Overview

overview

9

Static

static

1

PESONet009...ils.js

windows10-2004-x64

7

PESONet009...ils.js

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    PESONet0099394ReversalTransactionDetails.zip
  • Size 2KB
  • Sample260701-phm9fadz5k
  • SHA256 092723d9d68f2c227a5adca4559d061fc14cb609b0c0674e23bf71bd6cc064f8
  • MD5 SHA1 SHA512 TLSH
Score
9/10
defense_evasionexecution

Malware Config

Targets

    • Target
      PESONet0099394ReversalTransactionDetails.js
    • Size 5KB
    • SHA256 55865c6b6ae4d7b62713790ecd2fda0c4dc8fb3544d547701e796656aa018304
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    executiondefense_evasion

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Looks for VMWare services registry key.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks