2d5dfbf29d474f2fa504a9e5d625169ab3b09ecec719d5b5ecb0cdd893d2080f

General

Target
2d5dfbf29d474f2fa504a9e5d625169ab3b09ecec719d5b5ecb0cdd893d2080f.bin
Size 81KB
Sample260715-1mfwpsey3q
SHA256 2d5dfbf29d474f2fa504a9e5d625169ab3b09ecec719d5b5ecb0cdd893d2080f
MD5 7c8df8248b248f2be53b525fd695750b
SHA1 ce4cc6d321c9ed471a1cf792c850e6f8796160ea
SHA512 cfb0567979f75149f669675434c82f3b0bba04e4be07399f386f2402bafeb3ce3ae8ba26d186351c59502eb89139b674d86a5ff087f00ad49cfb1dc27a20e282
SSDEEP 96:smLHyO+nj58g2VcL1ynH+njlCpCNys+njPkSS19QXkR5:BHcy06HcRkkcIvXvv
TLSH
T1FD83DF3431E90118E1F3FE716DF477D6AD5BB9B7EAB11688594102060D22B80FE26B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  Dohovir.docx.lnk
- Size 27KB
- SHA256 be3b89da7df189548aaf80954f46bccda37f048fba2b2e94d0643fe1610c08c4
- MD5 16dde91abaafb0471b0a06e56325936a
- SHA1 0271e228f6ee412871ef77e46a7e24d55da2b08d
- SHA512 cc7691d5f2e1d4619e891ddaccdbfa07194bbe2332443143972f982ee78de39c2a70b00afd02779d0ce689f0d0e6b6f7e76684bc1e81cd54baf7acce2d450a6f
- SSDEEP 24:8d/+qSPNV43yaWInZZGEhcSp+UOi+Eu+njVHq28gG7MflAG:8l+FVHanGJy7KEu+njtD8gMj
- TLSH
  T1A6C22D3035E9004DE1F3FE316CF477C6AC9FB6B7A97112885540020A0922A40FE26F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  Scan_013.pdf.lnk
- Size 15KB
- SHA256 5781ddf3307fa8e01a3642e1bcd11b42217f05bfa75e73c295af5f7f0bb20e9e
- MD5 a7886622207fe86c3379dec8d559db31
- SHA1 b4cd0c4f6d3d0ca9a11b4c20577d537570fe5811
- SHA512 c83cedba6928dc87272162f0c9c5430f2568853522c9d29d4c66b0523e3b3a6cf202033c8169af1db86d73116b34e1bd6871b646ca6d28492c8737b0c3f200a6
- SSDEEP 24:8d/+qGPNVxWyaWInZZGA5Sp+UOi+Eu+njVHqC2Mn0:8lKFV1anGA5y7KEu+njtP2
- TLSH
  T1B472AD3431E80108E0F3ED71ADF5B7D29D9FB5B7A9710699594242090E22F40FD2AB3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral3 behavioral4
- Target
  Spisok_na_Zakupivly.xlsx.lnk
- Size 37KB
- SHA256 5fa032ceb017366e473a5ca6f5f98dd799254943a7635b0190995f75b5da4f54
- MD5 a3493cae9ddfa077479b43f7f3390f84
- SHA1 d6f91f65daf1b4b928b8dbbe1c9f6eb5eb7b1ca8
- SHA512 08abbf671a29f380bc2341b4421c3a00528e0ff420c4ddd38339220425c83023b10cb9af69f620f15c4aa2e6a0450b91598f325069afa696928f103853611662
- SSDEEP 24:8d/+2245kXCPV6yaWInZZGJ5Sp+UOi+Eu+njVHqckShZMc/81hr:8l+22tCVXanGJ5y7KEu+njtlkSfa19
- TLSH
  T1C903BE3435E90109E1F3FE316DF467D29E6BF6A7EAB1168D494102094912A80FE66B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral5 behavioral6