General
- Target 18072026_0937_Vat.No.20260715231017.EXE.iso
- Size 6.7MB
- Sample260718-lll9rsft4m
- SHA256 146c37f3f478f9c320ea486e13be7d527c5574666a8dcec920ca7b3867f3b1de
- MD5 8a73380909331c3211c810daa730ccf0
- SHA1 f760df35ebfa57950b8a4d1543a613acd49ea968
- SHA512 f98b7ed3271f9f81779de477b4931832d469d464b1d5360d7ae6bbb87006157e53b87a4753fb5d62f271b6e2adf8235e2dec3f73d65df2273eb8058e9e232dc8
- SSDEEP 196608:6xYxZGxqNW6I7c7H56qkShrdaBWX7BUxSODUUZO:6SmxqNW6I7oRKcBUBZ
- TLSH T1F666C020BA914077C9771130495AA379B2BDB6302BB58587F390AF3C3E359C259396EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vat.No.20260715231017.exe
Resource
win10v2004-20260513-en
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
Vat.No.20260715231017.exe
Resource
win11ltsc2024-20260710-en
15 signatures
300 seconds
Behavioral task
behavioral3
Sample
pdfcOrE8.dll
Resource
win10v2004-20260513-en
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
pdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
3 signatures
300 seconds
Malware Config
Targets
-
- Target Vat.No.20260715231017.EXE
- Size 3.3MB
- SHA256 5dabdd4b418ca8b4034b5dea3684da0c10022ca5793c84439e4698e338e25db3
- MD5 13b01f46ec5078298548cdf8380f4c76
- SHA1 8b1af1ebc15b474dc6284f169f9ffdbe7e3cefb9
- SHA512 c64ee8e31261813e1f53a3e572c7759650e81cf36ac80c706da2cf7f6ad060ccb72b83820a7df51637c5248dbd2e5134940fc23ca80c37fe63d68318d63ed60a
- SSDEEP 98304:4xJgBc/Esdil3UQwcvEPiXZqkZMYy16I7Pk7H56s5Qz/S2:4xYxZGxqNW6I7c7H56qkS2
- TLSH T1B2F59E20BAD24076C173113159AAA3797379FA303B3586C7A6913F7D3E302D25D396AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
- Target pdfcOrE8.dlL
- Size 3.4MB
- SHA256 7c1ab2209ed95a0a98fb5c23e007b3bf3e8a7e7f8424a5cf5ff3331dac6ae4d7
- MD5 c056b0db5b3c2c7c7b1a3f7e71fa0e3a
- SHA1 83d6eba7a7f6cf5386be61a1aa67ccbb5d2a3198
- SHA512 52b4ca35f8575b866e7035a7a39d33d1becc2ada34864012482fc9d03c5502ef4ed75166c339344f8e412c699ed279ac5c6ea93656d0f06766f2036ab225bcd2
- SSDEEP 98304:Ojrm+RpaivYWX78aMXa3UxSODUUZn98L48lhnjk:srdaBWX7BUxSODUUZO
- TLSH T133F5C031B998007BDD6B12705A0BB3ADF1FD727819F58863F294C62C2D7AC8285195EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.