f733a0ad8cea92ce18ff734076cc19971b06b5fe4552d9d18df7645d6c2649f1

Sharing

Copy URL Twitter E-mail

General

Target
31072026_0303__tuvvafFol-365949HRPXDR_eeyqExec11909.vbs.iso
Size 4.9MB
Sample260731-dj99tasera
SHA256 f733a0ad8cea92ce18ff734076cc19971b06b5fe4552d9d18df7645d6c2649f1
MD5 2aa0672c61fa5c61b1f791981205f448
SHA1 d0143e37958625d95f7668aa81477df47371314e
SHA512 8782ab9f5bcb1f16a6adf6bdd3005463d79e1bc13ba27004b4822753bd2d5ff1d60bf5ac4bbdae6878a0b980a9fa5517a3c8d9e2a4846b3947da09f3b79c58c3
SSDEEP 49152:k82ZlUNG2tBLnih2pFckcbU2N8wr3/7kceuIoT0eWvvpz0FInTfH:V
TLSH
T1373623329E89996AC9604771B16A7E29AF2EB353034CD1D7BC5CC18B2B9BFC485370D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _tuvvafFol-365949HRPXDR_eeyqExec11909.vbs
- Size 4.1MB
- SHA256 d7bfcdd1e7f375fbedc20fe9bd6357eaa092049e2e2d4ab2c019963273ae661c
- MD5 4e0a8bdec6f4af28a13acb32871ad3bf
- SHA1 b7cc39c6a7c6dbced7cee452912e1f7ef47e5a28
- SHA512 98992798ff333e1554adaf2b685c1e5016e67d8d977bba426632c8cbdff88835592c83b8f2c34384342f9e72b6c3baebfcd66ee80553c409c84da3c9e8623133
- SSDEEP 49152:E82ZlUNG2tBLnih2pFckcbU2N8wr3/7kceuIoT0eWvvpz0F8:T
- TLSH
  T169163371CEED2D170E748725E06A3F2ABE6D4A53400CD2EACD98D19B25DF7C9413B8A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/iysx1.xml
- Size 67KB
- SHA256 861e8afcc8b73a58aae71ac4c0ed6961683d9a0d76b69d10860dab9681a4999e
- MD5 0ad3d53d8e3bb8815d311b83604e6547
- SHA1 9beec3ba8ea309d1ca162513987d3226dbecd840
- SHA512 d977525e1a7ca67a206559fb4c42ebd4b4b0c7610e3cba4da473981f8477eb0b38815fbdbf0d697d47a53ea2421101b55b4b16e84fa6eaa2dcf88158fa49d23e
- SSDEEP 1536:gMS7YjYeb2+fwius1trZ5tJIgdHh364XZOBdzoKb73P:gMS7YjYebVdBJvK4XZOBfb7f
- TLSH
  T158632857FB4AC0B9E94581780CB6A78A5277F6E11FB045D3B288230F8E677E92D310D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/optca/xdftj/jkgncs/igxqes/bupj6.pdf
- Size 20KB
- SHA256 04d724ed270bf43c41ea12cbddba9ebab3ec1e839cbbf88f4086d2a594bfe8d8
- MD5 984faa269a29f5ee999a3510abc3b30e
- SHA1 9e217011f6f9651dced80b5409548183569002b2
- SHA512 db16fdde89d14129f7710a3e7e920f248518fed7a1fc1a83741bb653274afe913ad149576ae41a52d031f117b9b86dcf766758f4488c510b90e9074fe73affc8
- SSDEEP 384:gLWSCW21BZm03wj/hSlBaDEXbGpWl127vwc35tg:g6S/2DZxwVuUrD7vN35i
- TLSH
  T1D2928EB3F5641C8CEC828B8A8D683CE5089DF027D6C83CC164789785BA55F7DB6126DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/optca/xdftj/jkgncs/igxqes/cfoyv3.pdf
- Size 12KB
- SHA256 70ceb9d5412eb3e7050d821bd9b2e4b7c7676a633e4dd3c23ff1aa37ec5e45fc
- MD5 b11338d79839bdcae8d15dfbae297f8c
- SHA1 2d9fa486c500f51e7e99bc85feb6dd55f5d4ccc5
- SHA512 c0e28b660b209dcdab92aff3e3a380934a2d03afe17e7f87dd404b86e154b0d3b8fe76eb2c8c8d21a6833e94b37c2b1ffacac4b253148d07d9e766315dbe158e
