28b9399fbf2f0f8df9e21615aea71820ffd15f27ca52e1c54a09ed92982d08f2

Sharing

Copy URL Twitter E-mail

General

Target
08082026_1605_07082026_ВАЖНО.txt.lnk.zip
Size 7KB
Sample260808-tjlt8atze1
SHA256 28b9399fbf2f0f8df9e21615aea71820ffd15f27ca52e1c54a09ed92982d08f2
MD5 45a68e621ee9cb51402055180f167c0c
SHA1 acb82d42205ed2a80e23c101fe49a46b6fa7a44f
SHA512 0abb9b27b3d70e8106b62086c58daa1704e9c4151179e21f423410aa58114bc2685df96113597b9acf00bbb0a7103c67479846b02e19fde9e6d65704856ec69a
SSDEEP 96:DUl1L8gQJx1OU9YyyRxfxiRGeofcHnieQg26e+HxSqamP6s1KlerI:QHOvOVyMiZof/P3qZ6s1K4s
TLSH
T1D1E13A8437C6F68DC295B23849DD54EA1E26266E3AC3120F67E930E42DCF415A7F34D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  ВАЖНО.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 10KB
- SHA256 dcbd31efc356d048a0cf236d77ebc3ba1a1d3a492f44701fcaf52a23dbf4e323
- MD5 03712e3b04ec109a8e9f8e1868de70d8
- SHA1 42d1c6871eae3dbdb73b65c33aa541ba1f64cdf7
- SHA512 4118ec30dfde15adb792e93f4dbd652e8cf12ad3edd94449734a01b7790915bfffe913b6b599f4259ff86450aaa88bb16d66102ad3a874244f3ef803407fcc9a
- SSDEEP 48:8RRA1MvlehX8sguQBaMTCrYXKWFPI9IIa8QUA:8RRUX8sjb70XKWFPC7
- TLSH
  T16B22C23CCEA4023DD5B6C639E09B6613D5637C02753D9E8E10CD63456B63105F86AB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  информация1.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 10KB
- SHA256 b77496aa4d0706574c40f9d0818c204021c8b207f2ff90e98797548591cc5934
- MD5 3b317b6f10166168af27e5d9749e1a33
- SHA1 e7491680567765bf02e3a29a4e14697fcc013568
- SHA512 49ad7e721f74fc54ba69d8042ec38a1f52235ccb2cb25c72f246c3ae722a5bec36874e8f570ddca8a51a07071f507395891ce252137189545985e0d74882a094
- SSDEEP 48:8BRcUvleuCGViddqfy1guIT1H9I9IIa8QUA:8BRrRido0guM9C7
- TLSH
  T17E22EE3CCAA80219D5B3C63DE4DBA212D5637816A63DED8A20CD63455B93102F87BB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

execution defense_evasion persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  информация2.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 10KB
- SHA256 2b07aa084e9fc1d40495d3a9849b96e2ae1bc67f97c6b3a8e44cdc574d4041a3
- MD5 0358dd68719d66b5c8c4fb826aebe814
- SHA1 b932251ee4e8e2be9653f0b8643da4c6d283e19a
- SHA512 b64707db31bd179d20506bc1f72ff6033d6f2bd6d9918f7f8bdb4e86b6a2625224e05d45e4bd15041c6ccf3a0327d95781d941925ab7a6cd7179e0c9d6fe921d
- SSDEEP 24:8/hOx3n+WaqKicF2Wl1A+uWyTXWr4vdXZHksTvwnI3ypGk3qZ4I0w4L4I0CWvpMF:8pRcUvleRTXgQ9Zt8IipGqI9IIa8QUA
- TLSH
  T162229B2CCBA50219D5B7C939E09B6213E563BC12763D9E8B11CDA3455BA3106F83BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral5 behavioral6
- Target
  информация3.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 10KB
- SHA256 d9eb6c0f22d398439bfefb70cd717dd4a77734117a4359ffe04d3faaa0c92e3b
- MD5 39c691ce67c0eda27a3bffed90f9b13d
- SHA1 2c61893d53a57d8a49671ffa68332f2306e0e633
- SHA512 84d525234dedf2120f2c8be0426ccfc580886a8968dee0dc99f610c4cfb6615e05d7735e3e5448d0bb0ed76c022c139232d081931bc913e1b2c0d25bbb8f2dfb
- SSDEEP 48:8BTXRcUvleoD/cRGuc3pxlOTI9IIa8QUA:89XRLD/tXvlSC7
- TLSH
  T1A222AC3CCAA5031DD6B7C539E49BA312E9277802723DCD8B11CD63455B93102F86BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

execution defense_evasion persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  информация4.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 10KB
- SHA256 d1923c7e1ae2b0c5d707e2f2ff271d55c261002fb29fe285b43cb7c722c01c4d
- MD5 589d843c95c754bdff1ee5417159aedd
- SHA1 c85fa30d8a8a64299a056d226756329a315ec99c
- SHA512 c52160aea5893adbff0f76a50cc4798957aed17c8ff8e7f36e18981892b71101e5ed0eaab4a5483e29c0cec1074a6c72eb88faff240557b1eed9ad328d46ba1e
- SSDEEP 24:858hOx3n+WaqKicF2Wl1A+uWWBsWrPV9SVxNgS27A63BKVC/P4I0w4L4I0CWvpMF:852RcUvletsgPaDNgnQVrI9IIa8QUA
- TLSH
  T18922AB2CCAA5021DD5B7C639D4EB6303E5637C16B53DCE8A10CD63455B53102B82BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Looks for VirtualBox Guest Additions in registry

Badlisted process makes network request

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Looks for VirtualBox Guest Additions in registry

Badlisted process makes network request

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10