cvoohARCHtknta.JPCRH-JOXANO.iso
- SHA256 f9d2eb937035b47232279e822d56726ae7b0cb06f96114fd71764b403f50170d
Overview
overview
9Static
static
4_Notif_BVO...LE.vbs
windows10-2004-x64
9_Notif_BVO...LE.vbs
windows11-ltsc_2024-x64
9~/ghkee/ve...u2.pdf
windows10-2004-x64
3~/ghkee/ve...u2.pdf
windows11-ltsc_2024-x64
3~/ghkee/ve...a1.pdf
windows10-2004-x64
3~/ghkee/ve...a1.pdf
windows11-ltsc_2024-x64
3~/sqsgop1.dll
windows10-2004-x64
3~/sqsgop1.dll
windows11-ltsc_2024-x64
3~/uafcjq2.dll
windows10-2004-x64
1~/uafcjq2.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
_Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
_Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
~/ghkee/veacas/qtztns/aqczrq/ckxbu2.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
~/ghkee/veacas/qtztns/aqczrq/ckxbu2.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
~/ghkee/veacas/qtztns/aqczrq/xcdsa1.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
~/ghkee/veacas/qtztns/aqczrq/xcdsa1.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
~/sqsgop1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
~/sqsgop1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
~/uafcjq2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
~/uafcjq2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target cvoohARCHtknta.JPCRH-JOXANO.iso
- Size 5.1MB
- Sample260809-phz81axeqf
- SHA256 f9d2eb937035b47232279e822d56726ae7b0cb06f96114fd71764b403f50170d
- MD5 6d567408dfbf305ca6fe2a4f3605b7c0
- SHA1 818ee4303f78ff604836dd9b0aae5c63dc2053c0
- SHA512 3596cc7b1214343ae1837515994a53963353ee90094e5f1cb17199e968fda426be5e448f7710858d8fd61f9bfb5a1620199000568ea1863a3dbaa2faefe3dd23
- SSDEEP 49152:0r8dQ+eyJ1HTqEkinExwG4bMHQgsAux+GD9uaegMSns:
- TLSH T14136237649411E1BCB5173B5F01B2A25BF6F8563418DB2A6B88CE176337BBC1C12F868
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
cvoohARCHtknta.JPCRH-JOXANO.iso.iso 5.1MB
-
out.iso.iso 5.1MB
-
_Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs4.6MB
-
~/ghkee/veacas/qtztns/aqczrq/ckxbu2.pdf.pdf 25KB
-
~/ghkee/veacas/qtztns/aqczrq/xcdsa1.pdf.pdf 23KB
-
~/sqsgop1.xml.dll 37KB
-
~/uafcjq2.xml.dll 17KB
out.iso
- SHA256 f9d2eb937035b47232279e822d56726ae7b0cb06f96114fd71764b403f50170d
- MD5 6d567408dfbf305ca6fe2a4f3605b7c0
- SHA1 818ee4303f78ff604836dd9b0aae5c63dc2053c0
- SHA512 3596cc7b1214343ae1837515994a53963353ee90094e5f1cb17199e968fda426be5e448f7710858d8fd61f9bfb5a1620199000568ea1863a3dbaa2faefe3dd23
- SSDEEP 49152:0r8dQ+eyJ1HTqEkinExwG4bMHQgsAux+GD9uaegMSns:
- TLSH T14136237649411E1BCB5173B5F01B2A25BF6F8563418DB2A6B88CE176337BBC1C12F868
- MD5 SHA1 SHA512 SSDEEP TLSH
_Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs
- SHA256 c7b2edcd0f5c24dd5e571a1983c5c514e7d2e6ef2e0268a3f43d50d79076e69e
- MD5 5c943b9ee464e13570b4d57e643f6a93
- SHA1 9b98e58f69c12767928ba5d02977592db3f99c2b
- SHA512 b96ccb832a51869df7d0f704fe29d7879640d275f9b0d948b3d6a6dfa0c70802586c0c61f810068d891c6409ac8f00fd7f62fbeeef8c1edf551894fd5de65975
- SSDEEP 49152:zr8dQ+eyJ1HTqEkinExwG4bMHQgsAux+GD9uaegMSnsI:Q
- TLSH T19A2623769E551E270F914399F02F2A22BE7D8923424D92FAD4CDE246328F9D5C13F878
- MD5 SHA1 SHA512 SSDEEP TLSH
~/ghkee/veacas/qtztns/aqczrq/ckxbu2.pdf
- SHA256 5cbd06fba0e7336c2bdb7fe27f6b4428c72d04cd55c803cf72e08973f2149179
- MD5 2ccb6c3589c3a1084052379c2f42a31d
- SHA1 b9594041c05048758c4f1fbd04bbd01e750e0dac
- SHA512 159ca1a246ff9b911aa0e48d6858b2c826c953afaa37abcca0dbcb5bd900925a56e234478449e200bf9b3daaf718e335cdf8335d28bbfbb6ed2a8df494ccc8ef
- SSDEEP 768:+efuzal74GBOSqGpPTrPUunSHKrktT3PjMrQaT3kIQiqKIA+hX1:+0Cal74+MY7rPU9HKg537MNTUe+b
