01f62fd677ca1c6700d6969a1eb05863e4e178c811568045e026097165119725

Sharing

Copy URL Twitter E-mail

General

Target
0NotRKYRX_M329_61713ibgfi.zip
Size 4.1MB
Sample260729-l68cqsttb1
SHA256 01f62fd677ca1c6700d6969a1eb05863e4e178c811568045e026097165119725
MD5 19b99b9368552bf3b4ac816c19a3fa88
SHA1 5eaa344eca5bb1238f4e23fa0208358b2a16bf49
SHA512 2f5abf9a236989c0d9bffc1706f443c3f81685d31ed921c916a5a603f5aec53ae4e49b4e646952be2bdb26333cbf8abfeacdebba1c9389a34312d6a778ddae01
SSDEEP 98304:rlIiUtGO7DtTsWCjq9nbiYTFClknpxqKKkWsaqgDDsfZYttQPCX:r3gJpTsWVdzYM1crDsfZQtQ6X
TLSH
T198163347D04F3685D45CB0338EB695E8061C6392A2C7FB366556FF44F82CA993F8A9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _050LT70Fiscal-nqfanRGXZM_13924Runglhx.vbs
- Size 4.7MB
- SHA256 868b21543f6ac16be2bd39565554262755c642606b344d9f8fcd419f3dcea208
- MD5 61d2ff2946025558701bb4845cff5780
- SHA1 ebb8a178454c26b6b70c1c9c41a6c06797fa8339
- SHA512 66abbfedf11ccbbe6bf364f12b24c1c9bea331ff8db372d31a9af161b76eb4e26ecf05260b380261975d36bb94bffdd1ad955ed28c160fb0902cf7920328b19a
- SSDEEP 49152:jNw5qekbwExgEMBbuDftnlBLnzomtpTM7KPhBl4u23ft5MoAHYT+8cn16y7+Kuvr:ir
- TLSH
  T172362332AAA6191B09B1473EF01F7A327F659813C74DC2E4CC9CD12735DBA58C5BE4A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/aaas/mknum/bfare/eoknyb/bskh4.pdf
- Size 26KB
- SHA256 58be248df7bc4790819e8fea310abbc4cb03eb82f8bc67902529877b7ec6a608
- MD5 a43faa0483238c938c951f7981a78641
- SHA1 4b5a2cc6aaf9a4245c03711928aea3203389993a
- SHA512 0a64d4c4cacf4ab436886848b021587a3df0e268301865fe67362bde62e02981faf562c814b83c7905e11b01d904d40c771bea9da58360034d41133bce42f69f
- SSDEEP 768:oXCqzeMYefHBMp0uWdvMqKzCQ4Gmsq+Tl4qKIA4pZ:GzeMeWdvMNCymspJM4n
- TLSH
  T1A4C2BF6D5007D8218B0752E7FF4DBA95299AF30F21D85AA12E1C6CD25643FEAF20E0C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ~/aaas/mknum/bfare/eoknyb/gqxpo7.pdf
- Size 33KB
- SHA256 4ab1af4220117ec5fe388e5c8f65823fd4f7904a8179bf4bef78bb23cedf4f60
- MD5 fe9ca7477713e102ac7f253a2f393bf2
- SHA1 9e3feef4365d4c6c6f5c2a3ccaa4c089d22b03ea
- SHA512 a4f2e0bdd39012f0c50eed662e4fd3efa82f879a0061a664213a4e08c558e56d32c8ab0195b2e99081422b593b009dbe4f0866b8e990d0108dee6eaef3c8913e
- SSDEEP 384:8gIYcTFi9xx03wj/hSlBaDEX0GJWl127wwc35fHEccWLcy5hRxoN8yT2zk+M+cIR:8gBcTyswVuUYD7wN35sbKtSKP4+vczc
- TLSH
  T117E2B0B3F5F6188CEC86874649593CD9089DF127C6C83C9B20B887C66590F6DB6225EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/aaas/mknum/bfare/eoknyb/imlc5.pdf
