c1c8a7c7a4a426bf5a258f36b9d3342805b1617bb2577fe67b09818f7fb1bf80

General

Target
15072026_0431_works.xlsx.lnk.zip
Size 240KB
Sample260715-e5hmcsev7s
SHA256 c1c8a7c7a4a426bf5a258f36b9d3342805b1617bb2577fe67b09818f7fb1bf80
MD5 033f983ac6dca46dd221bbda5671c873
SHA1 586616f77e773a747194eb7215a93b7b0d527247
SHA512 ddf6cdcece00c038774177df225f27db6c0aee831603d79f640e416a7d28b4c3fd9bb820ccdb56e0cd8628dbf79315ec0c8a8c06dcbe54b1d4d8a78a7a55ac4f
SSDEEP 48:92wBEIaS5an+vy7KEu+njtZyShab7PcYnxUsanwDHHmtu9lMAajKEcPnxURtganh:qS5y+x+njzyEedhymHqd6SWydJHwQOkb
TLSH
T11734A83435FA1118E1F3EFB16DF4B7E58EAAF677A921524E5981020E4901E90FD21B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  form_c.docx.lnk
- Size 72KB
- SHA256 76951b19b300a78e26d5b5f592f69ebacdf651bce90beedbf3c4d570a38ef5f3
- MD5 d0b7bbf4f54181f2cb7ead3bbcdaccb1
- SHA1 c0531fa22685a73d1633d54bf43a6360d2196819
- SHA512 4a8421c554ae747cc937130b265a1a4d0d7d306a025007566a3460329368bb8eb1db1e1bd35465e94c0580224322a7b01f41ba6fc2311ddc674b5e545e57f094
- SSDEEP 24:8d/B2xYnHRUPFyaWInZU8lvsx1WOHmnTZzs+m9lMAMI:8lcYnxUsanwDHHmtu9lMA
- TLSH
  T19773663075F91118E2F3EFB16DB4B6E58DAAF673697102195981030E4900E50FD61B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  summ.xlsx.lnk
- Size 7KB
- SHA256 4edcd00619a5aacb8ca112934d2dcb779a5ac407695de2613db8f11d4ad9b26f
- MD5 f05fbf7d7afbe33fc2c09d7e0b1298a0
- SHA1 a08a5d58bc3d5c62626010679ace16dcc9185b64
- SHA512 08f1ae5529a57aed05d09f10454aed6738bb287bf987762b1ca658a1d6ed8ab4d66272b5c2b15f07ab7cd68e27d7582cb59c192e91e83b26cfc203db3937cbe2
- SSDEEP 24:8d/B2xI8nHRURtRyaWInZU8lv+mp71WOHmnTZzs+m9l+R7Mzlx5:8lcPnxURtganKmpJHHmtu9l+R7uT5
- TLSH
  T144F18B317AE5221CE2F3FFB16DE4B7E98EAAF1736921521D5881030E5900E50FD2173A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral3 behavioral4
- Target
  works.xlsx.lnk
- Size 160KB
- SHA256 83d66b89646677986520631d6fa01e9d3a05106ae1e03797d4e62855a8b59b50
- MD5 70e2114f72b027766676edd9f8dc31af
- SHA1 557da217bfeaf30bf63cbf3c43a0df5e309ff144
- SHA512 2b3b62b5df55ba43e88d936f079b62be83c92bd3a8e5beae8c0d74da4032cb899803e436683b29b413acd50c2656fabf3e6eb750a4c052dfc80ddad040051924
- SSDEEP 24:8d/IIpWqOVPgyaWInZU8lvavSp+UOi+Eu+njVHqoySMW9:8lIaS5an+vy7KEu+njtZySh
- TLSH
  T19CF3DD3430F91159E0F3EE716DF4A3D1AEABF163A832168E898546090E01B80FD16B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral5 behavioral6