397b72923f2bf9eae7d9eeb9f576889e5048bd1c5ca9a923bead1d1e975131fe

General

Target
20260803122904.0CDDE8D5F31F.zip
Size 4.0MB
Sample260803-g2p85ssydv
SHA256 397b72923f2bf9eae7d9eeb9f576889e5048bd1c5ca9a923bead1d1e975131fe
MD5 60be21fbfb9bccaf5ca25eae073ee574
SHA1 b1aaccfa8ac982556a24724eeee2fb1baace8dfd
SHA512 e6abb8b296d734c8daa3707613e4526880a34d8cff651b655247478cba8e90936ec32ec59ac7757c56a7a2ca827984d32ffbf514d5040304f031a67e6b3599f6
SSDEEP 98304:wG4Vk27lh8r77N4fabjXuPr2LhaC17ak9M4p7ZQt1z4E2B:s5lh8rKivP0k9MM0shB
TLSH
T1021633A9CD393890F3CE6ED15D6A9DA03988F7E5EDC73810794E42CFA6353A011425AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PdfcOrE8.dLL
- Size 3.9MB
- SHA256 e4e94604d0c73e1d5e4bd6855f2dd0c91d7e884512aa4eed8b63fa69e2a91391
- MD5 a9155728583966693d656c8745edf44e
- SHA1 ee194d93d1785f1a54b5bcd90db7c1a426bddd20
- SHA512 196356145867893e313a73e7e250fa60c67e1f9466637989ce12e3bcc8b6927f694c45fe1ca1f7fb1cbc1a57605e5265d01a3573355d13dcb87097e55e0d6db8
- SSDEEP 98304:b2xliJQ4DUrfgJuVUwpZfUCcabgWShASbyAdEOzutKVlnfSzPyi7:b2xIQTBQabgWShnbyAdzzvVlnfs/
- TLSH
  T14016D0123D8042F7E42A1370564EB7BDF2BDB7B80BE784C7E6D0E64829724867126D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Vat.N0.20260803122837.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH
  T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4