47e8b346fa975c2cacc072e5567aa7915e17bea3fe57e45e4112535bed179848

Resubmissions

03/08/2026, 16:22

260803-tvf34scb458

03/08/2026, 15:58

260803-tes3qssgrh8

03/08/2026, 15:39

260803-s3k7cssglb8

Sharing

Copy URL Twitter E-mail

General

Target
`MAX WHITEHEAD 31-7-26- Fw_ Release of Information 1.eml
Size 1.5MB
Sample260803-tvf34scb45
SHA256 47e8b346fa975c2cacc072e5567aa7915e17bea3fe57e45e4112535bed179848
MD5 e869c920243b89a3c3a87d855b36aa10
SHA1 85a60b196175170be0a8e9ac41bd06d58ae18321
SHA512 98ef1bdeed08fba36e0d71d5d0beb9abb658db8894eae5243fc2b146b4ca284a404b7e447cdab4693beadeda556aa36976596233efe60ff229315622b1f5a64c
SSDEEP 24576:Zb9dGPL809ytZ+5RBetRdIsagNsQFSfzRmA:Zb641+5RIHNsQGzRmA
TLSH
T11E75F1F4DC062D828B205635F42F7E1A5DD42F836AF33289F66C750493F99B8D993928
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  `MAX WHITEHEAD 31-7-26- Fw_ Release of Information 1.eml
- Size 1.5MB
- SHA256 47e8b346fa975c2cacc072e5567aa7915e17bea3fe57e45e4112535bed179848
- MD5 e869c920243b89a3c3a87d855b36aa10
- SHA1 85a60b196175170be0a8e9ac41bd06d58ae18321
- SHA512 98ef1bdeed08fba36e0d71d5d0beb9abb658db8894eae5243fc2b146b4ca284a404b7e447cdab4693beadeda556aa36976596233efe60ff229315622b1f5a64c
- SSDEEP 24576:Zb9dGPL809ytZ+5RBetRdIsagNsQFSfzRmA:Zb641+5RIHNsQGzRmA
- TLSH
  T11E75F1F4DC062D828B205635F42F7E1A5DD42F836AF33289F66C750493F99B8D993928
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  2026.eml
- Size 8KB
- SHA256 97c82e1eaf4073251294e337f846296fcd7137e2117c4b160f2755cd782bdf6b
- MD5 21fa5337b1b49d0cc1795ef747d9268d
- SHA1 578fe042eed40bfba94fa03b53a16c5de74f471d
- SHA512 91f31ccd8d5e58a4234d13baaaf1b3b7e5227fbd06b0a37a847b40385ea822689a2e74c95d875080eda40d4c4ae551e0c20cb17167af51ba478bc7d83694fbf6
- SSDEEP 96:VRVnBRg0RDEj+FzRpRRYv55Da+G+QReRwRRR4YD5wRfz3Rpy0i4nki6uglT4GIzt:pXhdQKlTprzOq/R8XBw2
- TLSH
  T1AF02D8F6D5221B187AC075D80E497C0132A0D6CB4DBBE1E016FB851CA6C66ACA7960EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 1KB
- SHA256 14000e113d1b4fbc2a8b1961bf22544cab6b8bb247caf54aa7d08bbed6c39a44
- MD5 cd7765bf1131f2b3fea66b17ef8bc09c
- SHA1 0f851090a44458b4747a46bc827022a6466c9e01
- SHA512 e54b3a15c590eedcc592bf5d1d7e7daacb85a4bc20f4ed520ea6b5fa38751639f4c0f194d1bdb1e622d2f4c3e818e5d8ca4f992f459434becefe7ca8f300570f
- TLSH
  T1AD2149E781C0DC3D4EB280B8C0015BEBD1D730AD736606D0755795B76B868A083B77C6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 455B
- SHA256 5839cb503f745c9531d5d7b53dc8cb132aca63b2f20f2baef7df949e2c0a56b4
- MD5 13ebc0e8b5de19cdae8f7d56704f4adb
- SHA1 70576ce4e31b9a005329d2a4dee18c21490e6d36
- SHA512 f4f691c08a17b1d4822d301d58b21e28a6a2bd1576e317362d1769b1972681e31aa53b7750304185d976c5945fbc298fc0026246acd13722dd6eb515b62b0cda
- TLSH
  T18FF05CE6A80745F063E161E1040ACEC89253306FDADC0261311C828C0717EABDB4306E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  =?utf-8?B?UHJpdmFjeSBBY3QgUmVxdWVzdCDigJMgQ29zdHMgb2YgU3VwcGx5LnBkZg==?=
- Size 228KB
- SHA256 8314480c15fa11e93cb3f96e63359538c6d4a82bfd173e10851ca03e24cc4c7d
- MD5 67f98437439558bf510e3304ec310c90
