53b2d24c9aefe01a768f6e2c637ab9fd56dcede852925cec18eccae58dfecec7

General

Target
YZi Labs - Audit Confirmation Form - June 30 2026.docx.scpt
Size 131KB
Sample260721-afas1abs71
SHA256 53b2d24c9aefe01a768f6e2c637ab9fd56dcede852925cec18eccae58dfecec7
MD5 0c56a75870a47a01374c6a2884c8d643
SHA1 a8c4c376a2125e2507ab5dfeae6f299f0a6234ad
SHA512 999abdf458782ac4ea1e376bb173e187800151a3d7bd4462850494c886afba44157cde4f055fb6e050db07d8709d353fd72899f35d58c5b803f3082a41fb9fa4
SSDEEP 1536:2m+f2ClM3spCuyOp6EBS8JSsEi2apEL72fv3eVuIn6KoFccMsTxk:wVV8LOpo8JSsX2xL723e1o2sTxk
TLSH
T1C6D34CAA23E13628ED57B8F5C2CBDB7173B360145FAB48056AC68FF9424C471DBD6224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  YZi Labs - Audit Confirmation Form - June 30 2026.docx.scpt
- Size 131KB
- SHA256 53b2d24c9aefe01a768f6e2c637ab9fd56dcede852925cec18eccae58dfecec7
- MD5 0c56a75870a47a01374c6a2884c8d643
- SHA1 a8c4c376a2125e2507ab5dfeae6f299f0a6234ad
- SHA512 999abdf458782ac4ea1e376bb173e187800151a3d7bd4462850494c886afba44157cde4f055fb6e050db07d8709d353fd72899f35d58c5b803f3082a41fb9fa4
- SSDEEP 1536:2m+f2ClM3spCuyOp6EBS8JSsEi2apEL72fv3eVuIn6KoFccMsTxk:wVV8LOpo8JSsX2xL723e1o2sTxk
- TLSH
  T1C6D34CAA23E13628ED57B8F5C2CBDB7173B360145FAB48056AC68FF9424C471DBD6224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution exfiltration
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- File Permission
  Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
  defense_evasion
- Queries the hardware information (I/O Kit registry).
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
- File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
  defense_evasion
behavioral1