General
- Target 04082026_1655_14022026_IRS NOTICE 2025.bat.zip
- Size 423KB
- Sample260804-ve652aszet
- SHA256 64385dea15d2fbe3fe7d222e429ba496f4428c59094a1a7c68207d9ddb4f92fc
- MD5 01b9538b16cd2e540a59dd2f14b422d0
- SHA1 1ef02fca61e32f65be67ecff5a72e3d61383cc5f
- SHA512 ac3746d6d03ce34fc9a73186716ca656aa3078de8a44c30aa312eab8334e7318f890a1da2b0ca085cbae140d8dd42a0a59e0d927909a888cbaf6465e0fb0dea4
- SSDEEP 6144:gsgHDRSHEQF9esdHrQyYsA2XMC/PfvcwIJ4Ydb2sfGi80klL+spcfAx5Sw+aS+CS:gsMTQH58aA2XMkXzm1GiZklKfhw+F+CS
- TLSH T1FA94239F07C49B9DD4842239C6225E5BB6C45CC065C6593BEA84FF3893B30163878FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
IRS NOTICE 2025.bat
Resource
win10v2004-20260513-en
10 signatures
300 seconds
Malware Config
Targets
-
- Target IRS NOTICE 2025.bat
- Size 2.6MB
- SHA256 a79af4c702d0ab607cdc438bf9af01203f20a258a4d58948f7ee8dc43153a008
- MD5 36d4f4a10afc5ae9e5de0ac818ce86d9
- SHA1 e9b2bec4622cc09382e3cd314ac084e2b3301a06
- SHA512 ecd57f2ce1faa4b6ff23f29240680700800d777921bf1b87ec3b4207a4d59da302009f7cabd31bbc7ee5b6a561d38221c4555fc37498bfb4161c5cd14227b2c2
- SSDEEP 24576:6LnkYATkxrOLnkYATkxrLuFnRhi+3cVoaP/DKOPjL0x9wUVyZE15F:3swUIZE15F
- TLSH T12CC585A665907D30230EE377AA8AD4A4377232EAB5140F987F56D9CB31F80B750CC6E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1