Overview

overview

8

Static

static

5

ISKH_7565_...st.pdf

windows10-2004-x64

3

ISKH_7565_...st.pdf

windows11-ltsc_2024-x64

3

applenumbers.exe

windows10-2004-x64

1

applenumbers.exe

windows11-ltsc_2024-x64

1

bittorrent.exe

windows10-2004-x64

1

bittorrent.exe

windows11-ltsc_2024-x64

1

clion.exe

windows10-2004-x64

1

clion.exe

windows11-ltsc_2024-x64

1

libcrypto.dll

windows10-2004-x64

1

libcrypto.dll

windows11-ltsc_2024-x64

1

listPlanRatio.pub

windows10-2004-x64

3

listPlanRatio.pub

windows11-ltsc_2024-x64

3

ssh-shellhost.exe

windows10-2004-x64

1

ssh-shellhost.exe

windows11-ltsc_2024-x64

1

statusTime.ps1

windows10-2004-x64

3

statusTime.ps1

windows11-ltsc_2024-x64

3

unrealengine.exe

windows10-2004-x64

3

unrealengine.exe

windows11-ltsc_2024-x64

3

ISKH_7565_...��.lnk

windows10-2004-x64

8

ISKH_7565_...��.lnk

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    1ed821fcc96cd12b94a7d4ab486d718416164e0ef8b607821b02b34c38f02674.bin
  • Size 12.1MB
  • Sample260720-ygpkjsdv8r
  • SHA256 1ed821fcc96cd12b94a7d4ab486d718416164e0ef8b607821b02b34c38f02674
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpdfspyware

Malware Config

Targets

    • Target
      ISKH_7565_Naznachenie_doshnost.pdf
    • Size 167KB
    • SHA256 d01f7fbe0db4728d961a711cc988916bf997bca34bda06f681d98225963e0170
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral1behavioral2
    • Target
      applenumbers.exe
    • Size 16.9MB
    • SHA256 06845a04d2329ca39c8378cb83118f6ffd278805f5b229cb65c21c4ca989fd56
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      bittorrent.exe
    • Size 1.3MB
    • SHA256 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      clion.exe
    • Size 375KB
    • SHA256 a0eed0e1ef8fc4129f630e6f68c29c357c717df0fe352961e92e7f8c93e5371b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      libcrypto.dll
    • Size 1.8MB
    • SHA256 065d3a16b418dfe5647c56c8a1787ac540b13299bdf35f69e9980525804cb9ab
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      listPlanRatio.pub
    • Size 81B
    • SHA256 824e4fdb7b7cf25864a10445a1f051a570b7b8ecb285e6faf95736a006ad801f
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      ssh-shellhost.exe
    • Size 184KB
    • SHA256 feae0baf291ff54a1366f0cd628665d2b1c9fe279ce2544d4f84c7aa46064f3c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      statusTime
    • Size 6KB
    • SHA256 229a5f460dc556479bbf30f4c7665ba305dd4b380a2e89d27a6a1c5c8a6535ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      unrealengine.exe
    • Size 9.9MB
    • SHA256 f78d87ff967bbdebbc43c58c2b5376522d2bbc975c98727c75bf28e2eb23ffd0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral17behavioral18
    • Target
      ISKH_7565_Naznachenie_doshnost.‍pdf‌.lnk
    • Size 2KB
    • SHA256 0bb9f10f423d3bee7777969aaa83046b09982dee7818b0917849a3b9ff23ad12
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral19behavioral20

MITRE ATT&CK Enterprise v16

Tasks