Extracted

• • Target
    #Archivo_file_mjtWBsbFUmtUIbZRdUpCdvs_30072026034637.hta
  • Size 12KB
  • SHA256 87f2552baff86893a70431dbb9c88f28c6b9abe5fb4a9408518f3bac58e76a41
  • MD5 7b9fdc93f7f64c2b1359d56e0c100f01
  • SHA1 6e7b4605a89d5c7cfa7288df0181d327e513f3f4
  • SHA512 0370a0355275015999aefd09d261fa48d2bbf03daad160cd6511ce028690b2120f4b99cedbcc893934906725923f137b5672d9d3e96b918c2c5b86be690ac27c
  • SSDEEP 384:AN1EoCRc+hmy8sRhOSFWVnI6oYFae7Xyd+45Dpclsqnv:QVPagO+45Dalsiv
  • TLSH
    T15A42163CD93EFA0AA2D4E702CD68F32FDCA5078FC51478DF12B69576248A2D245981D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionmispadupersistenceprivilege_escalationspywarestealer

  • Detects Mispadu

  • Family: Mispadu

    Mispadu is a stealer written in Delphi.

    stealermispadu

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2