- Size 30KB
- SHA256 9ba427a0b084faf1fbd3457a478e64d400d7985034cf974e297f24443dea12db
- MD5 9cc137a0d27f81745776c5876115455a
- SHA1 b99551089985a0d51e524b2504c41c6c8f574fa6
- SHA512 5e523d4be126883b2bd7ec49d76d775a4c0e80df346680c7f98871c64f76c69105d9d7bda2a84f8e8fb96433db8bdff66ce413af96aa2774c5a9f70af58ddb52
- SSDEEP 384:EHkowqOxtmrCvxdn0bWzcOPXaqdkJRNs4v2NNGmuGkvJ9dmUWMNv5itbFoIdcV8x:bqOBr/cRq2hiNkGwJY
- TLSH
  T1E8D2830DF241FA90D45187E55F387639657F732868CA5B904DA2C72BEA019EB3B7CC82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/aaas/mknum/bfare/eoknyb/iraxf2.pdf
- Size 38KB
- SHA256 fb83dc5c94b5356bbf08a5c3dc9efa6d8812b270132151368d4889f4d926e6da
- MD5 617d685270333d15dc6396c6fbc137af
- SHA1 83284779920af6efdfc446c93cd311c2e61c38f0
- SHA512 5e0fb70babc5bd019665e61bb09dc33a56bea963703ed8d94568b89b2cbb1f7ab28a51954dac4ec263ac89f4023e3c55cfbed488147eb7e9c36f5cc57ea363f9
- SSDEEP 768:L6IlCJijP4KMByHhpNEOcpzI0iZGIqwFxMO1DdUD3mxDYvz4VdmfiIvftKu//31v:L6IygwK9BpNOzrGMmxDMz4V2vfvPFuQl
- TLSH
  T13403E1B06231B809EAD7675DBFA13D49458E3A42CDD128C3D8618AFF7574AD39862EC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ~/aaas/mknum/bfare/eoknyb/miurlt8.pdf
- Size 1KB
- SHA256 a13380c87f31b47c1b292d0a942ac548412798bbe80ca9bb0c3ecc27c2cf2b44
- MD5 3a29b8f490b3bc6a9f1023f0eed12d55
- SHA1 ad32c4a3b97ab417222b3e2f9877d25d3c3ed058
- SHA512 5869f38c5c413e872bd7e1bd84487a176711ae33a2e553eff7121386026f07f35fe00b3b9b5206360b8dfe1cad8ef861de585df3118770d39ae3b939201d8e5c
- TLSH
  T173310E2495CC4CDCF1A686C1BF2F7886A47AB00352E8A8C111BCC64FC18AFD5AC53B17
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/aaas/mknum/bfare/eoknyb/mztnhg9.pdf
- Size 38KB
- SHA256 be9ac4f967b61996af449b3d357d50540cbbdcce344e2285a2f012c82a65b426
- MD5 3d7cc8472aca79e87a1565d6af8c3064
- SHA1 cd103293b31dfcd6c940a2e85ac318e4b6880abb
- SHA512 e63da1e98f2eb97d8c75679b56a8449e20afefd8524ada4cfffd9654899a10ca326f28decd88ac03157b309bf30b9cbd372d7a47bb7253f91dc4c21982dba8ac
- SSDEEP 768:L6IlCJijP4KMByHhpeexKSiFz57joopzwWXC9p+vMMlG5q2:L6IygwK9BpeexKSuz1BFwWy+vK
- TLSH
  T1D403E1B15EBF7D0DED8199406F35388445CEB1C2C4E4ADCBC1A84A893478AD9DA27EC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/aaas/mknum/bfare/eoknyb/nzleuk10.pdf
- Size 66KB
- SHA256 936d01473a6c7f311e785caa002eb3ae7ad762209b75ccfbcb48d93bf3d3a3db
- MD5 64071ca7bad7e1347c14b86c820b69c9
- SHA1 dcfc9411e189c16f9c62af3453d156a6b35b3934
