fed8dc910f01c6fae8c6d7f68a3fb233ea02e979174a643b6fe8ad961770b622

Sharing

Copy URL Twitter E-mail

General

Target
07082026_0603_05082026__tjmmilVDOHULTram-512S_CEIHOLoad.vbs.iso
Size 5.5MB
Sample260807-gr8bzagr4s
SHA256 fed8dc910f01c6fae8c6d7f68a3fb233ea02e979174a643b6fe8ad961770b622
MD5 e2e19c505831ecce89f5026e475f1bf6
SHA1 ea4fd4fca0c3863fe6060c59fae5b852eebcd49b
SHA512 c5fec62a9e402491798f9fe8bb1b15fc1ba35ac8be0b44b8a0bbf51e0bb8d2073af0b5121bb8f14b8c26dfb72720f11b8316aa7f78628165870222f5abe0044f
SSDEEP 49152:U3lbBfYoJdcXAI4B1FQ9ybTvckgONrzcgVj35ZKaY/0CY2q2h+XpuS1R8IGv:WGv
TLSH
T1414623336A520C5ECAB0B335B11B19327F3F511346CCB2D6B98C607627BBB85E52B859
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _tjmmilVDOHULTram-512S_CEIHOLoad.vbs
- Size 4.9MB
- SHA256 0eb83eb4ddabe8eae1acc46739eca5376fb4187d481ddc7a21dd7bc45b30ef88
- MD5 c2fb07006b5fb10bff263c94a3697d01
- SHA1 8d97d5a18f4678cf57967ab92011c2037b4a2da8
- SHA512 570c9aa2ddf1e903cdf197a279e664f51c3bce30b1ee77219e72ea69426ee6706fa0274c147d20cc032015e52cb801e0ee025bb365701fa352f10efc77922a74
- SSDEEP 49152:E3lbBfYoJdcXAI4B1FQ9ybTvckgONrzcgVj35ZKaY/0CY2q2h+XpuS1R+:B
- TLSH
  T1413623337F661C5B0AB0C736B01F1D327E7E44134A8DD2998AC8B16A39DF789953B858
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/ckzy/gltpl/kvugan/jozv/ayzbq6.pdf
- Size 31KB
- SHA256 e1680c8496a702d81fd59733137d234cccb90582f1683ae6faec50637f905d62
- MD5 7fbb2cbef0ace6cf5b3543b59f1a0240
- SHA1 e9f851af9a15ead29ec7690e43ae7ed26600dee0
- SHA512 75bdb0e0c9d857b0a1478c64d1f032ce84682d2a9100b94b47ea5fd317a35049e010b5cc33646ad16b82047df2fd60b721abecb79f4719ee2728e70e4f9e02de
- SSDEEP 768:+C4gGOdpZa7jSfFRQZiXn8Q7OZeHHGzQqKIAqJd:+C5GKZYjKwA7OZenyUq3
- TLSH
  T145E2AE2E3107C8619B0753D3BB1D1AD2EA69F30F24A899B65E2C8D169947FF0F4091E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ~/ckzy/gltpl/kvugan/jozv/bgmji8.pdf
- Size 51KB
- SHA256 3de284d8ba70a240a35f1b03e9c192df2c05dbce14a9fda31c34616a7f6aac0d
- MD5 32fe5c5d5c738205376840d074b25602
- SHA1 cbe40e7177b18b9ba4052694971467e16c3080e5
- SHA512 00cb8eb8a3fc97e60e0263850916e3e30f89996bb2e1c53845d830a5e3cf118eb24d65b5f9626452167387d700d0776d141d7aa97b04dbeb9675e43a01eca491
- SSDEEP 1536:ezfbYC1qXlT3Q2hdm2/hFCPW1Zqfe96gUbDsVO:0sY4RQApUP8ZqfesgiDsQ
- TLSH
  T19A33F1090A987BCC98B365530F10FA95939E73327CD805962DBE599B274BEA8F4031F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/ckzy/gltpl/kvugan/jozv/hjzye10.pdf
- Size 23KB
- SHA256 01cfa7c1e6872840bb95bd703a59a05ed25fe2c98300fe1bb2c8fe903755a8f9
- MD5 d92b5722c83d84bdb1b36f263a130394
- SHA1 35442c44cd242f61d3a2040e4b3c075690924ed4
