1849dd8e732e4e70410b48d598b7995f7af8d0935e4a85fe10928292daaaa41a

General

Target
Invitation_Aug.zip
Size 260KB
Sample260720-ph47ysb19s
SHA256 1849dd8e732e4e70410b48d598b7995f7af8d0935e4a85fe10928292daaaa41a
MD5 d6b2e1826c596ec94e96a2f5a4c80868
SHA1 c8165b39e83431daa32f57d73c0f6388fbbcdbef
SHA512 f3ee754433512695bddcfc59ac4fd74f274f34a22587b1a10b777764f49d38cfb6e6d219e64497687b71c5453d795117db5e62a85c5ebc09f621528e7f8f2a7e
SSDEEP 96:d2Sy1YcUbAfC0Z6gy+HURIhydy+njym08uQ:d2GcIAfC0ZGWbc+m08/
TLSH
T13C44ED3075E81159E6F3EF716CF47BC69EABF5736531129A5842030A4D02E80EE65B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  Programme.odt.lnk
- Size 39KB
- SHA256 fa9bcb604351eeb749313878d7ad16d9100a87953c2fa9c40ce0c2f02827473c
- MD5 d27aadd981f433726f5a35d1e615675a
- SHA1 ece2b3f647db78c1fff6952f37244c57cfbdc955
- SHA512 eee55fd3fad0346408bf37f501e8591d88b4aa8d07a8f507dbf8653db960ca2db4e4aa2d18b1ec6dcb9ee2b1adf8c096a45a1451afaa190ae3620ab8ff3e5d75
- SSDEEP 24:8d/pKTYChyaWInZU8lvxGO+i7DBEpmJL7rGvlxPlpYZ+MOMrk:8lsSanFX+gNE+L7C9bAfOj
- TLSH
  T18403AD2076F90159F1F3EF726DF876C68FABFA627131125A2442470A4E05E40E915B3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  form_c.docx.lnk
- Size 72KB
- SHA256 181db83be5c01390f031a7601476ff4fb54aa5d5f777694a0eb920b9e4393e79
- MD5 4b05c67020d8b5730925f493fb139305
- SHA1 00705103cb409ade10597e6c04032a1f4bac380a
- SHA512 5a4fc92ee90ba1f00bf6f9f07174ae4cfeb3b847e517c04ad6f46aaa0796b1c20c14e4202aab18ee598b6786aa898919db4c8ff408d7cf41ac6c5effa59cccba
- SSDEEP 24:8d/AfK0yNyaWInZU8lvxvCSp+UOi+Eu+njVHqoWqdwvM7Jew:8lAhanFvCy7KEu+njthW+aR
- TLSH
  T15873993035E81059E2F3EE71ADE476C5ACAFF177A96116AD4841020A0D12E80EE65B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral3 behavioral4
- Target
  invitation.rtf.lnk
- Size 147KB
- SHA256 4cb9291e6e32ca24e23e63da3fd994adc8199ec504778a699392dd362dd23a84
- MD5 21dd076ea04165cb501921d2b747b83d
- SHA1 8457c244f93d874f01983ab5439d5cf43798d1fb
- SHA512 dc91d1e5e79dd8f88e8a3bb22de84c98dcab2541a2533774d8657b30d3d06fb9a87cd727f7454c400c8806a0af816f1707b84c1a5cbfe6f69fc0123a6505a8a1
- SSDEEP 24:8d/TWq2aYKkRyaWInZU8lvxwz1WOHmnTZzs+m9liHKMhSn:8lT6ganF8HHmtu9liq
- TLSH
  T1EDE38A3079E81118E6F3FFB17CE876D69EABF6B36931525D9842030A8811E40ED55B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral5 behavioral6