- SHA1 d6cf299bcc45d9ea46ef2ed19db1a1b4468cbd74
- SHA512 512bd7468e80db98f34db0dc63cfde01e77c23aa3081d08ae7fa1c44da412040f0732beae5a9fe7e62e0cc72a0a1cde32971413beb6d6de6221d800480e9d3cc
- SSDEEP 6144:8GkxvRs9TxZUwSLOeMYueNkByqrDTaoxP:89xvRs7mLOmZNLqrDT9Z
- TLSH
  T1113412487756F0683C822C7EAB4892D14416F109ABC5596A3B8EC8E72F41DF59CBCB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  image001.jpg
- Size 1KB
- SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
- MD5 c49a619ef88885fa3ec62a18ac89f457
- SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
- SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
- TLSH
  T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  =?utf-8?B?UmU6IEZXOiBQcml2YWN5IEFjdCBSZXF1ZXN0IOKAkyBDb3N0cyBvZiBTdXBw?= =?utf-8?Q?ly.eml?=
- Size 37KB
- SHA256 a558005792a443242fd451eac682fa27d05b13c5bd20afe13efb7a5ed4ae66c1
- MD5 2b3378a06fd4a84a84489cbad582b459
- SHA1 0ade271c4933c56fa890ca34b1a8057252ef4f89
- SHA512 e8f7d150748524aebb8913736e4569fd656195aab8fa1482c445c136a5e393b212d39aea0b8cfbce177bd4c261cf3e5cee3ac38137183027389d52da6f1c1dc5
- SSDEEP 384:kdSj2oR7Tzbri8Ap1NXJWdlTlYPDpJ4E+V6u40rbIxieyNXwIJIlPAKyUtmFBe9Q:k5ohb+DpTClTe7lo8xaVizdaVKm
- TLSH
  T180035D829DD72767DE154F309C191E97B024B74B3E97C8836A7E8BC6F0B9BA205C51C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral13 behavioral14
- Target
  email-html-2.txt
- Size 17KB
- SHA256 e023a589108f40d3fbf0be5850c5443424601725d2b13e690d18b03e5d02fb90
- MD5 74d47baf7572aff0924c7b448c840df6
- SHA1 e89c60f18ab99cc4c53238ad92d34dfb8630da3f
- SHA512 c0979c534be6b46631a8a90dd5fdff3e22a5385165ce5529ec7b5c72f4db05afdb77aa395bfd72d136ba25c98dc544dc385ff8512f8e805c18f77fc0cb6e15cb
- SSDEEP 384:aIf6Zq6UCw0edAvdpzd4EWJc+dJdAdTk0E2Cs2Ie21d2V2Ug2U2qX7e2W22vGVaB:ajkmrmkre
- TLSH
  T168822043E6900D0741F282FFE02B1755B0C1655997136DE3A3E922F7BA9AC746E2B3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  email-plain-1.txt
- Size 5KB
- SHA256 1f542df016504a0475985e43bdfa02bfa569941126f3abe9d034f9f50ed1f9eb
- MD5 f3c033277ff6e8bb838913efdd912554
- SHA1 0965b4177488ead9176448125c7eed823c3f5d72
- SHA512 089fb97504034498669f14c9346de1b179638ad46d5aa38e2daf2a5ff29c558fb58a12cb3ff9004088ecb5edae72793d14969eaff23cafef74d6430960795afe
- SSDEEP 96:AO3KGDtdvO+wv/6heQP+kTJakFOBX7E8ZFyJ26V8QH6F98lue:d6emJ/emkTxFWX7JT6V8j8lD
- TLSH
  T1E4C197CF97871322477242927DA95E9CEB5AC06FFB6A4A50781C835C1B36E24933B1DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  image001.jpg
- Size 1KB
- SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
- MD5 c49a619ef88885fa3ec62a18ac89f457
- SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
- SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
- TLSH
  T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Candid advice before any ERA filing.eml
- Size 109KB
- SHA256 5148389955e9fbde1d9f00abc178acf938f3edd995b13f27aa7ab174d0990eda
- MD5 c56ea8def666aaf4564d2ab22fe448d0
- SHA1 e38b5535546e750ecf071cb1d01b3294f3edebf2
