e7ea833a5d9745f0834a2e66f6edd87a8408a52762e25a745a6943fd234c55a7

Sharing

Copy URL Twitter E-mail

General

Target
Whiteheadgroup.co.nz - NotebookLM.zip
Size 43.8MB
Sample260803-m9f84avgre
SHA256 e7ea833a5d9745f0834a2e66f6edd87a8408a52762e25a745a6943fd234c55a7
MD5 c99b6d55da9823ef2e8a8b7a410395b0
SHA1 d425c8b849693bb1fdcc6adbe583c68790521f68
SHA512 b7a73c28755325a1125663e3147f0953b163bc886e33977b397aca28b761e05d6258c24d8b861b6478cfcc982bee7c5407c2a2a43d760818a1350302d56b100e
SSDEEP 786432:Bkr2A6FrtJPw06mc5xHS+62AjIgAsk/fHd3Rdr6UPkbhcd+eswgh2T2uf9DtoE98:BI2AarHo06mcXHl2lO3RdrFkq/auf9pw
TLSH
T138A7339CE8006E18D63D71BC29BE28C173FC9226C50289ADB76E53B18EC77C49675E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NotebookLM/Disciplinary Hearing for Serious Misconduct at Gol/Artifacts/Muddy Boots and Fraudulent Calumny metadata.json
- Size 603B
- SHA256 8097c0a9e5929998f49244c77f9b44579c4f94e01cbcbcf1236287f06bcdafb4
- MD5 a752d2d8b16bba40a1f08757f628fdb4
- SHA1 ea18071de711ad12e25b522f9a3291adab778db4
- SHA512 5bd128c121558daf665cc884c1eed93c127180f7470d4d8c45c5f75d4a1fb32b343fd4aea17991940c966024588f8f7e3048d1c12d50f163757d452287cad24b
- TLSH
  T134F0E122837569A741C6100014B618575910DECBC0DC3E703E4D59ADDFDDC1F45BA3E9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  NotebookLM/Disciplinary Hearing for Serious Misconduct at Gol/Chat History/Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c.html
- Size 72KB
- SHA256 380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371
- MD5 a8f0bfb3885db441150395d294c64a4f
- SHA1 075b1e8091ee60fbcbf2fc2a8d40805e512186ef
- SHA512 3a5840b26c9b4c1736edc74430915af8b873dd2988574514f51a08a5cd6a0b1b47d47e46d0eb2ca1307640be7d54bbcf38a4b8658d81c452cadcd83cb0b2540e
- SSDEEP 1536:kdMozIViKXWZdH47v2oZFWNQmU9WuTUrSybh:k2ozGiKXWLH47p4q97yN
- TLSH
  T1D173A6479329033D0E720A82691D17EF775CE0ECF35612E278DAE278211995247B7EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  NotebookLM/Malware Analysis Report for Driving Moccasins vs/Sources/Max odt-df71b82bfb07d3df1d65d3857c8c68644f7682(1).html
- Size 1.5MB
- SHA256 e0455db01a6d2b5bf68ce89bddaed993efb75fd6dae5de4bac6fd4b1f850d652
- MD5 7c60e8c948a37492210e02df1f646400
- SHA1 24f65404f34bd0a07da63ad01b221ef97ea7046a
- SHA512 947fee3554e33bc696c2996d1a8e0f72885e9c8b9bd633da98606c976bc94b30e9f14e7c735823927416b73c34db1896360aedf9b34b71c8817b2c7fa4f5f18c
- SSDEEP 24576:ruaOSsPR+gkCzUhzpB+/Kmk1ULdENqsYCedN1PEKHesBnf+ocuNIm7:FsgPUc0t5HeOf7
- TLSH
  T1CB751231EA7FF959D73C8DBAE98B5D040E976CD3188D80CBB1C273C25A482D68A165F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  NotebookLM/Metadata Analysis for Response to PG PDF/Metadata Analysis for Response to PG PDF metad.json
- Size 217B
- SHA256 7e659899100da52d87b7a213d68e7e63d66a7d97410a4ddd255d2f92c32a0244
- MD5 c6cbd03631a1efed3edadf74a78ea103
- SHA1 239b1013e4780a1ccde5c8ef97228ce8b3e21587
