e7ea833a5d9745f0834a2e66f6edd87a8408a52762e25a745a6943fd234c55a7

Resubmissions

06/08/2026, 00:33

260806-awag6svwfz8

04/08/2026, 23:10

260804-254k6azygw8

Sharing

Copy URL Twitter E-mail

General

Target
Whiteheadgroup.co.nz - NotebookLM.zip
Size 43.8MB
Sample260804-254k6azygw
SHA256 e7ea833a5d9745f0834a2e66f6edd87a8408a52762e25a745a6943fd234c55a7
MD5 c99b6d55da9823ef2e8a8b7a410395b0
SHA1 d425c8b849693bb1fdcc6adbe583c68790521f68
SHA512 b7a73c28755325a1125663e3147f0953b163bc886e33977b397aca28b761e05d6258c24d8b861b6478cfcc982bee7c5407c2a2a43d760818a1350302d56b100e
SSDEEP 786432:Bkr2A6FrtJPw06mc5xHS+62AjIgAsk/fHd3Rdr6UPkbhcd+eswgh2T2uf9DtoE98:BI2AarHo06mcXHl2lO3RdrFkq/auf9pw
TLSH
T138A7339CE8006E18D63D71BC29BE28C173FC9226C50289ADB76E53B18EC77C49675E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Whiteheadgroup.co.nz - NotebookLM.zip
- Size 43.8MB
- SHA256 e7ea833a5d9745f0834a2e66f6edd87a8408a52762e25a745a6943fd234c55a7
- MD5 c99b6d55da9823ef2e8a8b7a410395b0
- SHA1 d425c8b849693bb1fdcc6adbe583c68790521f68
- SHA512 b7a73c28755325a1125663e3147f0953b163bc886e33977b397aca28b761e05d6258c24d8b861b6478cfcc982bee7c5407c2a2a43d760818a1350302d56b100e
- SSDEEP 786432:Bkr2A6FrtJPw06mc5xHS+62AjIgAsk/fHd3Rdr6UPkbhcd+eswgh2T2uf9DtoE98:BI2AarHo06mcXHl2lO3RdrFkq/auf9pw
- TLSH
  T138A7339CE8006E18D63D71BC29BE28C173FC9226C50289ADB76E53B18EC77C49675E4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NotebookLM/Disciplinary Hearing for Serious Misconduct at Gol/Chat History/Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c.html
- Size 72KB
- SHA256 380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371
- MD5 a8f0bfb3885db441150395d294c64a4f
- SHA1 075b1e8091ee60fbcbf2fc2a8d40805e512186ef
- SHA512 3a5840b26c9b4c1736edc74430915af8b873dd2988574514f51a08a5cd6a0b1b47d47e46d0eb2ca1307640be7d54bbcf38a4b8658d81c452cadcd83cb0b2540e
- SSDEEP 1536:kdMozIViKXWZdH47v2oZFWNQmU9WuTUrSybh:k2ozGiKXWLH47p4q97yN
- TLSH
  T1D173A6479329033D0E720A82691D17EF775CE0ECF35612E278DAE278211995247B7EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  NotebookLM/Disciplinary Hearing for Serious Misconduct at Gol/Contested Will and Estate Vandalism/Sources/Contested Will and Estate Vandalism.html
- Size 1KB
- SHA256 f79d6b0e84f223c67481dbd6ef5ab45a2508f2fe03dea967585debe57ef86f16
- MD5 95ef5ea278c5d577f540b7b74377138c
- SHA1 ecdf8f94a5fa2ca27c96045b442820562e4a0044
- SHA512 2ae491075e3541716bc560e75edd60b8a3e1d7c5256c7f4739f7f1d2ff23877f85ed1bc520055d2a65ea6606e94f094c1ea8d21be98515d8eb7dfabacf8f86a2
- TLSH
  T1FA41656FAB4B033A0E76A3A4F50F12C7DB1AC02D62726760888E018C5327D56D6FE2D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  NotebookLM/Malware Analysis Report for Driving Moccasins vs/Malware Analysis Report for Driving Moccasins .json
- Size 240B
- SHA256 e67dcc2e23465c4f0c7b09b717372995623d527579cef50444c7e908c8e44ae6
- MD5 bed171a41a71bea8f12170805c250ca4
- SHA1 46dd2e9832b4bcbcf06292e8335914b4cea66ba7
- SHA512 f75eb62a362ff004b47eb294287ca821dd13dbbe5f0c1d6ea1bd186e485cf68a6906628b555bbbf7b850a6ef8d62c8af95c12d8e2e17514e31f5dc827a042efd
- TLSH
  T1F3D0A571F8650CD31B4D4496557D96C51F0139030504F5175747465C6D0C95D6CF64DD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  NotebookLM/Metadata Analysis for Response to PG PDF/Sources/content_3A_2F_2Feu.faircode.email_2Fattachment.html
