General
- Target extension-fix-5EYRF2.hta
- Size 3KB
- Sample260803-lm3m5stepf
- SHA256 58d975c712e6401af774395aa88673dc426853cdb93977e8ab8dbeab1ae78a80
- MD5 af390c89934bb749528b3e5164844473
- SHA1 e7cdc52a51167e9227ddd281a4770abb88bc1e85
- SHA512 1e1625d1e3dbfe53846f142ee4ba3d2089dcdad44a648f6d85228f045816d8ca5e41c0efd434cbc5d494a7a2c28957aab7fbdc340e56ccba7b9e0a20ea02dc51
- TLSH T1485142F37A5682C6BD3289DB1A6F508D18981B422366E4BCF2D7DC00EE8DF5A44743D8
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-5EYRF2.hta
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-5EYRF2.hta
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-5EYRF2.hta
- Size 3KB
- SHA256 58d975c712e6401af774395aa88673dc426853cdb93977e8ab8dbeab1ae78a80
- MD5 af390c89934bb749528b3e5164844473
- SHA1 e7cdc52a51167e9227ddd281a4770abb88bc1e85
- SHA512 1e1625d1e3dbfe53846f142ee4ba3d2089dcdad44a648f6d85228f045816d8ca5e41c0efd434cbc5d494a7a2c28957aab7fbdc340e56ccba7b9e0a20ea02dc51
- TLSH T1485142F37A5682C6BD3289DB1A6F508D18981B422366E4BCF2D7DC00EE8DF5A44743D8
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1