General
- Target 15072026_0347_Tin_buồn_PGĐ_Công_ty.tar
- Size 7.4MB
- Sample260715-eck7saa14k
- SHA256 554b67ea1a9377ce2e41caa1ff2f42d05f2cd994b25953a499a1c12c234f9961
- MD5 1f57c5e0ba08cb541decd25931e58620
- SHA1 06d464e76349e781ef8413937b47ba3640f04fc7
- SHA512 8db14ddee5f39c028aa5176031eee519c75a574fdb99deacd660a62df42cfb869c8e2bb7529c1cf8b8b8f28ff5ef26ca841e1731b35ef97fb8750e6ba3ee3f77
- SSDEEP 98304:sfkfDu3M/Gxd2GwI8/AnVBmwka9tDAj0nHFFLOAkGkzdnEVomFHKnP8Y+Iym2sx3:sGyzxd2191RgdFLOyomFHKnPysJ
- TLSH T16876E4D2E86F42D3E8520633C5BC6B6CD31D6D38BE910067F14B3E15A63E64939AC52B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IFIR-7R-I2R8/FoxitUpdater.exe
Resource
win10v2004-20260513-en
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
IFIR-7R-I2R8/FoxitUpdater.exe
Resource
win11ltsc2024-20260709-en
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
IFIR-7R-I2R8/plugins/phc.dll
Resource
win10v2004-20260513-en
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
IFIR-7R-I2R8/plugins/phc.dll
Resource
win11ltsc2024-20260709-en
2 signatures
300 seconds
Malware Config
Targets
-
- Target IFIR-7R-I2R8/FoxitUpdater.exe
- Size 6.9MB
- SHA256 ae4acd809fd4f9fc45a83ffba51a2a6f4cdf0aacf684365c89486c3a4af6406d
- MD5 254286036e30c08244a90443a677cc97
- SHA1 82ff66fd9ebef4a473aa67307542f23ac0d2796c
- SHA512 34d537d9745b58b59bd16858ca0d9e398e0aa00aede0f1c9e1ac896d15cf8a9977baedce9cf155748df1f2c4101b24a29873a5925bc3f5a4850876716e5b4383
- SSDEEP 98304:9fkfDu3M/Gxd2GwI8/AnVBmwka9tDAj0nHFFLOAkGkzdnEVomFHKnPz:9Gyzxd2191RgdFLOyomFHKnPz
- TLSH T18E76C2D2E96F02D3E8620633C5BC6B6CD31D6D38BE910097F14B3E15A63E64939AC527
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target IFIR-7R-I2R8/plugins/phc.dll
- Size 137KB
- SHA256 e7ace5d6ebdc19b88800ad890619241e2341012f6c065618274f263b1752e5c2
- MD5 63b6282b7928609529f225c951e59637
- SHA1 7362a8d38bf15d8eb3db42b7ddbf3325da6cf2e2
- SHA512 1010fc574df06283cb017fc6655bfb56e19835e21cfc4db9bb604ca3d04fb5713d71e3a9ca10e4516adb78250335fcf2fdde42335ae8da57f2d00174d112f001
- SSDEEP 3072:JAACV/zYUN+G1kSZKAOM49k4EigmTyQLns1:JG7N+kZKAn4kwR
- TLSH T1A0D35C07B4E1EC61C16D133C1560A7B16BFE7635DA2129772AC40A799B342F08E97B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1