General
- Target auth.hta
- Size 2KB
- Sample260714-anszjsdt7v
- SHA256 6343f62db4f01a1436e4228cb16892bfc93b67d5f9d00b96d187af1504571eb1
- MD5 eecbc9189eafae301f996b42606cf204
- SHA1 bb66a3d3a0056424e1da5e933b48d7d807ceb3e6
- SHA512 b926c0ff460be370a5303408ac34e12cba62c07bf347eefaf172659c278624325e4ec2be006b82a6a1326bbfcc1884140ac50192c0b84f1cf490cd3b995fe84b
- TLSH T109512729E61ACD2B25CBD0EAA59C3F4E720483BED2656C3EBD0C5DAC25DD97038D15C4
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
auth.hta
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target auth.hta
- Size 2KB
- SHA256 6343f62db4f01a1436e4228cb16892bfc93b67d5f9d00b96d187af1504571eb1
- MD5 eecbc9189eafae301f996b42606cf204
- SHA1 bb66a3d3a0056424e1da5e933b48d7d807ceb3e6
- SHA512 b926c0ff460be370a5303408ac34e12cba62c07bf347eefaf172659c278624325e4ec2be006b82a6a1326bbfcc1884140ac50192c0b84f1cf490cd3b995fe84b
- TLSH T109512729E61ACD2B25CBD0EAA59C3F4E720483BED2656C3EBD0C5DAC25DD97038D15C4
- MD5 SHA1 SHA512 TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.