f9d2eb937035b47232279e822d56726ae7b0cb06f96114fd71764b403f50170d

Sharing

Copy URL Twitter E-mail

General

Target
cvoohARCHtknta.JPCRH-JOXANO.iso
Size 5.1MB
Sample260809-wvsg9atbna
SHA256 f9d2eb937035b47232279e822d56726ae7b0cb06f96114fd71764b403f50170d
MD5 6d567408dfbf305ca6fe2a4f3605b7c0
SHA1 818ee4303f78ff604836dd9b0aae5c63dc2053c0
SHA512 3596cc7b1214343ae1837515994a53963353ee90094e5f1cb17199e968fda426be5e448f7710858d8fd61f9bfb5a1620199000568ea1863a3dbaa2faefe3dd23
SSDEEP 49152:0r8dQ+eyJ1HTqEkinExwG4bMHQgsAux+GD9uaegMSns:
TLSH
T14136237649411E1BCB5173B5F01B2A25BF6F8563418DB2A6B88CE176337BBC1C12F868
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs
- Size 4.6MB
- SHA256 c7b2edcd0f5c24dd5e571a1983c5c514e7d2e6ef2e0268a3f43d50d79076e69e
- MD5 5c943b9ee464e13570b4d57e643f6a93
- SHA1 9b98e58f69c12767928ba5d02977592db3f99c2b
- SHA512 b96ccb832a51869df7d0f704fe29d7879640d275f9b0d948b3d6a6dfa0c70802586c0c61f810068d891c6409ac8f00fd7f62fbeeef8c1edf551894fd5de65975
- SSDEEP 49152:zr8dQ+eyJ1HTqEkinExwG4bMHQgsAux+GD9uaegMSnsI:Q
- TLSH
  T19A2623769E551E270F914399F02F2A22BE7D8923424D92FAD4CDE246328F9D5C13F878
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/ghkee/veacas/qtztns/aqczrq/ckxbu2.pdf
- Size 25KB
- SHA256 5cbd06fba0e7336c2bdb7fe27f6b4428c72d04cd55c803cf72e08973f2149179
- MD5 2ccb6c3589c3a1084052379c2f42a31d
- SHA1 b9594041c05048758c4f1fbd04bbd01e750e0dac
- SHA512 159ca1a246ff9b911aa0e48d6858b2c826c953afaa37abcca0dbcb5bd900925a56e234478449e200bf9b3daaf718e335cdf8335d28bbfbb6ed2a8df494ccc8ef
- SSDEEP 768:+efuzal74GBOSqGpPTrPUunSHKrktT3PjMrQaT3kIQiqKIA+hX1:+0Cal74+MY7rPU9HKg537MNTUe+b
- TLSH
  T1ECC29D46A10BC565EB1B96CABF0D6C836349B36F60D09C212F5D9E63D503EE9F60D1C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ~/ghkee/veacas/qtztns/aqczrq/xcdsa1.pdf
- Size 23KB
- SHA256 0c9b7b31a8a2881f7e47a63a1b6227e602a4899bd57714b766f7aac7ebbf13ae
- MD5 b995d2eff77dd30cc4583c77ec059d4f
- SHA1 dc0d5021b2b258a55a3376f250ad71796e1a6997
- SHA512 006d94cfce8be2d9fc5007308807fc77804483210accacc3c2c87d2879dc473c879c67924efa61f889c6ff3fee380e39b7e9b323ebca10181b646b27f1517ac1
- SSDEEP 384:exbmFEs9ISsaVy1gV0fIkhEuqUPjk4fhyS7FwULBamBdZO04v8GqdA0lhRX2n:ex+Es9l3VgZqOj5hv7Fw6UmhO0+8GWAb
- TLSH
  T115B27C1CD986E49EDA83A9FB7E193918472FB371B6CD14442E2C0C5589C0F98FB5F886
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/sqsgop1.xml
- Size 37KB
- SHA256 9d9a006a03486ac8963aa92eeb89d14ed158857042155e8d2dadf63c7cb12193
- MD5 7413cc3decd6a142f1efd1a358257c89
- SHA1 127fb95faa002a215970e55646bc2586e2baf3f5
- SHA512 f1e42965be9b6cd1575d4cfd7ca1a32d1edd595e3cb788406e915d36f7d0a09b717c3ee215e8671aea3c93737b1fbd6548deb563357362bb82905976b399adb2
- SSDEEP 384:8hMpOyZshAWBoNyEIYi2mL4/y8RLVHM5mSq:8PZAWBtYiDLk5/H
- TLSH
  T1C503B47246944C4CEB277A3064D89E3E9A3771C119D1B78671C4B035DAB0702BBAFE6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ~/uafcjq2.xml
- Size 17KB
- SHA256 940cea523eb35cd20809226dbf692c2ef9573e736096657b0d71a72caff66afa
- MD5 9ed27984db015f6aa166e9b65bfeeb79
- SHA1 ec254ba1b1dc3536c536aef585968066e68f631a
- SHA512 e83a52e740c7889a98b1e9255a87d8ee40575d8ef33919085399abc1b7c4857a86de126c7f2e3690123ab9e1f6b3fe1501e5d7f65bb9758f57962f10feadf0c8
- SSDEEP 192:0cD7+icx2gjsdnIYiYF8SzfgOVMxPIsULc8pq8RuwdmL4pUQrNyT+xL:BDq2AsdnIYisgTSZy8RbmL4nNyT+x
- TLSH
  T154826C638BD80D09DCEB0F34BCD151229DB2FAD49D92D3CB205D811A4F693459BBA3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10