fffa5be744fc2315cdec4636a6c098c31ca40794a902883362badf0ac3f0c5bd

Sharing

Copy URL Twitter E-mail

General

Target
0Tramxrsonf_lmay.66772EFFN.iso
Size 5.4MB
Sample260808-g28eqa1hlb
SHA256 fffa5be744fc2315cdec4636a6c098c31ca40794a902883362badf0ac3f0c5bd
MD5 f291c9311c17d8da82db7d3de027218c
SHA1 0931356d46971b3d0982a40d3c862ba6bee95f56
SHA512 256ce3af3c91fae8056b9ab4fffc198fa90c689174e0fb914b45377ef4615cb4b680506af660c37dbe2bb9c84ff5c59f1f9bcdd38e15a63607f3f2b23a8d4503
SSDEEP 49152:OynvPr137EcEDnXzlfZ4jn6OIB0juKTAnvhSxxrLJc9/pOvCZUQyFdm0jid3Goxx:3
TLSH
T14C4623335B89592FCAB07375B01E6D227E6F4603424CF29669DCA07637FBBC5422E894
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _Pedid805120IZ68GG_FESMZZRHXY-Vrfcejyu.vbs
- Size 4.9MB
- SHA256 3a2584e9d358beacb1c65df6697c26e08d3bbd40febb1f4d94e3bc615b55a126
- MD5 7e792f5a07c2bb48baa09584b24e07cc
- SHA1 ca55d73356f1f02992a2f3e4ef3030305bb7d707
- SHA512 d0397b1d329790fff7287177778d6100fb20639040905956b5fdfd075d86cb1bc1e4d9e36d066fd2fd55cf64a66048a2a6654d35a0879fe998c35aed1cce6531
- SSDEEP 49152:hynvPr137EcEDnXzlfZ4jn6OIB0juKTAnvhSxxrLJc9/pOvCZUQyFdm0jid3Goxe:e
- TLSH
  T11E362333AFD91D1B0AF46779B02E2E227FAE4913420CD2968EC5E16735DFAC5413E864
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/ltvq2.xml
- Size 41KB
- SHA256 7d750be30b5d239e62585ce223016dbf2c24dccd6c31b1c4737e03936c755c2e
- MD5 8790abac4c4b63b922ba21ad5004884a
- SHA1 11f2475143578eecbbfd5865501c7201c4d12eda
- SHA512 ed2f4ea3df5b956aeaa79b364bb627acc372b7680dbde9f351611b80d746f62450e11006f81875f48f5d1575ef5c4a1e3b12cee76fd8f95e4ca6fc3c66a5cd56
- SSDEEP 384:6kOtkCLu+JGRNyEIYi2mL4/y8RLVHFwaeE5:fOtkCLdvYiDLk5/aBa
- TLSH
  T1CE132E720948DD3CE7137A30D59ACE3F916711D29CC4736A21A4A93186B0722AB5FEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/queffq/mcqqm/lcbbt/jhpyp/bhouhv2.pdf
- Size 27KB
- SHA256 28db7f9abee695a72199093ba7474693111323f5c1e4bfb2f2fef0c408111338
- MD5 0a95a73b6a33e76788b6376eb6a00518
- SHA1 d9e8f21773ab48c420920a6e5f50f920ec9b8665
- SHA512 9b02664bba6d333a13867634321f6b7b5306a4f1eb55cdf252985af12e576b54d822c6e7a31b7b605626f937f8318faf497fac8eb2408bb40707029af67f46ed
- SSDEEP 384:seI0ekMOgRqGsJ8HssUdoj0vJ7B5X3gVxUXxtIXfrWzUKdoQnopgRIP0oKw33sLX:tMOgRiiH09B5nONDWzULwC4qKIA4pY
- TLSH
  T1EAD29D5E5447E1E1DB0352C6BF1EBCE66049B30B11A89EA21E2C1C475A83FB6F45D2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/queffq/mcqqm/lcbbt/jhpyp/gssstv1.pdf
- Size 25KB
- SHA256 9ac4720f28e78e2b1b6018f3197bbed351b09b2184ebed72cf5d9265d5fa88d8
- MD5 54c3542ca29bd3d219dee1479a199799
- SHA1 993f162a1b9151cbf3c26804c914c3f84eb14b09
- SHA512 4041e2e1faea1b2a6a1e9ceb71d2ac843917ac505c77371f9d8863a7fbedeef12ffb5ca1bc96f817a9e019c82a613ec878715666a8d183e0b9c758ada9e032ed
- SSDEEP 768:KRUkptrp9/l5UdHrgkOAx27chP+JwmZnrxwxNiqKIA+hh2N:KRnHt995UdHrhQvZdwxNe+j2N
- TLSH
  T17AC29E4E644BC4E0AE9B86DAFF0DAE929145A34F54E4E8264E3C8C619843FF5F51D1C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/tptam1.xml
- Size 21KB
- SHA256 4ffe6536a9e8ef8231c0b46c80e633af298b275f406439c6234a52c37b35a502
- MD5 9b3fe1d9f53a30a98c79b155d4260834
- SHA1 0a2214d41edc3e5214d966364a82611acf16c354
- SHA512 b05b7fd512030dc4f83a237af29c0e88d383aa6d4f888f872e95d1da2fa341df1ec3a8c63b4fa488fec01269db52e2da930cc11fd41a001064e5dd4919cb3875
- SSDEEP 384:pbDKpeWtj8mvv2vwPLmyLn77zOicYr/IYisgToEy8RbmL4nNyXi:gnj88DmS77zI4AYiJf5AL
- TLSH
  T1E7A24B1287DC1D19E9BF0E30F8E152229EB2F6456960C2DF29DDC05E4F92B047B963E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10