General
- Target 06082026_0837_05082026_Vat_N0.20260805114644.EXE.iso
- Size 7.2MB
- Sample260806-kjge3agg23
- SHA256 ed9a6f9a87420efbc97c4ba006c6204e8e22db0810958d34ed2657fe6b414c40
Score
10/10
Malware Config
Targets
-
- Target Vat_N0.20260805114644.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
Score10/10-
Detects Coffloader
-
Family: Coffloader
Coffloader is an open-source beacon loader written in C.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Drops file in System32 directory
-
- Target pdfCORE8.dlL
- Size 3.7MB
- SHA256 5b2e7d59a3e4490d50053c01642277c5e906f0ba792a8e3ad4cc6e29b425acd5
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1