- SHA512 09b3100a139d3ff6e3cd8502d2106e2ca60a484a7116fc87c8223247058da0ce371c3fd6a5e98171232cb08fa52c801f62e983c3f9dcb417402303f8ec83aa96
- SSDEEP 1536:ot8cHhLbz1Yx47DaQ1W3fm/mq/EvM+L9r3l:oewpzS4W3omDvdbl
- TLSH
  T169B32A10ACE62BD3DE990E751CDD7996393A7B9F3452488B9878CB87C45BFB014860EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  email-html-2.txt
- Size 64KB
- SHA256 b5ca6539d7e9d66d292a5efb3ea8563d82bc23a7b52bee2b395a8fa6f073fe2a
- MD5 3e8578a90a65264e631fb529802f0dec
- SHA1 f4fd22a29019813e0a0300e9d6052a9b5220d576
- SHA512 d6baf06cd6c89f5a59f6a8b7f36470d11ac5664043d28445e0041908be4a4f86c94c8f4a49c8441a94037f9cd0b5603f6f5706de32eedaf863cdd6ff835369fa
- SSDEEP 384:qKRkRwFFiDGkFZ+qwSS4jqAY7FDmsRglf2FIZ02C6KcMFkm0FVFXe0GqPFAuvENJ:q3ZmbSe7hpM4JvNun864FNhyflq
- TLSH
  T12A536432F7040286E2FAB2E1E1FE175560A1C708E30365E5A0355B373ACA9965ED36DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  email-plain-1.txt
- Size 13KB
- SHA256 93c3a0f893cc8ce71fe30854c8ec4e63ac783379ac62fabca371d4a23ff34315
- MD5 58308f8a1bec1b36aaf9f9fe4b776455
- SHA1 23fe1d59874f43cfab287c98cb60fb296fb315a9
- SHA512 f2bba8ff521fd781bfbfe6abf6beb56d55825ad623eaf600e09d611f996c37a75892e0c73b8ab46eedadc2e7994307ccb65a023f5822e0e406c98a93401abfb9
- SSDEEP 192:k+nkCFslFLTNSutEY19w9NmPsVz4QuTaj1TVQOaluh0RyFG5ONcYdUfD/hmkEb1a:k+1FslFhJB9whUcaRyoScYGbpzEn+3P
- TLSH
  T17452F75F678B137203734194EA4EA9DAFB19807CF35946707CAC829C2325A66D3379EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  image001.jpg
- Size 1KB
- SHA256 b84ffd9ccb43cacc0e69e048ca72484f3b6d8d888003948d51de693c0514efcc
- MD5 c49a619ef88885fa3ec62a18ac89f457
- SHA1 0fa1ca732b94bff91ff3f84773c049cf93d9cfd6
- SHA512 cb7c3cd83fbd268fc32009b71d1248fc06434e6061d8157414a788c2295e6c337ac99e94201c4ffe56d3fde5043baa2c3a673314bb137f709391ef8fac633600
- TLSH
  T12241D72F5263A3209C665E6F6A0D1373F5CF3B957140364E18E05EC26110CA8B355E68
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Invoice INV-97919 150226.pdf
- Size 57KB
- SHA256 7da6094b930827b3e513275511073b65b36dbcfadba7d17f528eba3d52e24ef2
- MD5 7858260e552b093a857d69b51193016f
- SHA1 b2e143aed2437e05d9e8bd3334233692547b2574
- SHA512 f4aa6aa06519a02306c4a1bc4452bcbdd5e9f84c0a518f1c51a641dacc94a9ba5974478e621bb36592db8de6046a96c68461e3739048959ebb056024c1ef7069
- SSDEEP 1536:m5JSyaWG4gMzErYBO00O8kiHH5QkF0JeosOQJf:mPwFMzErYgo8kpkye7n
- TLSH
  T1AA43CFC8E265DA1CDD11DE7974063B4890BDF0838BCA56B376E8498A44C0EBCBDD46E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  Invoice disputed by JC.pdf
- Size 302KB
- SHA256 1f941b5becb60cc53921f8e969313ee2213569b26bd1aa1182f760d4e492548b
- MD5 fd6db6fda96c23510a942166bfb71870
- SHA1 bf78121f008f1d5df384852264347f40dd76665d
- SHA512 b83afc2465cc044f42413392e1ed7e494bcc1f8eefb9b1fe980040f5d059cd9b9d331f762c835ca5bfb1dfc5873ce6351153e308bf987cdfff8a59199fa68212
- SSDEEP 6144:R+NODnGAdwJp6QqqPp3gPmV3lZOXXCALiGstLTSZLIIjOpo7FYSp:R+EDnGn3qqPlcu1ZiCfGst3SZDOCN
- TLSH
  T1966412F59729489200C3D73693B902DE80D7D2AD82BC6B79757D8D821B80CC31DE5AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32