resource
win10v2004-20260513-en
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
ohlzi4akozcdoblr.rar
Resource
win11ltsc2024-20260629-en
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
ohlzi4akozcdoblr.exe
Resource
win10v2004-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
ohlzi4akozcdoblr.exe
Resource
win11ltsc2024-20260629-en
4 signatures
900 seconds
Malware Config
Targets
-
- Target ohlzi4akozcdoblr.rar
- Size 296KB
- SHA256 5f94db2c5c5e5b8df99debbc75782e263f37fa20f401fd345de437f796576831
- MD5 52adc79c05fac23fd135456b13c27543
- SHA1 cacb261f879ad0644287defe6b9b8cf77bca5444
- SHA512 0017f6c101852ce0c71cde9e214e5c81c76f4a7ce03124cb9da5f839994437608585b0f3d5c4d80b035eafcc98c61e044476f77f1b65a00b7626761e99bf77b8
- SSDEEP 6144:E0E/Da7nBepKSOEhmWDXC3Wm2vED6J/w/oouPeQdOYZ79pcXIa47Y1atcV8C:EB/DaZSxhmQ0Wm2c2/+SW21Z79yXIp7a
- TLSH T1D154236663702D07CF94413ACA5DD0765ACE3E47F243BA92C63BA2245A3FC60D5DD31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target ohlzi4akozcdoblr.exe
- Size 515KB
- SHA256 68de699b2885d335c90d41d37d402e83ba3bb4a4a5a08aef0290483b602dc050
- MD5 1137f08f4dfcaa305b8fed78e2b63183
- SHA1 2b0ee292ac015b5ce06736274a8932419893a5b3
- SHA512 230c5eaf0833a972deafbf3b26a00d03eefe01e6201f787986351fd8c78c3183257f04c2687db788d9ff503f2b324d52c09bc48fe9bbb638945ea603c5349bb8
- SSDEEP 6144:HlHd29rU5jRn3jl+v3TJhoPVUYLi6NmQAGyiCAPl44qp1IYwLGN6w2IbTq3pADll:F9Htn3jlYjJO9LaQArzZUA0BC
- TLSH T18AB43A157FA98E08D481297E455E4A18CBDAE1F222327307370AEF614D45DDEDE2C3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.