e373cc3a306b2eac590f6bb503abd653f262e3615d88cc67f9dde3ebce9139a8

General

Target
e373cc3a306b2eac590f6bb503abd653f262e3615d88cc67f9dde3ebce9139a8.bin
Size 12KB
Sample260709-xd58fsf14l
SHA256 e373cc3a306b2eac590f6bb503abd653f262e3615d88cc67f9dde3ebce9139a8
MD5 c2822742ad48ed1f67bb4705dea3a6ab
SHA1 f9f138d32b54036f3619829ff4396b3a0a773c8b
SHA512 8326394676b68b5c105db690a227e40bae7871da5ada5294e70b5db776cd76587f1d7b8956851c686786416408dcd679491e1f2a58a2fadf22b648455a3f4a00
SSDEEP 48:X7P/bXanR4+sHHmtu9lhIkC7PxBB1anR4+lNE+L7C9bAzLj/+7o/Sl7b:X73zyRgHDG75BryR4cUbAzm757b
TLSH
T14E52FD2475F91145E2F3EF71ADF87BD5AE6BF6736A72428E1486120E4A01E40EC1073B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  NAKAZ_MO_perevirka_mayna.docx.lnk
- Size 6KB
- SHA256 1e7464bc601236ebdbe49ff89ff1d3cf8e70ebce109614751c5eed579934ac1d
- MD5 d02e6f23aab58a803463f708b61da821
- SHA1 966fcf6c2d1295063442661cbe189b58c03a7d37
- SHA512 dbfd8fc3c3f4590b6679b99a8c11fa9df668ecf08c51d202d8da3da0029ba2dde0a4021cf24759d095b0096a90f07ef0906ed6abe42fba6cbd9f62ecc26f9fff
- SSDEEP 24:8d/vn3JYPU6yaWInZP4S7WZ1WOHmnTZzs+m9lhIMN:8l/bXanR4+sHHmtu9lhI
- TLSH
  T161D1AD3479E90115D2F3EFB2ADB5BBD59EA7F663687212195482030D4900E40FD1073A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  SPYSOK_mayna.docx.lnk
- Size 6KB
- SHA256 a6615e7e1d1889e9d3b0083b381c8c12751437d7b2a374440296f8acddc038e5
- MD5 6a2001da8abc43091c3994a1e90213dd
- SHA1 2cb3f713a587519e80ab3177fff67fa6374a807e
- SHA512 cba176d323caf0806fc39bc34fb1789442b618a826ced9883b7ecffce7e9e9b1f93eafa39cfbb09988457a4020811423947ca23103b03b7561d8276154140e70
- SSDEEP 24:8d/x3RB4dyaWInZP4S7p7DBEpmJL7rGvlxPlpYZ+QGKMBSm:8lxBB1anR4+lNE+L7C9bAzL
- TLSH
  T1E7D1AD2475F50185F1F3EF356EF877E19E6BF6A27A71429E1081160A4501D40FD51B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral3 behavioral4