caa4f39c1fdc107b2306a5655ad28678477a72fd230ab0a048e9b520d2c5106a

General

Target
08082026_1621_07082026_TechVista_IT_Services_Proposal.pdf.lnk.zip
Size 6KB
Sample260808-ttrhfshr7t
SHA256 caa4f39c1fdc107b2306a5655ad28678477a72fd230ab0a048e9b520d2c5106a
MD5 21a4efb0cf0262d2a9d27196fe7d9186
SHA1 31b39939acb2228206f023dff6203e423593b408
SHA512 344f7d5cec6c918fcab04b17c63d497ea46ca0d9fd57fee9548ead0895ac303eba689bd502098721b214a155df5b708f8a6fa5edbf4ac6986ed1765b3fd7128b
SSDEEP 96:5kkWrIF+G8Ks0tnq4n2oHFfSOKyzMrqtT7DTWHd77Mbgi/D5Ye7ovpV6qm2ca:5kjru+MnbbFf+WtnWHd7Ybgir58V1ca
TLSH
T165D18EDAF05ECB53EA61DC3458ACA4CAC53603F7E2F56CC20948C96C8AF58C48E34092
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Adobe/reader.vbs
- Size 18KB
- SHA256 5a390ca66c73f17d699da091a66a79bbeee977bf42860e2285ef48f394b42711
- MD5 a85c232d565870bc13dc63ee7be7b929
- SHA1 09b0744827b2e893c4f87ca6110c0e0c5c7b66f0
- SHA512 788f4ee30f76efdb6e1d98366a5359d998a21cc65e31d5038849ff34208b99592c0152fad69c4c1e96ecaaf63779c6701a372247e35bf4ed607c2e24fe6dd847
- SSDEEP 384:EJKJ8VwWTgK6o3n94u67GKm1rd5gPopstst/3b0KYie5x003Nv:f0Tgnk76xm1rd5gPopsts13b0KMNv
- TLSH
  T1F682F9313E05BE09D161C4D258EE56403C924E26DC674A37BE4CCAFCC62B6F992E5CDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution persistence privilege_escalation spyware stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Adds Run key to start application
  persistence
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  TechVista_IT_Services_Proposal.pdf.lnk
- Size 421B
- SHA256 ba53815696329e4d311a5543d384c490c593351b9f4a4c53a225d1fa96ea2526
- MD5 9bc30652d55bda43c3d3fa13ffe75a1e
- SHA1 cdddee26942337aa1d91d1c98487db33526e14f2
- SHA512 6e2549892b0d638c48ba3c222ed888309c09e57783956218c6ce47812c1ecf6148775bc097508dfeec77fabca69938a632899c4ca45faae019e2c79dae756d24
- TLSH
  T158E09AC116EB1618F6628E35D3329BA09ABAB488AF00424E98902A054C22280E0AAF53
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4