ed7d4ccd7ff7a68d85182a46ca2c7597983df8a4ad9ee0498495546b45f06528

Sharing

Copy URL Twitter E-mail

General

Target
Fwd_ Case Ref 1682312 Confidential 2026-07-15T01_55_07+01_00.eml
Size 3.9MB
Sample260715-bat55abt7s
SHA256 ed7d4ccd7ff7a68d85182a46ca2c7597983df8a4ad9ee0498495546b45f06528
MD5 6530e8d0922b06dd82c8830c456718c8
SHA1 f9cd4d411560ddbb721591c9e9d28951b43045c3
SHA512 5aed11d898a09e0d740cc9dee9892b615516f2ee19a0fc198709cca17dd9029d894210adfa83285c841309c16174c48f3a405b06662c703d84935382a7c843f7
SSDEEP 49152:Wxte8BAedNn1oT0wH58hr8Fpds2/2aXqqSfTzqpt:V
TLSH
T113161339EC0A15D65714A0BFF22BBC906C9C7B1B1C8702EAF37D5294B1E857446A2CED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Fwd_ Case Ref 1682312 Confidential 2026-07-15T01_55_07+01_00.eml
- Size 3.9MB
- SHA256 ed7d4ccd7ff7a68d85182a46ca2c7597983df8a4ad9ee0498495546b45f06528
- MD5 6530e8d0922b06dd82c8830c456718c8
- SHA1 f9cd4d411560ddbb721591c9e9d28951b43045c3
- SHA512 5aed11d898a09e0d740cc9dee9892b615516f2ee19a0fc198709cca17dd9029d894210adfa83285c841309c16174c48f3a405b06662c703d84935382a7c843f7
- SSDEEP 49152:Wxte8BAedNn1oT0wH58hr8Fpds2/2aXqqSfTzqpt:V
- TLSH
  T113161339EC0A15D65714A0BFF22BBC906C9C7B1B1C8702EAF37D5294B1E857446A2CED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery persistence spyware
behavioral1 behavioral2
- Target
  Conduct booklet (1).pdf
- Size 1.3MB
- SHA256 7999f5fa78d8dfedd804c1d61a4d3266ca6ba9f944b91b8983755ae5bb5ad7cb
- MD5 02c9ffdc87f32974dc59e9b11ecdcb5d
- SHA1 8440afea09e2b30b31284b2cccf84a4812d6774d
- SHA512 8d56775a767141cbdca297e4a7fd7d2958fd89e6b0fcdd423533bb8d736c9494fa18f1a91a218d620c33e7a5516924ecf7c6b48204c5a3302c0de74c2ac9072c
- SSDEEP 24576:GoorcsUpqmq/BP055rRmN6U7KGKk5kho8Vobfn4/YsYfL727IE+ftvrK:Goor/bPor8B2GK0lY6n4/YPfL7KsVK
- TLSH
  T12D552364A2260CE8BCA706357B891D6351CFA1E7054FB50B3EFC46DA6700FE591B0ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Our Business Standards New 230326.pdf
- Size 1.5MB
- SHA256 e16a8eecb421c1c02c8f6825c4ef90c66d935f69134e62f73c05959b45ea5f05
- MD5 9dff548910d307e6ff38cd68b47ad29f
- SHA1 0940bde5da561c8fa81c4508dc556dd341fd9f8d
- SHA512 062662cc8b5acce5895cf019b8551820bb6cc4d16e924aa6f4b926977ebb742da8aa2c68dc4c4d4274d0f12b9f3c5a4674fd1c1bda6321542b08a783cbb500cf
- SSDEEP 49152:Mh1PcRs5JmF/OwPBlUpFwJARtyN04kM3Ryyv:w1KhdOK/UMJ4g04kARb
- TLSH
  T1767502669695D8CCC002CDFC3F744897A9DFB173D5AA3CE230AC80C75788EE9B542696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  email-html-1.txt
- Size 5KB
- SHA256 30f949131b49655962850f5b736b88c152e2324d65175f61f2700675c692bb70
- MD5 0f22737e33fdb2c5493d4f826276af9a
- SHA1 336f520868db45e7baa9cc5b17039850d49b6534
- SHA512 235f8b0c31d8cca9abc9725b70097c47ed767ecc636a3c82ce0c56ca3499ddc4a95d2b08eef9d4d15ee544c2a73a9b27d6064ff5abb2acf3f30a784190508837
- SSDEEP 96:2STS7SESPSESySESfLSw/pvpSZnaSTiJSq9iOISWpe6SP6SQSTgfhxmSKiOLSOYa:ZTI5i5x5iXRunXs7JIjJL8k2tLbpAKqA
- TLSH
