7aacb813221485db9d2a3d9c2df0a1d39ff255c8cd5ed6308e50aa844a6d8f84

Sharing

Copy URL Twitter E-mail

General

Target
31072026_0332__0P4Y934Reg-927643QQYTNZ_jdlpRunjjmtu.vbs.iso
Size 4.3MB
Sample260731-d3l2bstaqc
SHA256 7aacb813221485db9d2a3d9c2df0a1d39ff255c8cd5ed6308e50aa844a6d8f84
MD5 fdcfc5bcf7c88968124d080cf1b29836
SHA1 cf25f1325ba7a5a7464a6a538d213b8612b0d0b1
SHA512 8ca98dd586f923d18efb23b5ef43f0d706f0ea4c2e9f90561fe7e996b81bb3f40be6288762b4a3e0d6d804a79083268b4c9eca881dd035f55684c00bc66f9ecc
SSDEEP 49152:YksqvFRBup9MUtSdzfFf0kCNjGnVUEIz+UT4R9S6dRCFtaCJlWfbcnu2uuim3YCR:+Ouim3YCR
TLSH
T1D3262332BB420C7DC3910770B42A34356F3DBB27854989DAB4DC9DCA67499C4A93B4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _0P4Y934Reg-927643QQYTNZ_jdlpRunjjmtu.vbs
- Size 3.5MB
- SHA256 eec460eb6b9cf20c3a43c3b3a7676c1a5ff01fc285eb8359c505910eff0d037b
- MD5 de802a147028d7650a2900403017140c
- SHA1 a14b61814444cd25913bee09985d03d9a782875f
- SHA512 a0bf939f7747f70fc6051a8cda6249c8d2834699e479c323cc4dba7040abce4ee54df00c0c400eb1c4d22106a8017c0fb5136f4b12951ae1c91d479377f6042e
- SSDEEP 49152:LksqvFRBup9MUtSdzfFf0kCNjGnVUEIz+UT4R9S6dRCFtaCJlWfbcN:H
- TLSH
  T1C10623726B5A0D7F43A00714F02B29257F2D8D77C109C6FAA4C9F6CA22CA5C9457B8B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/eczjq1.xml
- Size 109KB
- SHA256 b3bb763a0cf0679082ff569af9b07c9bd5b08bc5bf63ce6b7ebbd47608de3a44
- MD5 bc2b27cf1d3b9e566038f6c9d0007a92
- SHA1 eed6a1e0b3eb34b1be3e81fda4f2a1c57dcddb3e
- SHA512 10332f7d4cfda926c7d254a5ac5f9ad2177c0266f0a332a7331867f1d38512bff17eb69f226e3193d6546bfccdb7aaa62bb2f37f4cf5d4774ed58334d506a3a8
- SSDEEP 3072:NAX4WCirShYOty/Lo3zaILIdlUfo8zgOZKW9L7yDT:NAX4ZU24OilUfo1OniT
- TLSH
  T1B6B37D93B1D04471E1B21EBCACA9A665A83FFE202D74455BB7E56D494F3C2C0287C2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/mxahtr2.xml
- Size 79KB
- SHA256 20186a2657ee3c17e5b7ee5654ac73b7d34b5d480380f7c80e02955ef3d772a8
- MD5 0ddb14f218c5dbff6daab48a38bd95ec
- SHA1 2eea6a727a983e4f61268f5e5639bc279e0e0fc1
- SHA512 330fd088106da9f47ca68e3b3ecb8d81cbb41105488c9406378fb12a516d6a2da7657f3104cd12e3b8d16f3c13ac0fe2e75de55098543335c26fe73eaf0a86c4
- SSDEEP 1536:Lj+7MrgyymQhXeVt3UcffVrl9jETRopN655HhUoEi1zuRvwHd541wQ04Mim3YCgu:Lj0MrMmL30TuauRvw921wQ0Pim3YCgmP
- TLSH
  T1EE833A15F70390F9D8131A711186A9D725B0970F89159EEBF7AC8C69F73EAC099380BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ~/pnmjt/ofrv/foko/sbeyx/esoh1.pdf
- Size 12KB
- SHA256 0e65316295a1d7edc7ff02ee398cb972e7e59b3c3ec6b319313683aeee889cdd
- MD5 4c079a927ddd3f869ce13c1c3ac82390
- SHA1 54bbe0f62daa71ba67922c4cb3379cc878cc343d
- SHA512 15a378c7fae7e28c06333369b4c2f75bc54cbd13bd0b709285c3539a1aff1fbf0635496f71ad6cdbe75e91503edb95b9e0fec13e0f3f1a8c94f9c088242067e4
