52af37cf7751ab8aab08873b0e9b9a431f35c31dc078b0dc0b7843dbdf114c25

General

Target
06082026_1331_05082026_Top Office Sales -2026-.Top Office Sales -2026.vbs.zip
Size 7KB
Sample260806-qsdy7acm8v
SHA256 52af37cf7751ab8aab08873b0e9b9a431f35c31dc078b0dc0b7843dbdf114c25
MD5 22f18281b2a70a25ebba591ac16bf1a0
SHA1 fbff6419cbb07a523a6cae433dadeff996539210
SHA512 96ee68cf45efc24fc449c8fd17a62a5026973fca43731ec49ac3658809d38ea83f37f95f6bbebb6ad6a46539142b81eb0e7711d62ffbf9f5b36fe0393fae38cc
SSDEEP 192:jKgRMNf6sr04cnRLTbUcjd6Ldj3GQ+Oaji:2vNCsr04cnRfpid5qe
TLSH
T17AF18D55DF7EC20CF83BD7B602DC9A0EB231487C80E7E201477F75A9490211222AD5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Top Office Sales -2026/.Top Office Sales -2026.vbs
- Size 63KB
- SHA256 2cf131d7bc1ea872ae5ea25e5c2e18bb1ca43f525c73cc68f71df5145f6a1d69
- MD5 4360dd5d86482135143b18c0c0f48b35
- SHA1 f23cece7f6de8933512db89a71e14fa869c9ad53
- SHA512 88e69d89de5abddff4a7aa46b1bb953a352ab05cd0dcbdd50a690a0fd912c2c79fd8529157d67517e7f2066274be7ea98df6f963046d651bb70f5dcb6f8ed8e6
- SSDEEP 384:f6oeXoeL+/v3f9ER+6EwIEIlLjP0U9yUCG6IeRoAPdGXd+lKiAAP+0q5j96PJ8vo:KJ
- TLSH
  T12553542C09BDF55C93D9E217FAA9F3232D4A4CAFC2A9761726E35C6C61515C088EB0C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Top Office Sales -2026/Top Office Sales -2026.lnk
- Size 2KB
- SHA256 b1c86ed5e5a1c97fb324de638a831e741908d1286ff936f64cd4c148531a0c15
- MD5 551acf62c230b92072e8f152fd56f20d
- SHA1 dd381ef592f04b3efb1acf548035b08d002d6aa0
- SHA512 6b1bdc0cf10861e2ba3e030ea155ba204614c2d3dcfcdc1e1bcf43b34f86248187dfe6a2550dbd14253157a093235eeb5a195264ff207a27c5c825bb3ecc7c63
- TLSH
  T11951344265D98631E2F69D7308B391204A3ABD85DC67935E2084070C28F3918D839FB7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4