General
- Target 18072026_0932_MigracaoMTLS-Opera360-Migracao-mTLS-SEC-2026-0047.pdf.lnk.zip
- Size 3KB
- Sample260718-lhp69afs8m
- SHA256 44b455ec4213a9764560d706fb2b84259ea93dde35d73c946f811fbc0d1d6858
- MD5 9482fa2255de7889b7b7dcd63a2f0b62
- SHA1 ce965e0dfdcf7daf4f78f2bf15a352139f46e5ae
- SHA512 e2551056d42bb7d95c5a1647f1ca1c4a91b905a741fc65edca0d9cb8fe4a2dd47e6f185dc2b1f354d9656697781972fd7c7f11eba319a84efcedfe65a98b2140
- TLSH T1C0613CB9EDCA580AFD2ECA35023D4E2D5901AA048D16098A059F4701F67D4D7BB79CF5
- MD5 SHA1 SHA512 TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MigracaoMTLS/Opera360-Migracao-mTLS-SEC-2026-0047.pdf.lnk
Resource
win10v2004-20260513-en
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
MigracaoMTLS/Opera360-Migracao-mTLS-SEC-2026-0047.pdf.lnk
Resource
win11ltsc2024-20260709-en
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
MigracaoMTLS/p.dll
Resource
win10v2004-20260513-en
5 signatures
300 seconds
Malware Config
Extracted
Family
-
adaptixc2
C2
-
events.cacheedge.net
Attributes
-
port
443
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100123 Firefox/119.0
Targets
-
- Target MigracaoMTLS/Opera360-Migracao-mTLS-SEC-2026-0047.pdf.lnk
- Size 1KB
- SHA256 fadcac60cff1511379bb9acfa73eaab1d4fb3c4cbbafef3dd5e370b3da8485c6
- MD5 ae94a3d3ed2cd6f7c0becc6dd81c7e9b
- SHA1 06813bd1e56b72640254be72a945a6c588911b6c
- SHA512 ed952359b06bce89f5c91c31e835ba9b81b99c71562955bc33100d1d9e2e6cc5bed50edf2d2dd651d0bb205490458a371d77357467b8e54e252de1b53ed999c7
- TLSH T16231CB062BD11B69F3A29F72287A7B24923BBC19DA4A9B1C048045402852724F539FB7
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
- Target MigracaoMTLS/p.dll
- Size 6KB
- SHA256 c014fb655e7d6b5e7ca3d9a0f24259ee85cdcd5c83fa1c87d162bc1d9b6d3dd6
- MD5 ee56f5f8332ec7f13d98b90f93d8453f
- SHA1 e93367abc9ebd054e66a029ddd853d3886d205fe
- SHA512 ae97d43ad2236c2aebc5a16919c6d1432485abcf8c6d52863fa26327edcc9d40b6d9953fbf21b6c46953ee854c1b6938d2af415a54e27b669cdb8b67179e34ec
- SSDEEP 96:aOCJsi4lnYgZw9Gfco8bjnVTWCakKDk5IK:TCJaYg+Oco8bjnVThakP
- TLSH T126C15227F703529CE4359234C27A867AF4BAB0A45777366F2FA0E9363C59472F52C604
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Executes dropped EXE