912a7ff8c57efab5a6e8140ffe6e1fa175df9cc6e3116b0e682e3cdc370b6b7f

Sharing

Copy URL Twitter E-mail

General

Target
_RECIBO-JUFO0398_87209ZIGOX.iso
Size 5.1MB
Sample260804-zz4mvsha64
SHA256 912a7ff8c57efab5a6e8140ffe6e1fa175df9cc6e3116b0e682e3cdc370b6b7f
MD5 60f5ede56308f5b70f5f5fbc0024bdae
SHA1 478e111300cc2f968672e848ae7929cea526d215
SHA512 6f76ed939d67d4b3a8fa014b8ba3088593387601169c13a9e98863258e74aa071fa8ed8f75f2a5af7af2449d62924d416fc2929ba9873a522884d1302c896335
SSDEEP 49152:TRjikZgBPkZtSAs64riLezkogay+QenoTKojAstw8bOvGL5nV6V4:fVE
TLSH
T18A462333A6056C2EC4607375B43F7E3A2E3F67175488B2915C5CD23667B2BC29A6F884
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _28464Valid-9157341072_ECJOSXInstZGQB.vbs
- Size 4.4MB
- SHA256 a1e5ce2db11d6a6b14026b20660743950ae34ef5ded597e501918dafaf068b10
- MD5 063a869df289a005e9746baeeac3e9b2
- SHA1 53a78c2dc639dbdc9b9b090579384f4174ca65fc
- SHA512 9b327f43921a5588fab01483fd1100e120177264079dc6f54645160478ab2abff3a7892153a28c17776b148676da1c99a8345bfc7fb61c7c94bb46c9209c7531
- SSDEEP 49152:/RjikZgBPkZtSAs64riLezkogay+QenoTKojAstw8bOvGL5f:L
- TLSH
  T13E2633335B7A2D2F09B0472EF07F3F367E6D4E53810CE256898CE25935CBA8186A7558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/bruucl10.pdf
- Size 30KB
- SHA256 17c3619e5f7357ce3dde625156f3a1018b8076a0a7ec2223f063e833a9a06bed
- MD5 1376e75b3d960aea30d72df71a5bbf3d
- SHA1 c3b70e06215bfb413def286c2463601b008a667f
- SHA512 3d42c78ca2d23d2dabca98624acbf0473b96b94dc0a666deae35e1ec63853e14cad29ead764a6ae49fea2c39b98104adf434294043d27a54a59a2562d5619dc4
- SSDEEP 384:DukPnfI16U+DX0aK3pTNqXFujccZKV+KEfNGmuGkvJ9m2Eto/emalUSAOMbWrKXI:9GpAuQWO6NkGwJW
- TLSH
  T1CCE2820CF245BA90D46147E56F387639657F732868CA5B905DA3C32BEA018EB3B7DC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/cgxio2.pdf
- Size 30KB
- SHA256 de5ade4ecf9819821c674f4fe58943cc3a1dd00170b201b573e8479962d81a44
- MD5 5fcb8c60c9c879863df43a93e6d23758
- SHA1 773617814dc2cc7165fd7aa7c55bf2abd04e7260
- SHA512 2c108abbb0e42c273612db8c2932d140cc4cdd193baf4a3a4da1ab5188435437a609275ae27dac2b5070d5e712cb2aba387ad47172bdf031a77a7178a16ac06d
- SSDEEP 384:/Hko9ImbiHC9LmF0b5rHjTubBJ6YpCxcE0w6x+yQdNNGmuGkvJ9dmUWMNv547+Fk:LiS0xbBAuCxczw6xJQLNkGwJc
- TLSH
  T106E2830CF245FA90D01187E56F387679657F732968CA1A909DA3C72BE6019EB3B7CC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/eeaelz6.pdf
- Size 37KB
- SHA256 c1736c0e97cc1adc61a56d56a133e2d64b63c4621f71039e5fcea6b082ab68ea
- MD5 d3ee7812be0cebe8bed4d16c04117029
- SHA1 559ae1c72a5688d5098fc32bbeedcbb0f646ddf7
