3e73c35213010d29a9f1258799831db61694d7af38966dc8532f718d7a9bc6e6

Sharing

Copy URL Twitter E-mail

General

Target
20260722013150.zip
Size 8.1MB
Sample260731-plashssgna
SHA256 3e73c35213010d29a9f1258799831db61694d7af38966dc8532f718d7a9bc6e6
MD5 7fa725464264029dbf3bd1e81b104237
SHA1 44a441cf6f6b36eae66c828984ff8b4970690d8a
SHA512 83e5738fb2d5eade3e19b041b54b33f9d9a8a5d8758d0ebf1b767d148d4f46c8fb7c296181dd6b95295363ef60344971a63970cd4a9752abdeed0a72cb2d7048
SSDEEP 98304:6lunmnedfSAf3cAJWZRUNvwh1NJEf7mwh+WK9grlunmnedfSAf3cAJWZRUNvwh1M:68VvJJWXDg1P8VvJJWXDg1p
TLSH
T1CF8633106407D21AF71462EEDE8F3D06A0FE248823BB64F20EEE52D158FFDD658B9459
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VAT_N0.20260722013140.EXE
- Size 3.3MB
- SHA256 5dabdd4b418ca8b4034b5dea3684da0c10022ca5793c84439e4698e338e25db3
- MD5 13b01f46ec5078298548cdf8380f4c76
- SHA1 8b1af1ebc15b474dc6284f169f9ffdbe7e3cefb9
- SHA512 c64ee8e31261813e1f53a3e572c7759650e81cf36ac80c706da2cf7f6ad060ccb72b83820a7df51637c5248dbd2e5134940fc23ca80c37fe63d68318d63ed60a
- SSDEEP 98304:4xJgBc/Esdil3UQwcvEPiXZqkZMYy16I7Pk7H56s5Qz/S2:4xYxZGxqNW6I7c7H56qkS2
- TLSH
  T1B2F59E20BAD24076C173113159AAA3797379FA303B3586C7A6913F7D3E302D25D396AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  pdfcOrE8.dlL
- Size 4.5MB
- SHA256 917faa382a7fc87d4705ae9ee1e5ac56e70f8efbcf5eec650bbc81e894dd0f03
- MD5 595d4369529447bd086e908168eb8287
- SHA1 7cf5e3a80432ad4efd815d5e5b9aa46baecf30a1
- SHA512 3752f7c1e5ff16eebc663a065454a5e331a6769bae86ec1c0c4a03591ca57f525bde40cc2a3dd566b45ebbb84f5e77b519677edda0de10c2762c7ff13773db8b
- SSDEEP 98304:2kQzIlPCDxhf0/VlZuA+ZnDYMCFeLon+mGD/64cJWbRnuUY:PQ8pCT0/GDYMCY0n+CfX
- TLSH
  T1AD26BF213DE14737C56B03318E2FF67932FDE5A0173481D7A3885A393E796A3662522B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  VAT_N0.20260722013140.EXE
- Size 3.3MB
- SHA256 5dabdd4b418ca8b4034b5dea3684da0c10022ca5793c84439e4698e338e25db3
- MD5 13b01f46ec5078298548cdf8380f4c76
- SHA1 8b1af1ebc15b474dc6284f169f9ffdbe7e3cefb9
- SHA512 c64ee8e31261813e1f53a3e572c7759650e81cf36ac80c706da2cf7f6ad060ccb72b83820a7df51637c5248dbd2e5134940fc23ca80c37fe63d68318d63ed60a
- SSDEEP 98304:4xJgBc/Esdil3UQwcvEPiXZqkZMYy16I7Pk7H56s5Qz/S2:4xYxZGxqNW6I7c7H56qkS2
- TLSH
  T1B2F59E20BAD24076C173113159AAA3797379FA303B3586C7A6913F7D3E302D25D396AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral5 behavioral6
- Target
  pdfcOrE8.dlL
- Size 4.5MB
- SHA256 917faa382a7fc87d4705ae9ee1e5ac56e70f8efbcf5eec650bbc81e894dd0f03
- MD5 595d4369529447bd086e908168eb8287
- SHA1 7cf5e3a80432ad4efd815d5e5b9aa46baecf30a1
- SHA512 3752f7c1e5ff16eebc663a065454a5e331a6769bae86ec1c0c4a03591ca57f525bde40cc2a3dd566b45ebbb84f5e77b519677edda0de10c2762c7ff13773db8b
- SSDEEP 98304:2kQzIlPCDxhf0/VlZuA+ZnDYMCFeLon+mGD/64cJWbRnuUY:PQ8pCT0/GDYMCY0n+CfX
- TLSH
  T1AD26BF213DE14737C56B03318E2FF67932FDE5A0173481D7A3885A393E796A3662522B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Looks up external IP address via web service

Enumerates processes with tasklist

Checks computer location settings

Enumerates connected drives

Looks up external IP address via web service

Enumerates processes with tasklist

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8