5c373de6fc99818b7fd0220dba4b876121c264494d0e02f307a26bd700be2857

Sharing

Copy URL Twitter E-mail

General

Target
16072026_0254_Documents_Details-Documents_Details.lnk.zip
Size 2.5MB
Sample260716-deay6aby3m
SHA256 5c373de6fc99818b7fd0220dba4b876121c264494d0e02f307a26bd700be2857
MD5 4c64d98210c7fc53b91ffe8572db9187
SHA1 9e55851ea266ba40d9cdcafdd259a502e4846e14
SHA512 70c0258ce5360c472f2afaa41135b80ab846e379784fde78b11b1f3b7e888652db0acdfcd0d52458a203ac13d6554a1be720c0c912bc005d32acaa5c71715f53
SSDEEP 49152:u0Cj+gY3OaaCjKnNCdWW9bpHwH/n+yqzzW4sHxJh0zfetE0fjUkiidK5E/:+qPkzkbpH0v+hzz1s7hoc5ViidAE/
TLSH
T1A5C53343F1B3BE91F650EB9C7A60E7519550CBFA329DC18621EE27B03B498D28D41747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Documents_Details/Documents_Details.lnk
- Size 1KB
- SHA256 2486347f8ca545b8aae24a847ba32026b6d71380833f859fb42cc133dcbb85f3
- MD5 88d5d4c30c6732f9ddaa674621f8b3d4
- SHA1 2518c30182896a5a0b8cba689c66588ba508d064
- SHA512 bc575d01b8f13b352b3de9d6d8b6e1c876dba703f23f3dec260c53de9eca984a0b0d6f599f56ad223040045a21ed8dd4f8ed2b0a1ef7b8b42d20361c37c3bbdc
- TLSH
  T1AD112201422C9A11F6A14E3A812CCB197F7DBE8BAD1582840108341ECD71C30E3F08D2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  Documents_Details/`/Documents_Details.pdf
- Size 12KB
- SHA256 5ba5961b0675033b01b799e48ba29225405cd1bd1a293e7be1a69b085b76e87f
- MD5 a03448e92a0b14ff1703536c6f442ad8
- SHA1 cc4444f1e4b4334648d5f807165a560cf1d33f23
- SHA512 a0e27ce80f000559d40a62c5327c27f7d375aa01942d90cf56cbb2a4bbf5b04c64c229c3d693e82dc520d7236d3f402122b7c4ceee968af869fe3b6e9bf7894c
- SSDEEP 96:quT/tIBwI2D37Qr/PiNbpdwl6dh7YjqFv0zdAtg3FQDoEv2Fu1CUuJGMCWRE:q2CKIVHiNbLrCeczdA63FQs4iugZNi
- TLSH
  T19D42F73480EAD609F70082339B35B986C86CB1D36DD5B8DE717D47029F8192E73B4AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Documents_Details/`/config.bat
- Size 758B
- SHA256 56fd7481f26822645fe0298ab4a622983cb08e6507ce889f1ec43027d7ec1295
- MD5 7c79de9ca322d1e5a329d1cb59ba6696
- SHA1 a1b092c98bd3b6fbaa6b4f10fa20c2c863a1a323
- SHA512 b165aa74c69ed6d111f34a41ef76ccaaa56d5c82c571e5032db8f219a0d8357476a77b8723669000db65b011efa6fc7d259c53a07b3a14579fc66858470dbf2c
- TLSH
  T17201457F14870E692661DCC54B911882E69F85CF06175FE470D0898A9BA563692E09DC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral5 behavioral6
- Target
  Documents_Details/`/windowSysUpdates.txt
- Size 6.0MB
- SHA256 f774c87c3e1121f05062da9277af9ace7d54b4fccac41337baa5c7263980d7f2
- MD5 1d0a37a19233bc64d31f77697247e8f1
- SHA1 d0bb5a9c25b9cfa33300223d09a4b08bb77f5604
- SHA512 6ffb5ac5c5da5b106473e4f2b419e64fe320e26d03b4702e4de7fd643459b38d452fb3107edd94a0ba5f8c1b5b758c35c7bb90b0ccb72d4b4a993aad8944a237
- SSDEEP 49152:Wfj95Ft8NM0arZEiARRFwdWuqzO/VneI1/2sltCRL48gzzzQVfKiK9KvBVMA8URb:WRpEBiP/f1/jDgifabLMA1EW/
- TLSH
  T1C6564A07ECA545E9C0AAE23486679212BF717C485B3227D32B90F7382F76BD0AE75750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral7 behavioral8