- SHA512 2ecb1587cb82f412ac3a5debf51a3257ef8adbede7988b2f584a4507c66eaad56eba4e5a74e9ea26afaa09e791554fca26f3c409e1f56010d84af4b964c63ff2
- SSDEEP 768:b5QMbo0irYoFD/2i3BjdqCP2bTgrnsbS2JM17K8uh9VN2+iBmYmr:1QMMHNd3Bj5P2/insTCK8ahjr
- TLSH
  T11E039D138E06954DC94A9696BEAB7C2D8B1E77377AC47CC63C2C0E825B40C80ED5F497
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/fqqi1.pdf
- Size 24KB
- SHA256 50acc09a144f3858cebe79d2ec1be67c0eb50ee09408fdef69b94cf601e163f4
- MD5 45fc91f31e62900d238fb056e8082321
- SHA1 613d563d263100b2203ba250d3e8652dd2fe4c5a
- SHA512 29c5605bcc41747175e649ae531bf90af84dead26053a0ce6dbed1d6a2440d9ea8bcf05f0d15af70a79828aafde95fbd70aee2d7d49282dbd1f1323872f94a36
- SSDEEP 384:s0RqLiQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLCa:T8L5DCpPm38e6jcTJF4p946lPm
- TLSH
  T1E4B2BF834E464D6BE8F18740BF03FF0E6B5B7A88744B77D710A2A8C67B14AC15C1A22D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/lxyfnz5.pdf
- Size 25KB
- SHA256 a71b2b1a3dddbc7cac66792e66d364525410887d53a2e459d2c8548b1c4b59cf
- MD5 c02d8fe60889d077091f6088d0c42bb7
- SHA1 36934426d7799e7dd2fd821dbaf201a8cae54abd
- SHA512 e1e0f4eba4f483abf94ba55358b76b23cbf495a4c5cf8e676fca714957d715e518e89787bd8f63f6ac419e561f8501f48f14076b1fe6094bc92329548ad5b35f
- SSDEEP 768:9eQLwhBhtIurNjKSXD4EDaa2dAXiqKIA+hO:4QLyBoqNFbaa2dge+w
- TLSH
  T175C2AD0CA243D4249B5BB7C6BF5E16A26088B31F819C88795D3C8D974967EB0F11F5C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/nzcz7.pdf
- Size 1KB
- SHA256 b7744303249a322c3bdf94c5b16057d156c2a1cadd0ada563c39c325d35603b2
- MD5 c3e51622b819d2ae3e850212bfa8c33d
- SHA1 f90ff712ddcda07e9cb1b3cbaa9358f2451304b4
- SHA512 8e613536738e2907a5386e2e61f6d791e9cb01edde2170c25a1db0bc49f29ab9ac2995ea0a257c2411ec67402c13f6c395b5a8fb8606a358aea1a0637034bc39
- TLSH
  T1AE418418A9D89CDCF4B385517F1E38C7A43DB10326E8A8C1126DC20F488AFD9BE63607
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/opuaf4.pdf
- Size 24KB
- SHA256 134ae5f08ee3bc450bd8aa6d7a3bfdafeec4a341fcc81e83d6430eacb71acc0a
- MD5 e8ee5f06c3164494aed226750e2a4ce8
- SHA1 650f192c9e49b3a6b6d2f17f6a78eaa91708d1da
- SHA512 82e1b87a64c3c592eb6a2242918c719fcf8b9f8fd05897bf6360dc115ba1090613ffaf423408d2da973f181b2ea2801a06fb63aeb2ecebfb5eb2008a89261099
- SSDEEP 384:cGsmDQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLRV:wmMDCpPm38e6jcTJF4p946lPK
- TLSH
  T1C6B2BF434D458D67D9F19B51BF03EF0E2B9A7E98714B37D710A2A8CA3B24AC25C4A21D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/povmv9.pdf
- Size 26KB
- SHA256 ad1274c77e314cf872c13275c69a9b4b41542ddfa7e923391769a1dedc68460c
- MD5 230ca2433e9a7548ef327af06df4b198
- SHA1 61c94025b9036d1c836605cc7ede7b0e0ffe5e4c
