6d459830f69a25b4647288e35eaad9d494ddca369ed776592c171c105bd17d4f

Sharing

Copy URL Twitter E-mail

General

Target
0DocuFM79O_FFOXK_yrxgccORQGC.iso
Size 9.3MB
Sample260808-ake9aaag24
SHA256 6d459830f69a25b4647288e35eaad9d494ddca369ed776592c171c105bd17d4f
MD5 2b42b3a1492b5a2120729aa9270040d3
SHA1 a73cf2f6ca0459b298b0afef912b17faebe637a1
SHA512 f7caafcb9fa71dabc4c322577315403754c0137d7b992c5a36f7820f812ea16fd2c194d9a6360485f42453afc669b4c47db7bdf0f83b3875b41842b6b839eade
SSDEEP 49152:vuVsuDDngy/dvHw3tvpGpWzxwymSt7pgVdY72XyKO/TrP8S+5kHXi/NoqPGJYTz5:
TLSH
T19AA63331AE955C2BC564B336F02F2B362F3F5907458CB356659CA17233BB786422E86C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _Vrfc170749TTSEQ_7105-bbjtb.Serv.vbs
- Size 8.8MB
- SHA256 1debdf6c9ad90caca19643b53030e347cff8ac4e02cfbda8d39cc4d409bd83cc
- MD5 66579ecdb13c85a7cfcf2b787e349165
- SHA1 795958df0d757e5d111e3a4c50ef65db600dbff3
- SHA512 17923d8aa6215853d6668f4e099b6459d77f2fb9769f044493c24a48577f7500989e0bbf509e514982e5b6606d4c5825fa5f78364f3da7e2032e057bec9ff43e
- SSDEEP 49152:2uVsuDDngy/dvHw3tvpGpWzxwymSt7pgVdY72XyKO/TrP8S+5kHXi/NoqPGJYTzs:q
- TLSH
  T1E5963331AEA95D3F0674C33AF02F2F362F7D5D07854DD36685D4B152329B686822F8A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/arexn2.xml
- Size 37KB
- SHA256 e4792f1204c8c7d91988a4664fac0cb8dedbdd5f92f704dd3562c57f20c8fecc
- MD5 58b1e6b6e1ce8bdd8258ac4130f02cdf
- SHA1 da683c1693a634ff31729ed39a3789f6157db50a
- SHA512 a380d6474c20ba65a8ff45865d8ce681b8a35936f917ea2e9e49c8c58b02ef89a87ada78b467fb231d60c6471faac5dad154e1c0d1bf0a1cb5270c21648e2fcc
- SSDEEP 384:LD5yB+ftE/KWZdUt7tNmeYCMhou+2vO4T2erZIEAl9B9N/EDHZub0nuw9jas1mP/:LthNqRhpO4T2eyXED5uAnl9meNTLJM
- TLSH
  T1E6034A0376919036E8960B3064B4D5725E3B75816EF4808F276882BE6FB27D05FBC39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/gmibpo1.xml
- Size 40KB
- SHA256 329d2ae45f5f617899f366e6fe3a5ed649242415ca5ad47d9b641ec9831a7d2b
- MD5 8fe7411ec894be1cfd91b165155ff72a
- SHA1 55453dbe13d91f55e1a40fa25663d1f16ecc6d48
- SHA512 7fd0abcae5f0cddecd8a17625b9e80787c26e60c2414b3448603a953e32e2d7537d910b0e66f7e45b45525457e5d113a5f44136532e6543f3df266a17b4fd6bd
- SSDEEP 384:yixv7hdVexaDywGfJssxNyEIYi2mL4/y8RLVHLXbZmt/:R9NM1uYiDLk5/fm/
- TLSH
  T15F134F714A50CDDCEB22FE32A24E0D3E5663E6C055E473532098A470AAB9352DB5EF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ~/kgeap/iodrsi/ynrp/ahhah/ryylp2.pdf
- Size 66KB
- SHA256 936d01473a6c7f311e785caa002eb3ae7ad762209b75ccfbcb48d93bf3d3a3db
- MD5 64071ca7bad7e1347c14b86c820b69c9
- SHA1 dcfc9411e189c16f9c62af3453d156a6b35b3934
- SHA512 6220a8dc812c46115da42408854655bcc0d7096233bdc0427c2876a4e2b6c746dd4a774d70505d5520a6248f4c632effa95b18c611889c98a604a180c6944d06
- SSDEEP 1536:eyUqg6i8nMs7vDTyqQTplW7JAyTFOw/9+/xgVF0pn8XeHKS7H:j+Ls8lWNd/wxqmpnLHLT
- TLSH
  T14263F1507E2DFB70D194DBF90BA62D53A65E386706DCBB82056C800BAA11F4DB489B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/kgeap/iodrsi/ynrp/ahhah/ytucl1.pdf
- Size 30KB
- SHA256 ff72cd03e0c3d3bec32f3d9d417d9df229e050e136b2361356b55426599ce25e
- MD5 b24fe88ff3e2360ffdfa0363b3b596a9
- SHA1 8fd4b04043d1a73b7440c78d9076cb0cbef31f5b
- SHA512 456ff104101567efc9b7d6befc9b77f8e0f638a943b7b938b237c629e60f3db432bc5cdced5482df6daed757b8cea9db7b087d31d7ae54b27d4a09c0e1967434
- SSDEEP 384:zHkou43a4Byyu5f0bW6EIy4jrG70ClGNNGmuGkvJ9dmUWMNv5itbFoIdcV8fXoQZ:kqm14jq70RNkGwJI
- TLSH
  T1FBD2820DF245B9A0D41147E15F383679657F73286CCA6A905DA3C72BEA018EB3B7CC82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10