- TLSH T1ECC29D46A10BC565EB1B96CABF0D6C836349B36F60D09C212F5D9E63D503EE9F60D1C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr https://verificacfdi.facturaelectronica.sat.gob.mx/?id=064e12d5-3400-41bc-99a1-666174b4ee3f&re=MAG7712124D6&rr=IMH240401J77&tt=86981.65&fe=L8KFCw==
~/ghkee/veacas/qtztns/aqczrq/xcdsa1.pdf
- SHA256 0c9b7b31a8a2881f7e47a63a1b6227e602a4899bd57714b766f7aac7ebbf13ae
- MD5 b995d2eff77dd30cc4583c77ec059d4f
- SHA1 dc0d5021b2b258a55a3376f250ad71796e1a6997
- SHA512 006d94cfce8be2d9fc5007308807fc77804483210accacc3c2c87d2879dc473c879c67924efa61f889c6ff3fee380e39b7e9b323ebca10181b646b27f1517ac1
- SSDEEP 384:exbmFEs9ISsaVy1gV0fIkhEuqUPjk4fhyS7FwULBamBdZO04v8GqdA0lhRX2n:ex+Es9l3VgZqOj5hv7Fw6UmhO0+8GWAb
- TLSH T115B27C1CD986E49EDA83A9FB7E193918472FB371B6CD14442E2C0C5589C0F98FB5F886
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://www.burodecredito.com.mx
~/sqsgop1.xml
- IMPHASH 6c8408bb5d7d5a5b75b9314f94e68763
- SHA256 9d9a006a03486ac8963aa92eeb89d14ed158857042155e8d2dadf63c7cb12193
- MD5 7413cc3decd6a142f1efd1a358257c89
- SHA1 127fb95faa002a215970e55646bc2586e2baf3f5
- SHA512 f1e42965be9b6cd1575d4cfd7ca1a32d1edd595e3cb788406e915d36f7d0a09b717c3ee215e8671aea3c93737b1fbd6548deb563357362bb82905976b399adb2
- SSDEEP 384:8hMpOyZshAWBoNyEIYi2mL4/y8RLVHM5mSq:8PZAWBtYiDLk5/H
- TLSH T1C503B47246944C4CEB277A3064D89E3E9A3771C119D1B78671C4B035DAB0702BBAFE6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c3:24:b0:af:df:86:de:66:ca:62:ef:92:01:de:d3:06:ed:d6:f9:2b:82:7d:d6:f0:50:d4:d7:6f:7e:52:cc:15
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
Chains
Jul 17, 2026
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
0e:98:2f:dd:f0:6e:93:e9:11:06:5d:03:7d:4d:d4:82
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 28, 2024 - Aug 6, 2027
Minor OS version
1
Major OS version
5
Entry point
4824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
goopdateres_unsigned_zh-CN.pdb
kernel32
DisableThreadLibraryCalls
Name
.text
Size
1024B
Virtual Size
839B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
106B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=260, version=33808,
count=3, id=257, version=30795,
count=6, id=1, productName=Unmarked objects,
count=1, id=265, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
~/uafcjq2.xml
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 940cea523eb35cd20809226dbf692c2ef9573e736096657b0d71a72caff66afa
- MD5 9ed27984db015f6aa166e9b65bfeeb79
- SHA1 ec254ba1b1dc3536c536aef585968066e68f631a
- SHA512 e83a52e740c7889a98b1e9255a87d8ee40575d8ef33919085399abc1b7c4857a86de126c7f2e3690123ab9e1f6b3fe1501e5d7f65bb9758f57962f10feadf0c8
- SSDEEP 192:0cD7+icx2gjsdnIYiYF8SzfgOVMxPIsULc8pq8RuwdmL4pUQrNyT+xL:BDq2AsdnIYisgTSZy8RbmL4nNyT+x
- TLSH T154826C638BD80D09DCEB0F34BCD151229DB2FAD49D92D3CB205D811A4F693459BBA3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
05:2a:c2:29:f2:30:e4:e1:52:89:51:c2:7a:a4:f8:09:e3:eb:da:b4:49:32:7a:db:85:7c:aa:58:11:db:92:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Apr 25, 2026
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:31:fb:55:cf:5c:96:35:fa:e0:fc:8c:76:60:fa:be
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 5, 2025 - Nov 4, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
12390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\home\runner\_work\asimov\asimov\Source\Configuration\Configuration.RemoteStorage.Classic\obj\Release\Configuration.RemoteStorage.Classic.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