- SSDEEP 384:4WUf0b0S/EJv679LRa/tpOdNG0qLLx2OU:NmgEJv679LktmG0q/x/U
- TLSH
  T16B429DB0CDD57C2EE85B2C50897D3D29419EF19281CCEAC13BE659CAC618A14A5A1FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/pnmjt/ofrv/foko/sbeyx/fipg7.pdf
- Size 30KB
- SHA256 6390ac36da3dcf002e5bca4c46658752c0ddfe5ee1e53b0ca625ccd4fa9b6e3a
- MD5 73bbcb776f8bc6121e82920deb0c04cc
- SHA1 30369ae0c8912d914d046f4c57a64747b5d424ce
- SHA512 c3f7a63f729efd3bf2780ed59034f84d2158ffbf8684ac8d472046d17a8f63730351766975ca0bbd892ffe994a1ca387cbf3d077211c81367e3091a12b18d023
- SSDEEP 384:4Hko0a/gIjeYbdM1cMzc0bWtAsLfW24D8JwFLygTNNGmuGkvJ9dmUWMNv5itbFoZ:QxjeJ1cMggLFL/hNkGwJf
- TLSH
  T1E8E2710DF245BA90E45147D65F387639657F7318688A5B904DA3C32BEA018FB7BBCC82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ~/pnmjt/ofrv/foko/sbeyx/gehrug5.pdf
- Size 24KB
- SHA256 f2ec50660182730a8945491781eb64e8cc667d014279899cb503b6142daac234
- MD5 573db8ec3676d658174e53286a06b4e5
- SHA1 921846b507d53a6aede007982a10b9eac33f55aa
- SHA512 e46d31f8ba58e21335c65d4969bfc9e973de741bace381903e280c15bd17248cc4ff415172fd26cc5173b2d35f68393a6db9aa9ac18cb5cf75b715533272a4a7
- SSDEEP 384:V0H9DN/tCs1CKq5207YNg7o5ExbcL8+IMKiGSrk4kIvhizRSfoMF:V0H9x/IAG5xYyYEUIm/rn5vhizgw2
- TLSH
  T191B29F3AAD34B448FF33DA7054E93909116D752AEBD4B9B0713C8F457700EE06E1A6E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/pnmjt/ofrv/foko/sbeyx/khazrr10.pdf
- Size 32KB
- SHA256 b3f1a28877924d7758483769c5093cd3d8387cc7350d32cefbbd0ba576e158ff
- MD5 13c5f347fab9419bf9983a6d86ebd1d0
- SHA1 e41f6fb75ea3a14c5e29d8b4d9239d5eb13185bd
- SHA512 f4a5db8acb70e06a2c1b9193f528ffb618d91668b816975210454378802675842612fd0d8448538be57e58f6f7a4130f956119fbf4d9c44c88d790f56ea950fe
- SSDEEP 768:p1tS60qAyVEfC+BAVdRp7Fx+fJ7WZhayyT6FxaYByZ4qKIA4pv:p1tSbDOEaVdRp7qGJyTg0YYZM4l
- TLSH
  T194E2BF092447D5A8CB0765C6BF0EB9A19D4DB30F40A498962F7D5D630A83FF6F82D2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/pnmjt/ofrv/foko/sbeyx/mkkmn8.pdf
- Size 46KB
- SHA256 e90c37b856dd3dbee0d623632637d9f711ac888ff6748bf24266fdb54bae1d83
- MD5 a8e862d02033b94060eeec6416d9c1ee
- SHA1 6e3dad950cd00022858b009b92a81e7874bfafdb
- SHA512 1dec553deffb63d77b2d91edb3ac8c20a4209829f63e7723e66e9be09355778811aeef76114f6d152561bd98ae96c2b5093e9c5098ccd17efbfc075257d57325
- SSDEEP 768:VbBW8qkZ1DtGhQdG1gELYWhYGls6igH1U9cdn0bZ9lmjpCx4zQiPCJOR:dDR1BGiwjIGls6i01ScdmLrbiaJOR
- TLSH
  T17723D0AD9E124FABF5F213303F3979416879B50621DFBA8C30385B473CA4E60549A35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/pnmjt/ofrv/foko/sbeyx/muiqff6.pdf
- Size 38KB
- SHA256 ee06e802958b50ab90e88da89e8f5e14be8d6e254c53ba904a6c9425d2e275eb
- MD5 d093e5eccb38d21627a1d832a54ee6ec
