ffbd074c4ecaa13ab187a907419bf94a4d4d1a0146bd9e87cfcc73c09424e899

General

Target
17072026_0329_Arquivo.vbs.iso
Size 5.8MB
Sample260717-d1vkpadz8v
SHA256 ffbd074c4ecaa13ab187a907419bf94a4d4d1a0146bd9e87cfcc73c09424e899
MD5 1c26d05a0522921b305e734537befba1
SHA1 6eba985a293b674e377b60b915e9a4f39a186475
SHA512 5bade0e1ea001e21ebced8c7992ae5327b2bab14538de85fca0f7c6f7c6c697636326d23571e179e224982be1c43896a3622c4ed806f38429234eabf3c563121
SSDEEP 49152:G9p2kGHsy1crmmessncHiKyo78OCXzXAbGDqXFWUtNNGtKMVm/7V/wCVT8QC9eWP:bMCUheFnXXaA28VWJ8rlTkqGoeznjTI
TLSH
T1D75602892E4D43FAC117D873C54240BEEB7039D09731CADB65A9572C3E364E889E7A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Targets

- Target
  Arquivo.vbs
- Size 502KB
- SHA256 642e564d0635bcd2a6092e08877481a47c68f88c1bce3a6e6ebd445e04b8eb8e
- MD5 4a592c5810f35eb1c42f3a9afddd763b
- SHA1 521f5eca2adf1c8412efea987dcc5b39d7e03954
- SHA512 86122afabfcc5527daae7faf2d2ac290cecf200870103efad6d6df90eb9845f051cd52a64e6fc90f50546d4facb79bf0c1bca90c2a6e7497335ae5f5125c152e
- SSDEEP 6144:gWNnk7hoFXay91s67zSgYq2CYHtoOEXh9QNGYK3MbUDUaIvymbVxg+H+Yj1lpoIy:l+iDXh9r0V1jnc8m2kH
- TLSH
  T1E6B4298C7D8D175F9928EC93D20280FCEE792CD0DA55D2D19999AA3914B983ECDC1C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  PV67QA2U2Q7/c5e9932a.exe
- Size 1.2MB
- SHA256 075b6979127b40a791e78762e00515600261f39beb1417e5be8dc63cab699c65
- MD5 72f235eff68ae2b09bdc4c30bd892a15
- SHA1 defa6f68a0825b533fdcdb7891cbee4765b35d5d
- SHA512 e0f74e0df6a006c12d04dc74b7c97ff3bc1192e967e85ab4be3f3ea4bc3b048adb9d0bee02acb9771c003dc92bf5fd3369455d0422c7e9e5b5a40fd421672b62
- SSDEEP 24576:LiHP2fJ7dBYlRncrmmw5/9usnUVHioPypmu7A8OA0:GHsy1crmmessncHiKyo78O
- TLSH
  T16045AE56639943F9D06B8238C9034266FBB1B44403724AEF06E84B555F77AE89F7EF02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  PV67QA2U2Q7/newdev.dll
- Size 3.8MB
- SHA256 c8e450d83929eebedf0579d0cd366c050ebbae11f1914f0b32482d85ee4ef602
- MD5 fcf806281466a8a890808dc89b1f9ebd
- SHA1 4e7ea404609a8fd4623da30e8ee5eb5203800ffe
- SHA512 5fa54311b46a1f412191e04258094a8e4203bc38dcf4fd0e293f9d117ffbfe9727c317b16a040d2b753cc73da4c8b668cabdcda2f626059213dfe28832dd3d76
- SSDEEP 49152:OXzXAbGDqXFWUtNNGtKMVm/7V/wCVT8QC9eWE6UKUgzadOGoew+IannH+cwWTfgb:iXaA28VWJ8rlTkqGoeznjTI
- TLSH
  T1690611D2415AD2E69B8369F3CDC190A3076637F1BD766D89B1233AAC7D384F1608325E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6