ef2218af62f9e1e19acfb85af3707cf2c211183062d61d0ebb79c4ca1e4adb18

General

Target
08082026_1618_06082026_Adobe.lnk.zip
Size 1KB
Sample260808-tr2kmst1hw
SHA256 ef2218af62f9e1e19acfb85af3707cf2c211183062d61d0ebb79c4ca1e4adb18
MD5 85b3eaf602be11e7e740a34cec66ad00
SHA1 18e271f3d3fa04a9650a8eed73ca3f34092137fa
SHA512 19dbf97ac54ebc4fd5c29f25abbbd8bc1e153095fcb1017df52dbadc10da9e373edef46fbb0a3c98938e37e7f0077ae751cf3846d77e022d09ec4c1b6a9cc84f
TLSH
T1F821B7D4DE392E9CC916F0B7F2B7121DCDFA11C101475D418E9A3AEAA8D52A01E85DE3
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  Adobe.lnk
- Size 2KB
- SHA256 4fe5f30bb6e8f770e5fc316149665e46d34464c65c2477c87d740b439deb4357
- MD5 6dbba305f90b32b5aee5c687d0e68ad3
- SHA1 77f1c1eb012390b5c7aa13b52ab396843c6925b5
- SHA512 297fa45daaee3ade5abd3a6da7be027ac9553c6af691ca1edd0c0de4e49be3750ec21a0d949af2127e7f4c9ce03638baf05d03d32a40b545153f8fa84b9dd731
- TLSH
  T14D41DC0527F60218E3F74F3DACBAE3126A32BC25EE618FDE4280524A1861524D875F6F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Use of msiexec (install) with remote resource
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2