- SHA1 4c261f57c4d19c3615008f2b6bdfa170e1748653
- SHA512 78d0131d4add9f62b3d9c444e12ffa009d47afeb08304eaae326d0e1187dea240d40e4b2c91d06edecbcbae76190d4908ad85209f823925378cab606fad214e6
- SSDEEP 768:sdOLWon8mKWX8ZualCc1AjIR2zoTHbffH0v9Ekd9kSZ2NdquMn:ni88VWX0ui3ZR2zoLb01p9ks27xMn
- TLSH
  T1A503E18BAC488DD0E9C44B907C22F84D7A0ABFE7F4F733BD501999C6638C61161472EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/pnmjt/ofrv/foko/sbeyx/pukd4.pdf
- Size 25KB
- SHA256 93589deb7d22098774b7ebbbd695099b5024d08cca5a3e3693d842e2c883aff5
- MD5 2e0b2f4c3b3f3e44a919a4397278cfa2
- SHA1 3419b7c45372a44ec91cc0fe70e489ebcbe3accd
- SHA512 21a062c04fef5e3a5fbd587d02e1fa74cab952312d67a2d46b58bd3dd501a265e1ad66891829b4d991d96236911f53b3987477a5d69f812e9c7f46c831011951
- SSDEEP 384:Y71XDhMRSTLStSQsCl2f4H0FoPrYbG74MTB6xBsu//mh1EOISGr9qLITtNypE2p5:e1z+RsStSGW4OoPrZxhuOISGrUITnh85
- TLSH
  T140C29E50FDE4588ED446C6A390A578D44E69B2537AC4388238DC4F4F2F10E8EBBA787D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/pnmjt/ofrv/foko/sbeyx/rbrnl2.pdf
- Size 37KB
- SHA256 f6c20d80ac3d84183942ef81df6303179e857170c6dd98e3a826b8d273ea230a
- MD5 e612fad48560de720f78648b001a8c21
- SHA1 06070fc3c2bc1060f03922c13536c5dcc722075d
- SHA512 d8f1c98708e9b584d0ef3a8d7993547fd471d252918dd67cf973a681e6ce4b9d1af8c3662e619e1b4fe1060c94bcddedf67158ead27ab8c2a6b49bff0d368d74
- SSDEEP 768:J5q58ro0irYoFD/2i3BjdqCP2Qrvh6glaX4VJ1GJM17K8uh9VN25WJ43TmYY1:J5A8cHNd3Bj5P2IQgMQJ1ECK8aGO1
- TLSH
  T19203AE178902924DD88995D6BFAE781D9B1E333A79C4B8D63C7D0EC39F108A4EC5B067
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/pnmjt/ofrv/foko/sbeyx/ummqbc9.pdf
- Size 20KB
- SHA256 4500ed367dc7d75e7eb733095f557208d0a1b97f71276ad81f3772815d71f872
- MD5 e1ad384280e0566577255ddc29b427e2
- SHA1 895e5a0be202e72568914051143f156867147b10
- SHA512 2afa4b5ba34b8c5bae1442d7a134c567caee6347c4865eb2bef93bf80f3d7c7b204696b6ccaed03fb55856e70d194a711952669448a84b769d84954f6b3f319b
- SSDEEP 384:6QloPxOjdCx03wj/hSlBaDEXbGiWl127Rwc35wdh:6Ql5wswVuUwD7RN35W
- TLSH
  T1C4929FF2E5A91C8DDC828E878D593DD4086DF123D6CC3C8114B897C57A45F6CBA126EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  ~/pnmjt/ofrv/foko/sbeyx/zofn3.pdf
- Size 12KB
- SHA256 e31281c19ea1cebec4cd816226e853b407fc57ae7a3403c91c5a60a2f1642f8e
- MD5 87012f4049699291cbcfab8a4cc8bb60
- SHA1 c8765b8f5e459073a879a233d7318f498a76e61d
- SHA512 c389946b30076c21152f9a1b4576ff5bf4356b1e24223550260b47801e30ed8b7b48400ba5744d97e7bd7eeb315392aa3f7e14f018bedc57a81ebd5316c2b8a0
- SSDEEP 192:4JCHcgkp63ZRdhP1JzPzIi9twRiGHYqiOS9FqzeQ240/Dsb4p7fJx1+yxNn4e:60i43ZRdhdhrI+wU9OSnb542ZNxxAcb
- TLSH
  T114424B64EDC5A88DC842D6C2286538498B1EF33375C068823C9D8F45AF50D9DFF67AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26