- SSDEEP 192:4JCRckkpaeZRdhP1uPt/i7t8XGA3nxzGAEeQ240w/h7JuYO5kKxNn4h2:6quAeZRdhdu1/M8Wut54TTgkKxX
- TLSH
  T1B7421968ADD6A99DC443C28114A0389A4F5EF27372D43C813CAC4F885F11E69FE53A9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/optca/xdftj/jkgncs/igxqes/ehqm1.pdf
- Size 26KB
- SHA256 ad1274c77e314cf872c13275c69a9b4b41542ddfa7e923391769a1dedc68460c
- MD5 230ca2433e9a7548ef327af06df4b198
- SHA1 61c94025b9036d1c836605cc7ede7b0e0ffe5e4c
- SHA512 186d991e5a85c4a3cc3bd85c3b7319e06faba50d767b991cf23b62a0129153ee17f228d0a872a576092eaa0292a74cc65715762d836bfab08e7f10deb6a5942f
- SSDEEP 768:6FX4GftQaVBJWDmSncBR6GKsEfHBY26QeKf6iqKIA+hB:6FXbjBwAbIfhqQeDe+/
- TLSH
  T123C2AE18644BC550A7A752DABF5EB8E7A08CD34F20989CB25D3C8C958ECBFD4E42D1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ~/optca/xdftj/jkgncs/igxqes/fptz9.pdf
- Size 24KB
- SHA256 68d8c12391e2294db9e614463e60741e7def8906141fa98db6a4d4504e181944
- MD5 bd766bdf053039564a39096005113bf7
- SHA1 62a23c4ccdcb5046c29c02e42b60b9af532c9ab7
- SHA512 aeb68cb5c5f6c5fb370145c6f8ce2ce9e583cb02f2b3b15518f016177cf053083f1c800388671c578e7bef4d3fd99d394d7a52366d6acc03fdd79bf47b31d6d2
- SSDEEP 384:ORStQttQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLsN:O4pDCpPm38e6jcTJF4p946lPn
- TLSH
  T1E4B2BF834D468D76D4F18B51BF03EF0E5B9A7E44704B7AD710A2A8CA7F24AC29C1962D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/optca/xdftj/jkgncs/igxqes/ieted7.pdf
- Size 51KB
- SHA256 3de284d8ba70a240a35f1b03e9c192df2c05dbce14a9fda31c34616a7f6aac0d
- MD5 32fe5c5d5c738205376840d074b25602
- SHA1 cbe40e7177b18b9ba4052694971467e16c3080e5
- SHA512 00cb8eb8a3fc97e60e0263850916e3e30f89996bb2e1c53845d830a5e3cf118eb24d65b5f9626452167387d700d0776d141d7aa97b04dbeb9675e43a01eca491
- SSDEEP 1536:ezfbYC1qXlT3Q2hdm2/hFCPW1Zqfe96gUbDsVO:0sY4RQApUP8ZqfesgiDsQ
- TLSH
  T19A33F1090A987BCC98B365530F10FA95939E73327CD805962DBE599B274BEA8F4031F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/optca/xdftj/jkgncs/igxqes/mjtu8.pdf
- Size 25KB
- SHA256 d8a939595c8105ece6189b480d96a6884e9790fc93980c385d666da57f372d88
- MD5 eea518aed26f9f80d92dd6849b3bc8eb
- SHA1 ed41fd87b9b173d7729878e280479807cef5417b
- SHA512 c93b98f08aaf2bac86f9b57ace0bea267bfaa0d23874773e0b7087838ff179e246f331aa5847828142ce26e5e22e192cc72a464df6caf30ed50e8d9aaa129e17
- SSDEEP 768:M57rOIaJhtyGeMmH6PqrDcUFsw3q7f0vtO3iqKIA+h3:M5nO5JSG8Rr4UD3qne+Z
- TLSH
  T1BAC29E4A2547C550EB0742DAFB2FBDA7A149B30F2268C8811D6D9DA21A57FE4F20D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/optca/xdftj/jkgncs/igxqes/psoy2.pdf
- Size 24KB
- SHA256 69993682a4f1ed4b826fb893caaea25fb955865fbf2902e4567f456cd3231ef5
- MD5 44ab75d89d61a31a4ab45e606c613205