- SHA512 3bec370e73a89472bfe31c8c9e7a54d081f9522474b9df8c0cfe414dcda1ad5e7b663ab59795c78739dcaaf18c7c34c62046300fdf4f0fa1dd9bcc70bdc398c4
- SSDEEP 384:tG5MTZ375dEiLwayYrUaXsWBd320X23EmSn79hX1+++y6N6i5FH68Hh/8OWAv3Ga:tG5M137PL8ayYDpBdG0XMA0Q6z5Jh/88
- TLSH
  T152B25A236A094FD3F500D390BF575D922FDA2209A9C579F860E25ECB5B40F721C4EA2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/ckzy/gltpl/kvugan/jozv/ingmdj7.pdf
- Size 1KB
- SHA256 345ff2c09a8513c003b3aa593aacf9ae1e5b9afe61ebcbd24a8cae038f3c2c98
- MD5 8788cd8f2baf36df3f219c6938fd80c6
- SHA1 eda4eea47b2ba2181f9aa30bf351afbdddfb4167
- SHA512 382d5e6636d3a3e348a997629416aa82b8d8c533f5ce1af3de163d8982a372e79ae128e9b8e9cd05dfa5ff8756441ceb88310bbecb9f87da1353ee3c4b725ce7
- TLSH
  T1613142558DC85CDCE8A24541AF1ABCC7A57D721311C858C210ADC24F808AFC6BDA3717
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ~/ckzy/gltpl/kvugan/jozv/mzeejp5.pdf
- Size 38KB
- SHA256 fb83dc5c94b5356bbf08a5c3dc9efa6d8812b270132151368d4889f4d926e6da
- MD5 617d685270333d15dc6396c6fbc137af
- SHA1 83284779920af6efdfc446c93cd311c2e61c38f0
- SHA512 5e0fb70babc5bd019665e61bb09dc33a56bea963703ed8d94568b89b2cbb1f7ab28a51954dac4ec263ac89f4023e3c55cfbed488147eb7e9c36f5cc57ea363f9
- SSDEEP 768:L6IlCJijP4KMByHhpNEOcpzI0iZGIqwFxMO1DdUD3mxDYvz4VdmfiIvftKu//31v:L6IygwK9BpNOzrGMmxDMz4V2vfvPFuQl
- TLSH
  T13403E1B06231B809EAD7675DBFA13D49458E3A42CDD128C3D8618AFF7574AD39862EC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/ckzy/gltpl/kvugan/jozv/qbuv2.pdf
- Size 37KB
- SHA256 cd815bfbc4c8d41909268c43d76b4a47cf041004faac32fc2d8de24edceb0685
- MD5 73697ef5f26f094fa1e86c7f7b61f933
- SHA1 749045ba2138dc277f3b7c45d41697b0efaf48f1
- SHA512 28edeebbfeccbacaf9e353a99b77b688e0fddd2abf9be0e48641063545434a6047dce827fbf1dfbd2bca7791225c0c472dcc1c7ee9b6994300f18fe0793d50d8
- SSDEEP 768:JRRTo0irYoFD/2i3BjdqCP2tFi5M17e8uh9VN2ZWJ4325hCYs9:TKHNd3Bj5P2tGCe8aOj9
- TLSH
  T18C03AD174E02958DD49595D2BEAF786C8B0EB73A79C878CA3C2C0D839F40898EC5F563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/ckzy/gltpl/kvugan/jozv/qgrtme4.pdf
- Size 1KB
- SHA256 d42b489af7b86727b04366eeba9e55bacf3840ffbb083e933f10d8fddc8347f8
- MD5 35d3f67356b24d33c0b0059205c265c0
- SHA1 4b67a32723b6c9635b985c2b82e1051963e4a103
- SHA512 e5a13f78946d8a7261396753bbcabac17d0678b89d37e333d0fe3595c5058050c552c06fac89eb69ce110702ed4358680df5df1c76cb8b396ba19e406de22790
- TLSH
  T1AA416654A5C80CCCE5A6CA52BB2EB4D3A97DB14351E8A8D1117C834F8189F95AD53A07
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/ckzy/gltpl/kvugan/jozv/rnbny9.pdf
- Size 21KB
- SHA256 0893250096e4e2eace96e4a1605b2d13348770a0339a7a30598a967df5e5ba8e
- MD5 1a0dcafda9cd9664df53da25d8b0e2c7
- SHA1 27a62e71dcdddf670411f5f433b23b660ec70c85
- SHA512 b08f22f0c79e6969fc1d4fb30aca30adda00450fa760cf19c85b3c453cacd44660284437bbaa4fa80316b0d40f3f8f22d95f3cc245a38d55ea0d900f81421810
- SSDEEP 384:szMb0ccsPH3VpFdH9G5bBxJYfDx2RbH1EGRAzyw6N7V2lCIas/xnOh3q4q:JAiXVpFeyabH1CzRcQwIdN
- TLSH
  T160A2656E2763C998D8152B8DEA9467869334333617404F31FBAD2604D7C4F17BD5E8CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/ckzy/gltpl/kvugan/jozv/toyvpa3.pdf
- Size 25KB
- SHA256 d16e612684acdb0139b14395d8a2063f3fb3cf72289e0b18c9874391c00d741e
- MD5 c2c20eac60f8479ce8eb4139455229b8
- SHA1 4eeb8017bd96910f7cd2150485b5d9d96316b2e3
- SHA512 cf3403bb2d779905e3680a94b130ec8b14f6abf6f2975c394db0de4ee1158fb1e6abab717c1c9adb654c19bbb7e0f17acb0a2d41af0d78f8d816737e70a57bd1
- SSDEEP 768:dnncRIovlDW36Agbp66UZPIQiqKIA+hNu:dcOKi36AgbE6aPte+G
- TLSH
  T183C28D286047E060AF7363D9BF1EECA19159A34F5198DA723D6C5C429A53FF5F20D2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/ckzy/gltpl/kvugan/jozv/znglyy1.pdf
- Size 12KB
- SHA256 0e65316295a1d7edc7ff02ee398cb972e7e59b3c3ec6b319313683aeee889cdd
- MD5 4c079a927ddd3f869ce13c1c3ac82390
- SHA1 54bbe0f62daa71ba67922c4cb3379cc878cc343d
- SHA512 15a378c7fae7e28c06333369b4c2f75bc54cbd13bd0b709285c3539a1aff1fbf0635496f71ad6cdbe75e91503edb95b9e0fec13e0f3f1a8c94f9c088242067e4
- SSDEEP 384:4WUf0b0S/EJv679LRa/tpOdNG0qLLx2OU:NmgEJv679LktmG0q/x/U
- TLSH
  T16B429DB0CDD57C2EE85B2C50897D3D29419EF19281CCEAC13BE659CAC618A14A5A1FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/qrkpc1.xml
- Size 39KB
- SHA256 14d0aa191aca3089782d36f62d720bacfd486199b87e0641fcb24dc1e800e34f
- MD5 38ede3907f545b2c91f0cb4f9a04289a
- SHA1 b6f32ccb76a3ba20cb8f9e0ef0c364228fbbfd03
- SHA512 8b8446401ad45ee19b858c2bb0da0e8de32179554e68024c6aee491207f5f5a4d937434fd5fe3421f24f6695cd54d533c6e6231242a5dfb75219ed38a59cd3ac
- SSDEEP 384:mb3EHj0FgWGNyEIYi2mL4/y8RLVHKphXmcy:E3ED0FgWLYiDLk5/y2cy
- TLSH
  T16303A5B666804D0DFBB37A7050946D3E1A27B4D055D1BB8121C0B03ADA70346AB6FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  ~/ydnfjo2.xml
- Size 27KB
- SHA256 b91918ed7cf18c93b363720fbaee021485f8f1d465e9549421d94c3f0e9a50ee
- MD5 3c8d142236efd75de86217b062386735
- SHA1 ae6ca65566bf3dcde0d72b575f32538ccb9002ac
- SHA512 28252affb566abd1e18b851a9cad229c17c8cfa12eea22bb6977477a319051e19edbdfdda9d0cc6159de0c8d3b9f5b310232612393342055d6eb0b6f4bf33fa9
- SSDEEP 768:S0CUtbxDLUjCdDAnsb6yxSEONBgVqBSLJW:KUtb9hdDAeOkFY
- TLSH
  T1EBD2D8476910513AF8D749B2C9FDD429ABBEE6901F4420E3E2D4895E4F66BF23E3110B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26