90a2de1fd51caf766d22c131241262fe9437675220ffbdf9abf682eaa7ef370d

General

Target
C__Windows_System32_rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding - Pesquisa Google.mht
Size 3.1MB
Sample260810-qdmmsayhke
SHA256 90a2de1fd51caf766d22c131241262fe9437675220ffbdf9abf682eaa7ef370d
MD5 e9b468d0bbbea7498e62f499a891bad4
SHA1 837b5856b9dd706721272fdda0697ac7d2a85ed0
SHA512 146c81dd75a1c6305185d5a5c1c8313c0a68a0737de176ea0e99eaf7aecf4f000ba486bd752b861f3d831c0e338add1507404b2c2d923f486f2170ed3d155ff2
SSDEEP 49152:Cgcg1o1X3lWS1qIn72Zzk46Nyvjnv5jP3jNXVCCeoWo3Z82gA2+6eLgUfh:l
TLSH
T1F3E5F860B2211F33464B13D4B6A29B0D3557F35BCA0512FC96A946F0E7C9DB8BC8E5CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  C__Windows_System32_rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding - Pesquisa Google.mht
- Size 3.1MB
- SHA256 90a2de1fd51caf766d22c131241262fe9437675220ffbdf9abf682eaa7ef370d
- MD5 e9b468d0bbbea7498e62f499a891bad4
- SHA1 837b5856b9dd706721272fdda0697ac7d2a85ed0
- SHA512 146c81dd75a1c6305185d5a5c1c8313c0a68a0737de176ea0e99eaf7aecf4f000ba486bd752b861f3d831c0e338add1507404b2c2d923f486f2170ed3d155ff2
- SSDEEP 49152:Cgcg1o1X3lWS1qIn72Zzk46Nyvjnv5jP3jNXVCCeoWo3Z82gA2+6eLgUfh:l
- TLSH
  T1F3E5F860B2211F33464B13D4B6A29B0D3557F35BCA0512FC96A946F0E7C9DB8BC8E5CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral1 behavioral2
- Target
  attachment-80
- Size 9KB
- SHA256 c602af0d61ee6030449b6230046cbe51cb6cc0c7aa7ce77f055c2fe77ef74264
- MD5 c8eeb6a47ac825e33439c1f76f6a0560
- SHA1 b27fe3ccea53d680c7a9e46817678d13bb2638b4
- SHA512 1d0d1d67fa4f3fa58e1556fc39322631195b4046b928683fbbb0bfd41f09ee192e2c58634fbb0f65302b5f98f9e4a1398c48100987c73ed5e16a98f3d1eebeae
- SSDEEP 96:aIsK7COY9aqkrGF51l316nwnVj21EUaoDc1lb6wGT5qei8EDw+GmV8CvtxZVtxDA:r0admRT24oCOVG8CvtHhDQFtf+y7
- TLSH
  T14A12A563570031B4A227BB587AC7E3CD273A2292795307BD7E81180AD25E5BC6347F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  email-html-1.txt
- Size 1024KB
- SHA256 00cf39e40e0df60c93a70c50cd472c33a3a461688adbd7ff55c3ec17e651d623
- MD5 d6b14482b604de7231ef36325b58ef21
- SHA1 3534f8fed30f8771772fcf51c777093d1603914d
- SHA512 50ce0defe93c8ab2dc8feee65b2d71968ef1e22db6ee46ba7037fcba522958620160d79c9ca6107f9423fd4aea148c2e6bcba769793c1247a4db2b1583016a75
- SSDEEP 6144:rCc4o1X3lWS1qIn72Zzk4ZLMWUyyMLsTBT/zpK9Sodcji5xp2M7hl4+3oGK5iDzq:2o1X3lWS1qIn72Zzk4GKFcaqy7jjwiv8
- TLSH
  T11825943072212F32460B0AE4B5728B2D755BE35BC94A53F88AE84AF067C5DB9FC4D1D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6