3c9f880e1c75b7e0e05c0741f9f8fa94659086fafd836197ff499c2d94527636

General

Target
19072026_0305_check_3231.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk.zip
Size 4KB
Sample260719-dlaa7sdt2s
SHA256 3c9f880e1c75b7e0e05c0741f9f8fa94659086fafd836197ff499c2d94527636
MD5 96cac386f06eb5e60f209ba62b228424
SHA1 9f48d039eb87e126677a9a50f2afed530dcc025c
SHA512 834036ad73f445f223c5098d6d0d7a42d46c490b41c5f058882a5987e32a2007c385784b0e9b951aadacdefb86e96b4ca6ca043b5c9819a0d09f98b17bf5bfd1
SSDEEP 96:iMNcHisq1Z4kaT1J02OQ0eBrv879lDnwWepLdUhTT:WiRZ4vRfDBrvo9lDnvOZ8T
TLSH
T16791E721018FFA69C099B17CA28EE207AD58509EBE984A2F17F430E9E55F43975C7043
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  check_3231.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 37KB
- SHA256 03f3bcc03ead312d3d1fce3793281d1aea49b74f7b2fb8185254e2223f32747b
- MD5 edd11502d256685681ce1c689c4a25d5
- SHA1 d150845508e8606a774e0be230535ee853e88418
- SHA512 3a783b1f1a603ac0ba3c5f9355376c620cafcab845b426bbe479b517cffb192cc59d3e070aa1e51e51b24449f93165fd7af44ea1eb87d0e361a81b1bf4453308
- SSDEEP 24:8yQxRfgCb9Ki9dWGlA0FWu53FlEDil9CGALJHgM7JR7ZFNKPEtz4I0w4L4I0CWvc:8bn39wGOu53QE9CGGJHgS01I9IBF7
- TLSH
  T10803AC3ECAFA021EC6B7C639E47A9200A523341B763CEE8D51CD67494B17501F5A9B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  mem.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 6KB
- SHA256 2def77b0d16434c2c1ae5633296ad65afdb08ab3c2752a6a48c463e15b8b14d5
- MD5 c17e3c02ed71b9f07ce31c719a4daf65
- SHA1 076600e9c2e67308d0409767f4408e8f837f7cde
- SHA512 8846efe5da713ee3fcdcdcb547baa61a6ebd7cad898461e2eb827c9296a369944279b08bd6dfe24b5ce7e05e7596295031a96d25c099c99f69f91ba6d30792eb
- SSDEEP 24:8ixRfctCb9Ki9dWGlA0FWu53Fl1il9CGALJHgM7JR7ZFNKPEtz4I0w4L4I0CWvRK:8in0A9wGOu53tE9CGGJHgS01I9IBF7
- TLSH
  T15ED18A3ECABA021EC6B7C639E47A9200A523341B763CEE8951CC67494B17101F5A9B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  s112.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 5KB
- SHA256 c92f864db446eea4e27fb0d58a3e37f66e2929cf8effc7de786348a558ebce8e
- MD5 a2630541a2c87006679fd53276003d2a
- SHA1 0fbb0787b94013e075480b75bfb587767cae94cc
- SHA512 330dc011a1d3b368da2a754d889336218fb23d84b7b16964b866eb9a70981ae8c920f10767ae2e8837813d9fb5a949cdaeb8da70f904d5646163518c90901019
- SSDEEP 24:8bxRfctCb9Ki9dWGlA0FWu53FlEDil9CGALJHgM7JR7ZFNKPEtz4I0w4L4I0CWvc:8bn0A9wGOu53QE9CGGJHgS01I9IBF7
- TLSH
  T12AC18A3ECABA021EC6B7C639E87A9200A523341B763CEE8D51CD67454B17101F5A9B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6