- SHA512 186d991e5a85c4a3cc3bd85c3b7319e06faba50d767b991cf23b62a0129153ee17f228d0a872a576092eaa0292a74cc65715762d836bfab08e7f10deb6a5942f
- SSDEEP 768:6FX4GftQaVBJWDmSncBR6GKsEfHBY26QeKf6iqKIA+hB:6FXbjBwAbIfhqQeDe+/
- TLSH
  T123C2AE18644BC550A7A752DABF5EB8E7A08CD34F20989CB25D3C8C958ECBFD4E42D1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/sopdv8.pdf
- Size 37KB
- SHA256 f6c20d80ac3d84183942ef81df6303179e857170c6dd98e3a826b8d273ea230a
- MD5 e612fad48560de720f78648b001a8c21
- SHA1 06070fc3c2bc1060f03922c13536c5dcc722075d
- SHA512 d8f1c98708e9b584d0ef3a8d7993547fd471d252918dd67cf973a681e6ce4b9d1af8c3662e619e1b4fe1060c94bcddedf67158ead27ab8c2a6b49bff0d368d74
- SSDEEP 768:J5q58ro0irYoFD/2i3BjdqCP2Qrvh6glaX4VJ1GJM17K8uh9VN25WJ43TmYY1:J5A8cHNd3Bj5P2IQgMQJ1ECK8aGO1
- TLSH
  T19203AE178902924DD88995D6BFAE781D9B1E333A79C4B8D63C7D0EC39F108A4EC5B067
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/exvbz/apdg/lbjeh/hlkjt/xidxl3.pdf
- Size 30KB
- SHA256 b47113beebc9f6016cb68b3b99c19ae37503dbfe91d783655faac3b6260362af
- MD5 41e71b077ea3d59bcb5f2813a055fd7c
- SHA1 4a90bd570faaaffaac40463fdadbe0d5f5714b86
- SHA512 cc4a8c4ee0efce7ba44da9608173f87aa292f7fbaa001b40f2d12b0442b1df28e5263090c8293a2bbade1daa29203b5aaa22f3c4bd16ce4cf804ee342d61b8c2
- SSDEEP 384:HoHkod7p44/Ez3XWb0bWdpTFqziADFdwbSnRkz0+NNGmuGkvJ9dmUWMNv5itbFon:HG7b/Ez2bdOiZb+54NkGwJV
- TLSH
  T1B1E2940DF246FA90D45147E52F397579653F732968CA1A908DA2C32BE6019FB3B7CC82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/vcuhi1.xml
- Size 21KB
- SHA256 1d1636ff8d193f883b181efac6d7d5404d8dc1a51027f318f82e1437699d68db
- MD5 9c6571a544b026eda6bfd3d76d91949b
- SHA1 af4a8df59d302ad80e18b044aeed80162ba1019d
- SHA512 eab0211d2ce863babaddd568f09c15b1c564a2df4d98b3925a1a72238cb40e17538f9b2b70adb6021414ac7514a567539a80c99940dccbb18eded5bd80141c03
- SSDEEP 384:HMjVatFafETT5bw/HcqS8QTAm+d6NSIYisgTty8RbmL4nNyBxd:A0db/2FMN/YiJB5ALNd
- TLSH
  T1BBA27E694BA86537CDAB0F3078D1D2124BBA77893EA2D1C7700CC4465F833965AD73EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ~/xxzin2.xml
- Size 41KB
- SHA256 7d750be30b5d239e62585ce223016dbf2c24dccd6c31b1c4737e03936c755c2e
- MD5 8790abac4c4b63b922ba21ad5004884a
- SHA1 11f2475143578eecbbfd5865501c7201c4d12eda
- SHA512 ed2f4ea3df5b956aeaa79b364bb627acc372b7680dbde9f351611b80d746f62450e11006f81875f48f5d1575ef5c4a1e3b12cee76fd8f95e4ca6fc3c66a5cd56
- SSDEEP 384:6kOtkCLu+JGRNyEIYi2mL4/y8RLVHFwaeE5:fOtkCLdvYiDLk5/aBa
- TLSH
  T1CE132E720948DD3CE7137A30D59ACE3F916711D29CC4736A21A4A93186B0722AB5FEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26