  T1F2C19462D7565D3781B4C0CEF02A6EC870C62219A3231877E3E87977B65DC32392A6CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  image001.png
- Size 24KB
- SHA256 14e94f7c260f94902bd5f43fc33d02c9b9fb48ac96c01c8c47684613d97c8455
- MD5 a0e30449306173d7ac1fe555d6b43066
- SHA1 b669f28642d5a9eae4a741bc779dbac861cf727c
- SHA512 5f8df0f48ba90921fa7d93665879e653808b94a7fff3c20fbe943ca1a16a9b94655e810deffcab16cad5c2b44a5cf005b8bfdf755719ca6c034b2c71f4fdf446
- SSDEEP 768:CsGtyN2JGCWFW+o84Dyki09PmgYOlRhPv:q7PWE84mki/gYcRVv
- TLSH
  T1FAB2E10AD375216073815324F7D4A8F828B6E6A35F025CBE94891815DC3ECAF2ECC66F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  image002.png
- Size 164B
- SHA256 7a5830e5d19a48807b264972484512e31529852db6320f0da0657d09dd2ffb9b
- MD5 f69c70769ae7eb8bf32800b9285e6f40
- SHA1 f0011ac85641f6222b24b796b96b7cbb6b68585d
- SHA512 0e4aad64317920c6e3286b0874ddb87b1214b20b7d68d1b643891153e822dbd1cdff7ec1330653dcd76b39f1b193d377b146eab3e81d6768e8c74d86d79e486e
- TLSH
  T1AFC024F341C41C7DCF45413713F35011545515DF51101407DD15D33C54151DCC745743
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  image003.png
- Size 204B
- SHA256 788c43934e997c10901b086c357041eaaf68bb4c9d95412035007b8a8b4454ee
- MD5 e4e50f7fc07e376a154bfb16d61cf421
- SHA1 59a41f867126c25f54d2269c7026af85f96edc80
- SHA512 98bc23bd6b3a1bfea341e20cc13e7d257be75716d64d1f2ed040d86d1d3f348fdfda882ad29086e42bfff7d3bf8e6cc1e539ad34be2933cc6a35be2862679a21
- TLSH
  T145D022EFF1438E79C2004A3B42A40A42BA7F139BDC195D1C6013E2580E5A99FE4ECA83
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  image004.wmz
- Size 2KB
- SHA256 dc15a6804efea0f440679a3f28f924bc932d0a43533925e092796f9a551126ad
- MD5 e8a283816d009efaced98ce6786b03dd
- SHA1 d61b11ed11de681df8950adbaf04f120d5b10f4f
- SHA512 6ab847c6f72826161fe2defa4294bf7a8006c0a0c2a57cb36a2bb96ef3104d0c2049ffc153823d4c570ff3c48f1d987f1898be16c6e09263cd9377f11df095d1
- TLSH
  T194411B7243B0F97098F50650F44AD54E65C1A025AB084E6B1C65A44F46FB772AC39B2C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  image004.wmz
- Size 6KB
- SHA256 3f59cb2479d5ac3e1c5cadff4d017651454cd68b211d9d82a1479aeb246271f9
- MD5 290c10d16a9818efcfce732c13a2ef53
- SHA1 e74d14607ae086bc26c11637a5a5f47b9bf7912b
- SHA512 4b26e6ae7b1ef4c6ae16e8443518c1a5585ff09f6fe090ea47642be2c7b968ff81bab958ced3eadd05478cb82d9efd08a96a04494e4ac8146350d5be70aecdca
- SSDEEP 96:RU2fcAVKOVfjqXpnsowSDTq9x8HZb/IMPbO7lvhAB6:Rub5nXTM6HZbwMPbO7thA8
- TLSH
  T124D1D022F7854B57DC386F7084EF8F09B1B6E0615F20071B6664F63C7DA5275AF16A80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  image005.png
- Size 1KB
- SHA256 621552927e0c6e133bb644838a68e778eec403998130662fc7403633de09c897
- MD5 969de082dfbf3454c3466a9164fb1f16
- SHA1 aee508d5ade084b984a19090b4403d1e3b5ba577
- SHA512 8ef0afd006fb48ecefa3cc546b59d6791c2bb20d67a1bdc6627d53abe6a5c03cf7abb884cd09ad3a7b6cb14f7ae818244439392ab7eb4708d6f6aa58304046eb
- TLSH
  T14121E9C3624CC2C4D80DE255798CD5418C5668C70961A161C8393BBC8F3C3A602D06E7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20