39d4cccf5b2c1f82757a40550b728ec28d24506a5a46a7721166b81d570c8d1b

General

Target
E-Boleta88706.zip
Size 596KB
Sample260701-t4eawaat6j
SHA256 39d4cccf5b2c1f82757a40550b728ec28d24506a5a46a7721166b81d570c8d1b
MD5 89643aacff78c4bbf65797834a56088a
SHA1 64afae62575ab7ef1f9a43c1e704091e7e4fc367
SHA512 407d16a32f6adff148ffbde1e1c8ed0dbef724a685bdf22aee21e4b2916c211b9c0e870232be8d686f4b770df3ad41ae4b84382c43f0b7f2382039c9b559023e
SSDEEP 12288:QsSdrD1JXJBALNHsXQp6dKuEy/kFI6Pq6oawh4HdXIeIrUuJAqfVTA:LMJXkH3p6YuEy/kW6Pq6oawMXQjKYVM
TLSH
T14ED433CE922E5E69010C6D98AD3BD74332B6D501A6B45C8A738B34BFA85346F4D721BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  E-Boleta88706.zip
- Size 596KB
- SHA256 39d4cccf5b2c1f82757a40550b728ec28d24506a5a46a7721166b81d570c8d1b
- MD5 89643aacff78c4bbf65797834a56088a
- SHA1 64afae62575ab7ef1f9a43c1e704091e7e4fc367
- SHA512 407d16a32f6adff148ffbde1e1c8ed0dbef724a685bdf22aee21e4b2916c211b9c0e870232be8d686f4b770df3ad41ae4b84382c43f0b7f2382039c9b559023e
- SSDEEP 12288:QsSdrD1JXJBALNHsXQp6dKuEy/kFI6Pq6oawh4HdXIeIrUuJAqfVTA:LMJXkH3p6YuEy/kW6Pq6oawMXQjKYVM
- TLSH
  T14ED433CE922E5E69010C6D98AD3BD74332B6D501A6B45C8A738B34BFA85346F4D721BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Ver_E-Boleta-88706.bat
- Size 1005KB
- SHA256 13fbae79bd3f69990e6de9b2cda51732833a651d2a0e954434cc80c7012d26fe
- MD5 96916a51d3dba2bb20930fa36145632c
- SHA1 3b85469d6ff70e278512bc1dd94727e5cbd24956
- SHA512 d0fa1201a72df57cad60828fb27aaf519c243536d9ef4ee55d22d4b724af8a6480764eb027ba1e0ca31f3b6edde4468c9d4e5ba9c737de3f597681310809af5d
- SSDEEP 24576:sgOVGJfDDMxK1mWXcrsf+mKxYmMwZVvcRS8Rq:wzTnJ
- TLSH
  T1F1255BF72AC00E49A5A939E9FB171CCC03479C45AE75CD9D3CF0E94622A6768ED1E831
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution installer spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Drops file in System32 directory
behavioral3 behavioral4