- SHA1 fbcf5ccdf7352871b1f879b6e9f0454a5baf1bb6
- SHA512 8e195203e1819dd57e75f5175577fdbde67058ac1d06b902724b1499f6b315bbc28198fd84ed08258e20d363848442093bf66913e93349a831fe0c22fc729a7c
- SSDEEP 384:sBfGD0KtrrWvBbdj0fb8rOtW/X2WBiXRzw2iEmhAXzSp3ustqgKYIAlE0/CQ9x8n:wfkXqBQb8HX29XIAXz9iqKIA+hp
- TLSH
  T13DB28D192183C8A59F535AC7BF1DBC92905CB30F66A49D631C2C8E925883FF5FA1E4C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/optca/xdftj/jkgncs/igxqes/rnag4.pdf
- Size 37KB
- SHA256 cd815bfbc4c8d41909268c43d76b4a47cf041004faac32fc2d8de24edceb0685
- MD5 73697ef5f26f094fa1e86c7f7b61f933
- SHA1 749045ba2138dc277f3b7c45d41697b0efaf48f1
- SHA512 28edeebbfeccbacaf9e353a99b77b688e0fddd2abf9be0e48641063545434a6047dce827fbf1dfbd2bca7791225c0c472dcc1c7ee9b6994300f18fe0793d50d8
- SSDEEP 768:JRRTo0irYoFD/2i3BjdqCP2tFi5M17e8uh9VN2ZWJ4325hCYs9:TKHNd3Bj5P2tGCe8aOj9
- TLSH
  T18C03AD174E02958DD49595D2BEAF786C8B0EB73A79C878CA3C2C0D839F40898EC5F563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/optca/xdftj/jkgncs/igxqes/tlfybd10.pdf
- Size 32KB
- SHA256 b3f1a28877924d7758483769c5093cd3d8387cc7350d32cefbbd0ba576e158ff
- MD5 13c5f347fab9419bf9983a6d86ebd1d0
- SHA1 e41f6fb75ea3a14c5e29d8b4d9239d5eb13185bd
- SHA512 f4a5db8acb70e06a2c1b9193f528ffb618d91668b816975210454378802675842612fd0d8448538be57e58f6f7a4130f956119fbf4d9c44c88d790f56ea950fe
- SSDEEP 768:p1tS60qAyVEfC+BAVdRp7Fx+fJ7WZhayyT6FxaYByZ4qKIA4pv:p1tSbDOEaVdRp7qGJyTg0YYZM4l
- TLSH
  T194E2BF092447D5A8CB0765C6BF0EB9A19D4DB30F40A498962F7D5D630A83FF6F82D2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/optca/xdftj/jkgncs/igxqes/upelbx5.pdf
- Size 24KB
- SHA256 e6f62bedfc34e18d659ca3002ccbca910b9cfb55788e3c866fda63861df2d2e9
- MD5 f02dcab7c35ee2870d6a5d40038a1913
- SHA1 ffd9b92ffd3ec86ee8c24dcc7061ac839389b800
- SHA512 51e66a8f29eb83681965be1bf01ad8989c68cb00e4b1f45dc3fbb16f257389e707e31766bf617e401c472c12d4ccc73141a24406d0c1275410d84103c6461e0e
- SSDEEP 384:CetvQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLXv:CeoDCpPm38e6jcTJF4p946lPC
- TLSH
  T1BEB2AF834D454E76E8F19B50BF03EF0E5B6B7E98754B77D710A2E8CA3B14AC25C0921A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  ~/pspdv2.xml
- Size 63KB
- SHA256 3992dbccf18e03c0183f61cc8bddd4bcef7c3617fbb3e399b355d20bbf4589ce
- MD5 9fc0a78ea1bed4abb0fe25093d906acf
- SHA1 b21737389318f70a5174eb2fec352b37483e34a9
- SHA512 28b54caf7eaf847518a2b5ae7aac20d5b1578a24facc5bebdc05eb0c77909667e779d69b3e44a2083487d2642a7dece9636861a5e8d6c5165a9bbfe456bfa899
- SSDEEP 1536:KmKy1UIKgEqRPwHHnToIfiIOjIOy3VEKV:NKYwHHTBfAFy3qs
- TLSH
  T1C8538C06EA809273C5F40A79D5EACA6D8E3A32500BAD91E32DDD6BD02D047F573752CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26