- SHA512 27b0eee868959932bd8602779b49741ba8877124ac112dc224eb75e0ec44371dddd34ce7a55e40156a44b7b1e6ef713554edb984e6dae3f47ee81b1b1aeea077
- TLSH
  T158D0A7605C511CCB5A4440A458BBC6926B8478070688254AAAC3AA0C1EC4A5D6CB6955
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  NotebookLM/Metadata Analysis for Response to PG PDF/Sources/Max pdf-ad73639c575e49484688e231d922a5a907ca1d(1).html
- Size 39KB
- SHA256 7d917661d82622ce409bb18dce4daf0996ac4aab41b9c68f1f9e9f41ee9ea434
- MD5 0f5273b227022b5a130d62832fcf5596
- SHA1 0a3b3b770448d48822c17d9753718d460825a429
- SHA512 f32a2050a2cdbc2c2f9a3f0eaa2d0f86fedb9a47da11e1b6df686a50b0c5be4bf607a72295771c2cf7d9febf84f09f0e95b4745a1b7f2c88b51fdbccd81b7240
- SSDEEP 384:wL/D4dHdpm55GtGf8viB1/cssjRQQ+QU/lQhfr/KA6DD4dHBmmn5GjG5Jv9AmGdF:wbcssjRQQTUtQhfriA6sGdoIKnzNZM
- TLSH
  T17803F281C8D6B6BAA655D682FFB02C0A17F56D3483E02125C71BCBBF9BC8CC5C64D216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/1. Jason Peter Clayton 2. 2065 East Coast Road.html
- Size 3KB
- SHA256 dd9d1a8073f81a003a9fddc7735947a33b3f3015718f0c7a5d6a9326dbf19130
- MD5 7fc85d0b62795813c2172f26921ca33d
- SHA1 0d0b1b7815df0033dce79214e926d1a609943547
- SHA512 75a666bb9fb66fb968b154ade9f726b32912eb8aff32b95a62a3e26da770980ea37d63fa6a2eba2facd2ac31dd80254b84084f4307da5d00e10ea87b0610c3d1
- TLSH
  T1F471329EC61703AB0E07A3B9EA4953EF853D005C7A9325D8248FC0BC5605927047FBDA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/Copy of I need a legally bonified version capa.json
- Size 511B
- SHA256 62317b97b2df121ace94a73b048c964065b2086f05e66f4043a0de35ae9cf86f
- MD5 586eaf91884e6f7f194b514aab96cedc
- SHA1 bb8c95d7cd9a38fa6e66c107fb8ef41d063fa3a0
- SHA512 54164f21cd5dc4525fc33db7f4baa0010a93b921164ac819d36a6d47903c83770866c13996e55706f26e72d21e9738d239832ef554a199b49d7782d3410b54fa
- TLSH
  T1DBF00E28D02A2D4BC04D42B50C7DD9949B68112B1E841DEAB2EEA65D0F4583D736CAD5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/I need a legally bonified version capable of s.json
- Size 503B
- SHA256 8d858512e400598fe546e363e49bab76841833b82ff8df36622b166cdcf9596a
- MD5 73b6760bd3316d6c320128097199b180
- SHA1 9d10f6f3295ff387e4ebfe3aec03bd4307313bc6
- SHA512 306d125268b80b7c96127332985b9f8a32ee0833d384d679d92f3906c544c0ffc36f2a05001cdf1d29e766a9a719302c3b1333ab7c2bfc65e1a1cfcd019cb561
- TLSH
  T1F5F00E2CE1272EA3C04C03310C688291BF9C550F16A81CAAB1DEABDC1F80C7D31796A1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/yes - yes(2).html
- Size 800B
- SHA256 88815f5e7235a8be0ddebd699f12e7998b8a212420437272031c9ddedd3aaa42
- MD5 e92a16c81c95236825085528d99a1264
- SHA1 478a68d3865d30e882970d4c649d1c9ad83b668c
- SHA512 4fe183718d48d41789e2b0c7b514626afa73ea2b3bf6702ef106cdecf6dc48aea5c3d1c017f7bf72d9785395dd232c48229a2f67e66ccf6304607f73da34be46
- TLSH
  T19801BD5561E1A0BC2D6709530D752D5269F4133683100473C7AFF83F4AC98C5618E783
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18