Overview

overview

9

Static

static

3

_Serie-719...hk.vbs

windows10-2004-x64

9

_Serie-719...hk.vbs

windows11-ltsc_2024-x64

9

~/abftq2.dll

windows10-2004-x64

3

~/abftq2.dll

windows11-ltsc_2024-x64

3

~/necg1.dll

windows10-2004-x64

1

~/necg1.dll

windows11-ltsc_2024-x64

1

~/sbvsd/cb...k2.pdf

windows10-2004-x64

3

~/sbvsd/cb...k2.pdf

windows11-ltsc_2024-x64

3

~/sbvsd/cb...z1.pdf

windows10-2004-x64

3

~/sbvsd/cb...z1.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    0Tramxygit_pqygaj.523677ZJSPJ.iso
  • Size 5.3MB
  • Sample260807-ph3zwsdp7w
  • SHA256 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionlinkpdfpersistenceransomwarespyware

Malware Config

Targets

    • Target
      _Serie-71963-CMBKJScktoqe.FFIOMProcpxlhk.vbs
    • Size 4.8MB
    • SHA256 c011a552081dead8ee59da97d6c7004c179a58fcfe2fdfa11967b6502bc295b9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecutionpersistenceransomware

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral1behavioral2
    • Target
      ~/abftq2.xml
    • Size 13KB
    • SHA256 028c2b444ec7abddb13448c13317d1e26d7a644c65e2371d9115e1b9eff96daa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      ~/necg1.xml
    • Size 21KB
    • SHA256 1d1636ff8d193f883b181efac6d7d5404d8dc1a51027f318f82e1437699d68db
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      ~/sbvsd/cbgyxj/lnrdl/picmsk/isdok2.pdf
    • Size 24KB
    • SHA256 dcd115f95c3bd1ae2ee4479c9dcaf96391f900845d21844e546bc2e3b1c469f5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral7behavioral8
    • Target
      ~/sbvsd/cbgyxj/lnrdl/picmsk/pahabz1.pdf
    • Size 37KB
    • SHA256 cd815bfbc4c8d41909268c43d76b4a47cf041004faac32fc2d8de24edceb0685
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks