General
- Target Notice from Tax Departmen.img
- Size 1.2MB
- Sample260729-s2w78sag44
- SHA256 69a0923cfc9bd24a01a6a6047c84d06778f04910647d52005a88b6c9da9df288
- MD5 04256a26ed8d6d5449cad8b5889dcb93
- SHA1 6e8ae0faef441213f97bdb267bbe0bdbbe31ac30
- SHA512 65b467b3cf266b2fa7565225ddab67b84faa6b8feba6695d264458852f6d568cd0504aa38a2321d858b7a42b72c9ec12a0b92261adc930c863cdb4094514a354
- SSDEEP 3072:sAkO5yda3QQiTkP7f1w7BDi2Kwekrr1+zQO0uKFBHUr76ot9MZ8usIlc+qr3rYnE:XkitT1w7BDiFbkv0df48NIPo3rYnByJ
- TLSH T1FF458C4673A40CB9EDB7823CC9938A06D7B2BC160760E6DF13A8475A5F2B7D0953E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026 Statement of Account.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026 Statement of Account.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
winhttp.dll
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
winhttp.dll
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026 Statement of Account.exe
- Size 25KB
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target winhttp.dll
- Size 259KB
- SHA256 9be874621f2d3124feb1b8a50e8c032b064fad52466eaa8af52fd767076f2139
- MD5 c1698e660fda179f415cf10492041250
- SHA1 8dd82eef50ee91ab8e97999dfd476434805a6267
- SHA512 129e5b210106ccbda0d615871b4d3973059d16b8c34449ca4fef7d38774dbaeef7c03e8b36f6c42f4067360167da43f6c4ebffc2bd787fcba81c66ce07a8a3c6
- SSDEEP 3072:gda3QQiTkP7f1w7BDi2Kwekrr1+zQO0uKFBHUr76ot9MZ8usIlc+qr3rYnByJ:ftT1w7BDiFbkv0df48NIPo3rYnByJ
- TLSH T14B447B5977A40CB9E9B7823CC9538A06D7F2BC1607A0E6DF03A0475A9F2B7D0953E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE