General
- Target photov_095048111801.zip
- Size 1KB
- Sample260729-nvgrragb52
- SHA256 dfc8cd0674a378ded4d6de7feaed43f81d880b8ba6e13b3f9114ad4a052f56ed
- MD5 a7c07eb06caee53f38f9a8fad22c8f8c
- SHA1 2965f7686616ca64c445873d84305f9661fce845
- SHA512 3febed76d2143c29eaff3d5246a8e366e2d39962058522c1f5ccc8a12322f6f40263b69902f24ee1ef2a556b76a844e76fd40a2812629d8ace2433a363d26efc
- TLSH T15F21C8C0007FAF94C8629B367C162D349E96DD4D936EC3071FF471E49612ACADB02AC4
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
photov_095048111801.lnk
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
photov_095048111801.lnk
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
videoa_821127614631.lnk
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target photov_095048111801.lnk
- Size 2KB
- SHA256 f3fca476dc2c57292e610a0cdbef84431aaae0b4163c515780f7b9ea99912441
- MD5 52d12cd081484f8697f0abf278b7afd1
- SHA1 82e5d059f4d9341b3c8e4e540a9ea52dc94e7833
- SHA512 2d6140bd02bbbd5bb8ba7d205e0a75d4fdae807cb81f35c2ae681fe40bac7ffc4d3e30c4249d60be99eb3904954b7d6cd5068a421f63029ed1bfab354b6b450c
- TLSH T137519B295BE0121AF8F68E3AE9FEA142BC35BC15B116EC4D0454038C88B3A45A42773E
- MD5 SHA1 SHA512 TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target videoa_821127614631.mp4
- Size 1KB
- SHA256 10ad40ea5b930fa1c4ef14a9512d377054b8ccd7adca274278de9b29cab06d70
- MD5 a291c7c105bd8291c637150caa81ceec
- SHA1 8dd56cefab148ee8f729431fcfd47479788710bc
- SHA512 c491b7809f1d94620df7704fb0cd13e77aed24d8624e3f39e964741f5c6e97cc24571aca125e0cdd03365ca51c301502271cdf5441fd00ba99618e0aa718eddf
- TLSH T1DF312B2117DA8A05E6724D777C7CD14471B5F420BD07C7AC8280A4DAA1A6144E23AB27
- MD5 SHA1 SHA512 TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)