- Size 7KB
- SHA256 315abf9ee416ac46431bc83e79b55734e3de3b1b98027779d7a0d45ad7763fe7
- MD5 589ba9c4ef23ba16a5073cfba59c4100
- SHA1 0a65081246704d63f6a3dba8dad69ce19de9f7d8
- SHA512 09c58bd091aa200de59d05d8ff0edf479ae74eaed9e3e6734e33e499a40ea4d39f871a33524373e29ef5463236cb05c75b185503787ebbd1f1a4641a14520158
- SSDEEP 192:RPSNJeO7YfOh0dmNzO3NyDAPCCCCJNAANAANAANAANAANAANAANAANAAdhNzRmA2:J81YfOh0dmNANyDAPCCCCJNAANAANAAw
- TLSH
  T18AF1DD9811D521FE1C11AA1BED3C6D8627F471B15380A91ACB4FCCBF9B856E4F28A343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Rebuttal of Allegations and Notice of Personal.json
- Size 235B
- SHA256 2af6929fbcaa995dd38d7d9756af0ddc8e04bcffe5f24ebedd9d706a9b289c49
- MD5 5a07314d9b8d1d76e1e2cc76afddf2df
- SHA1 f4b343dcf854749d5125eabbc5bebe16d79deb78
- SHA512 dd0e8122a9ab1144bf79cbafe12809533f91030d695b32eafdb6076b835cc74b4f69bc11b58a94d10a9fe3655e32f8f8489a8f4e85a8ea689657cc15a2f53aeb
- TLSH
  T11AD097B835223A0398CC008A46FEC685B840680761002E0462C7802C4F8682E9EF3A48
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/44hf99yxfcshdx.pdf.html
- Size 76KB
- SHA256 0e04c5f5398cd3e08c2f81bae45cf61e6be3ce28f84953b75442d19b07ca8472
- MD5 80442ef2de0ec80c66695503b7bf346b
- SHA1 acdc10b7035738e8e24d2c8c8039e791e9d6d4c5
- SHA512 417de6ab9da513ddcad9096a488cc691a545155211129849d87f0958cb4f7e31a8d459cb698fe91d10b148942bc1814a696bb3fbec72f48875c73d6611e497c5
- SSDEEP 768:EnUAiExOFNjiWbxwKYf9nPMDUNaA/8Ydn7GtKjEyKokv:wUARwFNjiJUAEcJjZKo8
- TLSH
  T10E7354B243E51C8BE68254E8B45ADD833C6FA16EE77A84933D5D02CE10546F5FA28C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/Trust Account Statement.pdf metadata.json
- Size 261B
- SHA256 56f963b4ed627c62952f3154a278bcec91cb569933277542ecf038e9ac0f60b7
- MD5 2e31a09708a1ca90b4d4ea56415602e2
- SHA1 8392ff49f67143c5f6f2a76494846f9803606c1f
- SHA512 8c6d36185f47ee7d762d30d73d5f8aa0c493ed3b3fdaf1e5b848acb7bfbd6bc96b36df60e07e8f32e650e5e7735296a93607a40dbcf43880718e50591f068f30
- TLSH
  T1E8D02E20FA2B3A37C84C1262046C80E3E758864B24882C68F283124C0F8087634AEDBA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  NotebookLM/Rebuttal of Allegations and Notice of Personal Gri/Sources/Will P B Clayton 06-04-2000.pdf.html
- Size 410KB
- SHA256 167e8d568f2db40fe82422d3c7aca1c2b610e9492e0e733104087b89d0cb3a99
- MD5 41e4cc38a13f397d8816a1e447778cb5
- SHA1 1f2aa0766ee355a07fdf7142a76e1089ccf1b209
- SHA512 c4c34975839ad6e984c3c76f29073109b87eb4c4958347dcd3fbf9708e4efb0ec16fd856f9c99be0e35f9aba52d87ab54b79d951aa9d3676df1cfae3eb675059
- SSDEEP 12288:zJVIblWBUK6n7/+id4u8ZZuzALI/N10llJ7dzVV3bQ:zJNBUK6FdGXLIl1eJdVpQ
- TLSH
  T1C894027BCE337F1B6F2984F884005DC06CE468BF11A0966D3F8D9456D0DAE5289EC5AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  NotebookLM/metadata.json
- Size 173B
- SHA256 4f0b174fc9cf433f04c1e76535e937024c957145526e4ebfb343d5a1840b4f32
- MD5 7d667aaab71fecb7f40d5626d65f0a14
- SHA1 1eca8c4837e656059a59ba6b3ae4d3556f83403f
- SHA512 b9d1d125355a40975dfd0cfda52e6e86fc744967523c2e43a706c05ea046407e25a04f35c5b17b29b5f2b123e3cfdce154141224ef1ffaa424b1c1234cd28072
- TLSH
  T126C01220E8511C83568C00515CBA86C13B00780B1A06280A6743898C5E4492A38F75A4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20