ce9b07f5da61b67dad3810a89b82de1ffba16fe0db5579a8cb43356c2eb9660c

Sharing

Copy URL Twitter E-mail

General

Target
mini_zepetto2026.zip
Size 1.8MB
Sample260728-w112ksba55
SHA256 ce9b07f5da61b67dad3810a89b82de1ffba16fe0db5579a8cb43356c2eb9660c
MD5 71b2a464a7630bf008e8072321cfcac7
SHA1 ba85348cb7dd9858b46d50a962dd7697775dd148
SHA512 2c45b2a01b7e69feb7ed09f0e856e28ba16ba15d35e85dd039e7c8f9e929afeb3c6eb43d437544c8c0528155b1cf3bacd3bd7c311f028a2ca91edf35994f3f97
SSDEEP 49152:I9/X/km0yctxWJKJfuShKZreBfvwqPeTkCJzpRBuIEbkst9QDGO6ya4qV38JdG:IFNEuK9jhmreBfoUelJhabVpOta8Jg
TLSH
T169953391EB8C8CE1CB8CBA31B8F9557401A886FD411E6E25146B2D7BD73A038662DCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  mini_zepetto2026/MINI_ZEPETTO_2026.exe
- Size 157KB
- SHA256 aced8d7da4dec26f92aa954f2e3627b4d895c95a69cb49c8a729880d364e33da
- MD5 d4714a71e910a4d4996f538079dc1ac7
- SHA1 a6695da175c97ff432eef0286380bb8bf700e671
- SHA512 a18919d184265efacf392ceb5940c7423b97dd0c36d15014e0c10d5125f57831b6a0d37382eaa3f6f9314df3cae06ed8c16c06bb6533ca892ecdb0f94234d6ea
- SSDEEP 3072:tjNXO4bQMaQQaOG69WuUKy5o29ItNNNCAlb/H:tZDrZP9um53I53d/H
- TLSH
  T110F35A2172D0C072E55710318AE9DBB64E7AB8720B62A5CBB7D90B7A1F243D1CB3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  mini_zepetto2026/WindowsSecurityLauncher.bat
- Size 4KB
- SHA256 94478c5d3638ae7a12bb018674456079c97aef8e57ff527e7799d6cdba6bdb99
- MD5 c978c43ff9c47da282e4c81573718996
- SHA1 e413c3d7b8d5f43394942fd263025d6d188aec79
- SHA512 eda2b41f2748d34ef355edcc04fb99ac1d21ac83936fcdfa14db040441e1fd141f52f0dc7f13d053823070d1e10a01c6f40b4669042bf1f63c939c77fe7c46a9
- SSDEEP 96:MjRbVggsxM1/HBFYhll0GDUenlXehW05uFkb:MT91/HMt7bYAsUkb
- TLSH
  T122819601382CB16B44B1DB42C9FFCB5FB768639B166A1A563076823837123C2637A4ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4
- Target
  mini_zepetto2026/msvcp100.dll
- Size 412KB
- SHA256 56c54bdb8729f9b837bf8853d085b636f8d7201c54dbcc41ee523beb4a98ed7b
- MD5 b29d3e56cace26a6424ed68fd4b20cde
- SHA1 01bab34e3feab2b9729db60a788fa52077c64c10
- SHA512 35f0d959c1ca516e6c937bbac3748a18babaa524873447f30a692bf402b1e72d02ec9ff2de4415921e84e14a42f78fecce2a51a2005a62e8dd4344ae0458f38d
- SSDEEP 12288:Fqb8zxr1aWPaHX7dGP5HrhUgiW6QR7t5qv3Ooc8UHkC2e7z:Fqb8Fpa6aHX7dGP5Ov3Ooc8UHkC2ef
- TLSH
  T1999428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  mini_zepetto2026/msvcp100d.dll
- Size 725KB
- SHA256 555eb31b526096c6f6a3b6ee768dad1c1ef5cb8f0165071673164d64e7063f61
- MD5 d9b66b1509639cc71ddc703225c65823
- SHA1 143d65a3f90c19ea57fd902f35c4d5ca87db2c1f
- SHA512 623c60b12e5ba64d6f507766c273989d2c01aacfc5764e597cfcdb2e7c98d41359e107ff309418062ab1df78af764145a28d855637f3ebff51e8dce548cfe718
- SSDEEP 12288:C6NK3D/KRhB6y8C6y8I8cLzoyiM9z69Pw9Pj9PAJFxNZVBdplrLg55JFxNZVBdpe:C6NK3D/28cLC2ekwhyO5qa6v3Ooc8UHx
- TLSH
  T113F409216A024639DCEB72F41A9E633D56BCED80072161D392CDDAFE9F695D03E3214B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  mini_zepetto2026/msvcp90.dll
- Size 557KB
- SHA256 e659b93355b13e5614fc0bb1aef491443ab9edde244f54731cdb43c84e7a3008
- MD5 5654ef3503b16999843c6fb3b4b8299e
- SHA1 2081a9bc7c1bb0db7926a77c99292ad800a6931c
- SHA512 fa894c066eb58042a7298ef42fd7c96e3fe88fc0888d12a98d9060cca0dcc7f5303db27c3748cffaeb0181a2f26ef887561d2403fda53857e9163990c974fe2a
- SSDEEP 12288:wxFE340h3e34GVZQACkI2YhUgiW6QR7t5183Ooc8SHkC2ezgAfG:wxh0h3e3vgz2A83Ooc8SHkC2ezgAfG
- TLSH
  T1FDC4C3233B474AF5E48273F422C9132297B9FC950720B3D392DBE2A55F993C95673A90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  mini_zepetto2026/msvcr100.dll
- Size 756KB
- SHA256 43a38c67b02af7ae73e26f4bec5e632cd0dec89a173f0b49648934fabf2f1425
- MD5 4de76ff332a3b6c515cf0b0d5fddb8a3
- SHA1 c36bae0c9f9df24aa4d28ba9951dc67d88cc1d2b
- SHA512 33e4d1cb853ccf353f9d5d8978d71c3a400b66e8d62b5f43ceb2160793d9c9613ab33e96d8df05a09d212c6d0a04c98827c40f8ff603167f3448599abf5dfbb8
- SSDEEP 12288:16cmCy3AeH1TNDSB9y95p/7JMp48w7Z1w9ebV+9V0iQbzRaIvCl0mR4sPAyXWwa:1TmCy3JVTYBk95pTJMp48w7Z1w9ebVGE
- TLSH
  T186F49E11B692C073C1B221300629D7B25D7BB9711035946BBBD58F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  mini_zepetto2026/msvcr100d.dll
- Size 1.4MB
- SHA256 80e8c0147f9960c8982092a4b43329835dc394036306bdd1a763bb59eb3d751b
- MD5 b245bf00ba8c1196dbf8c2bd5dec9f60
- SHA1 3090b2365ef1c3dbb378d309ee4b9aa811548e07
- SHA512 45b453c117fe3ae541eb9af0f8c7fff12dba4c83c95b6ab53027ba5650e44483738cbac34b2847b5830697c66d537dcbc54e76c0235ce7bfa3f9aacdfce685a3
- SSDEEP 24576:7m/wTbJniLOB8QyruNelIQrTLGA1IZxvW6q9yNxsjcLO++yR6lPUoLpmLy4fAh:718QyruNwrXGAujvn84qcOvv
- TLSH
  T1B1655B01A751C025F5FF10F86AAEB23C752D7AE0572420C793E566EE9A686F0BC3161F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  mini_zepetto2026/msvcr90.dll
- Size 640KB
- SHA256 ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185
- MD5 e7d91d008fe76423962b91c43c88e4eb
- SHA1 29268ef0cd220ad3c5e9812befd3f5759b27a266
- SHA512 c3d5da1631860c92decf4393d57d8bff0c7a80758c9b9678d291b449be536465bda7a4c917e77b58a82d1d7bfc1f4b3bee9216d531086659c40c41febcdcae92
- SSDEEP 12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
- TLSH
  T1F0D48D51B6E2C032C8E611B8569CEB725A7F64B0032468E3BBD50FEDC9647C0E63775A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Disables one or more Microsoft Defender components

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16