cf3b832ef141a3328295136e1816aa1de16101d53ae7d0f04b9bfc44a92bd11f

General

Target
07082026_0606_06082026_Rezume.docx.lnk.zip
Size 42KB
Sample260807-gtsdjaycqe
SHA256 cf3b832ef141a3328295136e1816aa1de16101d53ae7d0f04b9bfc44a92bd11f
MD5 7d1eb891f68e45400212bbbe1cacd7d3
SHA1 1f40fd0370cb853feee0d3d7fc7c16b33749ac69
SHA512 774944d366dc125b7f580207414e76cfd8a360a0e5a1c5cd8bac7567e053ad310f792ed1b53a430d60f6dd2186abb363ca8cfaf8ea96fb66e5dac26a3043cf32
SSDEEP 96:dUNiyYT6IYHSuyYT6IoHfUbAZ/UUYT6IHOHyfoHNK:dyYl7uyYloHfIAZ/UUYl9QHNK
TLSH
T16513003036FA0005E6F3EF71BDF4B6D59EABBAB32622416D5481A7094851D40FD2673B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  Rezume.docx.lnk
- Size 7KB
- SHA256 4c21324296d9483cce763c9d8e727e6afb738e0e5e7f3f7997cd8cba4a13b5dd
- MD5 b946a6c6e9d2d3d73bea5c9ee85684c8
- SHA1 2e7acb10242ea00e9e39f8abe2eb36f74a597506
- SHA512 08dfc2439374e61ad224cbe2dc7e35810df42735847634b03e8fab3301d6530267a21e5b2fa4492d6442d2827aa4e8cbe353689c5564534b49638d656cdeffa1
- SSDEEP 24:8d/cNiv0plYaInZuFIjhw1WOHBnTZzs+m9lIlWRZJmM5:8lcNiyYT8FIYHHBtu9lfw
- TLSH
  T1E4F1DC3076F40114F6F3EFB2BCB4F6E48E7BB6B72922452D8441570A4410900EC26B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  Scan_Diplom.pdf.lnk
- Size 16KB
- SHA256 4280493b29c6a5b1ad0426c95383e329a9ab1e97b7e7c6c758cc4590eff245ce
- MD5 829885ba31f37bfad79f61f075ff61dc
- SHA1 00ef22641812af8ee2083d1e2940f1807e4ff703
- SHA512 655c697832d83c624bfb9cef48ccf066e8ccd43198bde5cfd74b09a223102752a8956b692046b371bac6c5c9c4605cef84a242af51f68509b42999976a574c7e
- SSDEEP 24:8d/C7pSlYaInZuFIocb7DBEpmJq7rGvlxPlpYZ+3W6ZJmMI:8lCyYT8FIoMNE+q7C9bAZL
- TLSH
  T135729B2432F61046F0F3EF357EF8B6D55D6BF7A22622516E148193094910D40FD6673B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4
- Target
  Scan_Rezerv.pdf.lnk
- Size 18KB
- SHA256 1919c8c22f2056974b0030ebcef26776490f0b2d8587cf58177c56e894141158
- MD5 29b0a56fe1b1b66e6a0166f24ed89355
- SHA1 9dbc303c8e9475426a00775bf15a6d59ff65562b
- SHA512 cb4a650568d397d79feb0469069ac189afc1f3f1f6e0e6c06e9eafc36f8d55f76dcdf9271cc83424ba8f981ca16fab2130ade28e3969a55ae4d3f29723f85109
- SSDEEP 24:8d/C7pUlYaInZuFIZZAR1WOHflbnTZzs+m9lIlWJZJmMB:8lCUYT8FIZZAjHHhtu9lf4
- TLSH
  T19E82DF317AF60019E1F3EFB1BEB4B6D19D6AB6B72922415D548153494810D04FC2673A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6