2ffbb43a3cc95b2f03f01a3588392a001aed9b9fbae97e455d258bf54fd56cff

General

Target
04082026_1543_04082026_Vat.N0.20260803122837.EXE.iso
Size 7.4MB
Sample260804-s6cz6ateja
SHA256 2ffbb43a3cc95b2f03f01a3588392a001aed9b9fbae97e455d258bf54fd56cff
MD5 e59bedad0b5758ad98106603de03f97e
SHA1 9d85827776679e161f4a4894b2f7f7362ce51730
SHA512 decb3b23a7fa5ea9660a200e921227c025a8583a4358ec56b200b9852e266d074dd5d287f1488db44fe72ad0059fd76b49664f88611c5e827b1c6042db997dc0
SSDEEP 196608:62xIQTBQabgWShnbyAdzzvVlnfs/H4+jTxZV1C5bcIx6v/O:Xpobjdnff4/xZVab
TLSH
T17376CF117AC081B7D43613314E5EB77DE2BDBA700BF691C792947E2839306C27935AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PdfcOrE8.dLL
- Size 3.9MB
- SHA256 e4e94604d0c73e1d5e4bd6855f2dd0c91d7e884512aa4eed8b63fa69e2a91391
- MD5 a9155728583966693d656c8745edf44e
- SHA1 ee194d93d1785f1a54b5bcd90db7c1a426bddd20
- SHA512 196356145867893e313a73e7e250fa60c67e1f9466637989ce12e3bcc8b6927f694c45fe1ca1f7fb1cbc1a57605e5265d01a3573355d13dcb87097e55e0d6db8
- SSDEEP 98304:b2xliJQ4DUrfgJuVUwpZfUCcabgWShASbyAdEOzutKVlnfSzPyi7:b2xIQTBQabgWShnbyAdzzvVlnfs/
- TLSH
  T14016D0123D8042F7E42A1370564EB7BDF2BDB7B80BE784C7E6D0E64829724867126D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Vat.N0.20260803122837.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH
  T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4