d8156341d8f9954c2aef94f707627e540c23e366ed513f7a505daa30c5372ccb

General

Target
Y-S20260728115404.zip
Size 4.5MB
Sample260807-ajgeysda79
SHA256 d8156341d8f9954c2aef94f707627e540c23e366ed513f7a505daa30c5372ccb
MD5 0d2f7369cc07c4c714fbd7f16b22b6c3
SHA1 a5b04b98b0c6bd8d4998f46f477f73dffc209c8b
SHA512 272b9a11ccc69710c496ae61abaa3300252ffb75d5da13993a56de8ff6744cd85cafe5e2849d53e52d14c55ff4c0ef6726583dee553db8f2b7d293e1f71702e6
SSDEEP 98304:1AXf70coCTwe4wjfyPhkCJ40iKlxYWFrTh/BjFzEmsWIxGiA:1AX3fkehuPCCe0OATjREmsWZd
TLSH
T16C2633E61BF54E0BC4166F460CD2F955E0E7BDB087A18EABB0D4029E1135E1EBB49E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  PdFcOrE8.DlL
- Size 5.7MB
- SHA256 5dd8a6058a184c8bb8fd2d8a5b053d58574944c935a4c11ebb8ca520eaae6f35
- MD5 87b4c5f24910e5e9df79ca857dd23d86
- SHA1 bb1b51207119d6f91e591ec29662cff48a8f9945
- SHA512 2102926ac1afcf34f0d7fbcaf18e20a093c7ab59ff8d4fb04f703f0c2de0f0b76f0fe023add1d6d1864ff24da4bd3418abd8c6bd05df81667c15ab390707c3c9
- SSDEEP 98304:ZRuLfVfs8eP6CrXX7u4nyXcezHjs7S8L+bgWaGu:ZRKK8e9tqcezHCGT
- TLSH
  T10F56CF117DD1483BD2DB0B30491EF62872EE97B12F74488BD6DC4A2C6E346A32716E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  VATN0.20260728115218.EXE
- Size 3.5MB
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH
  T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4