- SHA512 6220a8dc812c46115da42408854655bcc0d7096233bdc0427c2876a4e2b6c746dd4a774d70505d5520a6248f4c632effa95b18c611889c98a604a180c6944d06
- SSDEEP 1536:eyUqg6i8nMs7vDTyqQTplW7JAyTFOw/9+/xgVF0pn8XeHKS7H:j+Ls8lWNd/wxqmpnLHLT
- TLSH
  T14263F1507E2DFB70D194DBF90BA62D53A65E386706DCBB82056C800BAA11F4DB489B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/aaas/mknum/bfare/eoknyb/oafubo6.pdf
- Size 30KB
- SHA256 17c3619e5f7357ce3dde625156f3a1018b8076a0a7ec2223f063e833a9a06bed
- MD5 1376e75b3d960aea30d72df71a5bbf3d
- SHA1 c3b70e06215bfb413def286c2463601b008a667f
- SHA512 3d42c78ca2d23d2dabca98624acbf0473b96b94dc0a666deae35e1ec63853e14cad29ead764a6ae49fea2c39b98104adf434294043d27a54a59a2562d5619dc4
- SSDEEP 384:DukPnfI16U+DX0aK3pTNqXFujccZKV+KEfNGmuGkvJ9m2Eto/emalUSAOMbWrKXI:9GpAuQWO6NkGwJW
- TLSH
  T1CCE2820CF245BA90D46147E56F387639657F732868CA5B905DA3C32BEA018EB3B7DC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/aaas/mknum/bfare/eoknyb/ofhiac3.pdf
- Size 25KB
- SHA256 d8a939595c8105ece6189b480d96a6884e9790fc93980c385d666da57f372d88
- MD5 eea518aed26f9f80d92dd6849b3bc8eb
- SHA1 ed41fd87b9b173d7729878e280479807cef5417b
- SHA512 c93b98f08aaf2bac86f9b57ace0bea267bfaa0d23874773e0b7087838ff179e246f331aa5847828142ce26e5e22e192cc72a464df6caf30ed50e8d9aaa129e17
- SSDEEP 768:M57rOIaJhtyGeMmH6PqrDcUFsw3q7f0vtO3iqKIA+h3:M5nO5JSG8Rr4UD3qne+Z
- TLSH
  T1BAC29E4A2547C550EB0742DAFB2FBDA7A149B30F2268C8811D6D9DA21A57FE4F20D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/aaas/mknum/bfare/eoknyb/rvxlb1.pdf
- Size 39KB
- SHA256 73726d7f5301598917ab705633057591a5d2b8c9c90f39e1f6780a0181799d75
- MD5 7b2f356183858911dbe9f2b3984b8555
- SHA1 c17b5b3517035897765349bc76e89e378dd89416
- SHA512 3a5370dcc2b4deb4f0c08c4b3617b746562871033f58b9ceb68243981e284529105dbb0a562592589fa57a88c0d901a46874441a82fb385e1831bcf14ff0f7af
- SSDEEP 768:L6IlCJijP4KMByHhpOkoEMQXZRB9zt9HSTg7PXGuUFCI3HwXv8:L6IygwK9BpOk17RBNHSTIGroI3HC0
- TLSH
  T18203E170E879F906F092AEC14F39381D86FEBFD2C9C870E2D9900D45B4315E65897DA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/ulpa2.xml
- Size 20KB
- SHA256 39768457bbeb5af3d537b8311c73e2d5dffc4a6e9a29ab5077341a951f2468d1
- MD5 1d93a7ab93e4b1e7233e77523fcc676d
- SHA1 a0b3c36c6df20ea5c705669756887c3eb74f757d
- SHA512 3b0a9564639a0c796ee6ae382d851da7fdec444c7203dd9155ed4773620ba1724106c679a29e9e4c47d739f627879c6b01d1c667d2e7de4526d226cd8fc1d80d
- SSDEEP 384:qkqM+ObiQVns8VBSIRw/eDX9OUOZ2OPVIdvYuYJL+mcXfeMQ:qkqM+uELKX9OUOZ2Od+g3LJp
