7df4fbfa89346bf281ea80be05804f6c22cbbad1582f1e954890bb08580a66c0

General

Target
30072026_1329_Nakaz_MO_Perevirka_Mayna.docx.lnk.zip
Size 13KB
Sample260730-qrakdayeke
SHA256 7df4fbfa89346bf281ea80be05804f6c22cbbad1582f1e954890bb08580a66c0
MD5 b9d9b1c87f0554686d0731635243bb49
SHA1 c8d51e136234e44f9829761b2515b0e50e2dd842
SHA512 22113672a0546396e1f732a0e1ca335e7d19692dc3f5b00f3689cc825d7717f07cdfb99d1b54206c36f0cc1d5076c3a1362693b2c2f9df6df87f321bf8a5df7a
SSDEEP 48:2P6HjInvsHHmtu9ls84ajkLP6HjlnvCbNE+L7C9bAN4d/Vo/snT:2C8EH68ljqCxdcUbANyLT
TLSH
T1D652E13436F90159E2F3EF766CF8AAC98E6BFBA3763501494496131A4800F50EE11B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  Nakaz_MO_Perevirka_Mayna.docx.lnk
- Size 6KB
- SHA256 4a40bfb730e94a1a95a45e424581e808eff65d5e93750cf4844782a52d2561fc
- MD5 af861d850584c3c2b964a064846ffcfc
- SHA1 1fbe205f9604ff4e8d83878f8f1d16812ae134e3
- SHA512 9eda61ed8d444f03ca9fc1a6d49262366226a38a81eed90e4897894f8c7fe4446d53b6596f32a309481c89afed631622e95a8fb163fe8f004520ae0652b1a5d9
- SSDEEP 24:8d/6ii7jr8XJWInZNT9hyn1WOHmnTZzs+m9ls5yyzMxLX:8l6HjInvsHHmtu9ls84aj
- TLSH
  T12ED17E7476E50219D6F3EFB16CF4EAD9CEABF6A37D3155194482131A4800E50ED21B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  Spysok_Mayna.docx.lnk
- Size 6KB
- SHA256 8a50ed3d9d9e90c971100e211b7f5c8c7128ccbf9164cf3bd1beed8a49da6ab6
- MD5 3fc7b9e02c80f93cf8a1af6f980901d6
- SHA1 6c540c5cb35a95960c1372791810c27179bcddb6
- SHA512 25386a2b2ed506b9ca2f2911ba2dd43af56ea6eef73e18f4c7ca9058d46103330a8a92ff01af4abd1de9aa1d2750c2768209990c867f4debcd18c947e287ea23
- SSDEEP 24:8d/6ii7jr8aRJWInZNTCH7DBEpmJL7rGvlxPlpYZ+6JuJMc:8l6HjlnvCbNE+L7C9bAN4
- TLSH
  T194D1872435E50119E2F3EB352CF8A6D98EABFAD3753501562482130A4910A60EA15F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral3 behavioral4