6949888348b68d1dcd1aaf6f26ff3231d8f143530219811d4051385c46b7ac45

General

Target
20260803122933.A6E6AB4EFE7E.zip
Size 4.0MB
Sample260803-wv4waade64
SHA256 6949888348b68d1dcd1aaf6f26ff3231d8f143530219811d4051385c46b7ac45
MD5 5c09acb583b979954cdc18a228fdf42e
SHA1 ebd64a55f30346d176ca6a8219b7fb343dd3c754
SHA512 4d92e073fdee9c3ef4fd30f9522c21856194ebc4ae719ae3bc359023d7e072a75be7567f120691c3e3a621e29ccda6cc13874f48b09b769d1f0e9b53586f41d6
SSDEEP 98304:sszpM/GDYEKHKuBQHBjx4MhQU8Qx69M4p7ZQt1z4E23:7lD1KHI2M3569MM0sh3
TLSH
T1A01633EA1D613F6D88D97ACBC9AB6CC0BC4E91DDD09305E0B11EC693A23E3A431D650D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PdfcOrE8.dLL
- Size 3.9MB
- SHA256 f6c7848454a3777d110f40fa319fe86f3a510e91e6e2541a0033c016919c1407
- MD5 423454caf37bb611619817a93c41a453
- SHA1 26f920f44ad855e85c2d5ad71ff631d62b071565
- SHA512 e2dc0fb175f0906053cc5d268b9bf8d6022bd56cd3b255b216719e41fd3ef7573b2eca3f9ab76d4776e6853cc275c0548a80691425bd0bb41d932cf2b1e16aec
- SSDEEP 98304:b2xliJQ4DUrfgJuVUwpZfUCcabgWShAFbyAdEOzutKVlnfSzPyi7:b2xIQTBQabgWShEbyAdzzvVlnfs/
- TLSH
  T18E16D0123D8042F7E42A1370564EB7BDF2BDB7B80BE784C7E6D0E64829724867126D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Vat.N0.20260803122837.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH
  T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4