- TLSH
  T164924997BB048072E9CD4A7450B7D23B487977411FC120E3B7E80A5E5EA87E22B74A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  ~/yiqzk1.xml
- Size 30KB
- SHA256 e72633c7d99c0708a734ea513d9495d5cc639ae3e88fdaf364c18a8e4374c833
- MD5 41adc6645dd3e43d09017908d2b0cd54
- SHA1 6acd8076c19bb3eaee9b98255129e10ddd1f5c55
- SHA512 9d60b65b9505d92d1a683d95047da81858aded7a72a9bd23d7c8871b0ff02aadb061d3b8b09b4661224f7172298594e3db57ddc4aa0e53601f370fca1a98738e
- SSDEEP 384:ShXCU4AGUBOn4Q9yN8xKQ9QS1bMtO6yX00SpxSyaOyDwywCOMQYYJL+mcXfeM39:OCUbGBv9ymKLSetOnHAaOyUlMyLJm9
- TLSH
  T1DEE26B132AD1C571C69E0A7058C7932BD5FB34212EE1152B7FE943DE0EA83BB5A28717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  ~/cveyd/fpjox/rmkr/okzbtg/blvmv2.pdf
- Size 44KB
- SHA256 6c0fbfd95c9b63dbacf600975cb9f86b0a4ab183fb5bc6700d35454ac2ccdc80
- MD5 6870b47197786a7be8b0b708f6bc3055
- SHA1 1b6e199143d7989784d47849e66693f8b89d5355
- SHA512 f2105a6dc4e3751143c53f7c1c02f717a18a5e58bfa2d9209475499cfe18bad1d6476d5561a1a3962d97fd78b95ca07f459c7a4f7cbd40274fccffec63c27ca6
- SSDEEP 768:hZemSR3+/U+C4e0UegG0IvyBpyyLSTtuWM5p1V0MoE0QPIfgs:PSV+cfeY/y8SIWI2MoE7Ls
- TLSH
  T14D2318578D088E879448C3B87F172DAD2B2D670DADC57AFE00220ECB7F955651C9A12F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  ~/cveyd/fpjox/rmkr/okzbtg/ehpb10.pdf
- Size 49KB
- SHA256 ace65c04b93f347eaaf1a4e55ad433469f368fb64167cf746a0b59b37cdebfb5
- MD5 4b7ac35ee524c5c17db8bce1aae713cd
- SHA1 a8a57cc11ecc44b4c76a6147ef3105c57fa6812c
- SHA512 df9dd26a197074dd935dcf5949be5cd7c54b744b10d0b67d7b136a1e74cdbc9b2fcd1a93636ed67c5c24c9a7f2f054f77e93f13a71f1320869c8b616843b1d26
- SSDEEP 768:VbBW8qkZ1DtGhQdG1gELYWhYGls6igH1U9cdn0bZ9lmjpCx4F+QNggATt:dDR1BGiwjIGls6i01ScdmLrvQNggkt
- TLSH
  T16333E06E9F128FA7F1F113703F3975857979B50221EFB68C30389A4728A4E70549B35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  ~/cveyd/fpjox/rmkr/okzbtg/emnohs5.pdf
- Size 39KB
- SHA256 73726d7f5301598917ab705633057591a5d2b8c9c90f39e1f6780a0181799d75
- MD5 7b2f356183858911dbe9f2b3984b8555
- SHA1 c17b5b3517035897765349bc76e89e378dd89416
- SHA512 3a5370dcc2b4deb4f0c08c4b3617b746562871033f58b9ceb68243981e284529105dbb0a562592589fa57a88c0d901a46874441a82fb385e1831bcf14ff0f7af
- SSDEEP 768:L6IlCJijP4KMByHhpOkoEMQXZRB9zt9HSTg7PXGuUFCI3HwXv8:L6IygwK9BpOk17RBNHSTIGroI3HC0
- TLSH
  T18203E170E879F906F092AEC14F39381D86FEBFD2C9C870E2D9900D45B4315E65897DA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32