cb3e8774af3ef02ad9a18b263000d696ee8544f0e946b0ea104553473e8afe9e

General

Target
12082026_0045_11082026_Перечень задач-Перечень задач.docx.hta.zip
Size 135KB
Sample260812-a397dagj4s
SHA256 cb3e8774af3ef02ad9a18b263000d696ee8544f0e946b0ea104553473e8afe9e
MD5 fcf44c229ff32ce4e6d6ddedf713b1a8
SHA1 43410ca33fe888e29742ae59839ea7c053be30ca
SHA512 52a9b6491234527854a1c296a8634460ad24427f0faf1d4332e1a2e85b458432f4df6cae5c0bea48b1c14323730c971fd515fdd05243e4df831a0de97d58b1e7
SSDEEP 3072:e9corR99geWBU8R3KkZ5eDdtVTCz7MBKWQx05pfNYhSDVbbSvXwB:e9p97UU8pKI5eD5guOxUYoZbSvgB
TLSH
T13BD312E79CFCE875BA5D63F0D5F950A62FC794160E389168800C69BD17A4D298C0772F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Перечень задач/Перечень задач.docx.hta
- Size 224KB
- SHA256 f7ffab6d0e36227aad383dcbaff1661988564e483383f492d94f0b7ae73ccef2
- MD5 e8064c34ccfddfc3fe8f9b51978e4555
- SHA1 38a717aec25e383bfd0d361bb680da967cbc442a
- SHA512 9c61771e05f93531bf5b0c3a90919ad47cbf5e6c26e0b4499738999bd0892a4a09d7ecd8acd83c9a857359babe84dd76de688852377a0ed2e7c2d18b0f3be4fb
- SSDEEP 1536:Q9SLaI29SuBgMEDEwhfPKlVTR3CK2vWpK2mLAVw3YRkLvTp6qIoFGVMpnhSEHHA4:gTBrscukdlGNiA
- TLSH
  T1BB34C08098A5C080B84B38D0C9D4308A19353E7B761BEE59343D7BFAFA665C95F649CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  Перечень задач/Реестр/Реестр 2026 ЦКМ.pdf.hta
- Size 221KB
- SHA256 73f8042b89a09218204211940f27d6ef14a7fd7b5fe035426f6eb44342d2c2ce
- MD5 745f39ce2a30d71209c2589304faf242
- SHA1 5acf1253049d037b32957df879ca5d7dd041baf8
- SHA512 d3ad6b43a8d3d4be4c33071c7cf0a68bdfdcb51c3ee2dc1503a22df1d7e7f5a8b63764f964704b3d3229faa98a932bf1e339ff01907746c5933d8428cce655ba
- SSDEEP 1536:G9SLan2CSuBgMEDEwrfFKlVTO3CK2vW6K2mLAVw3YR4LvTp6cIUFGVMXnhSEH1A1:u/BJ9Fn
- TLSH
  T13624C18098A5C080B84B38D0C9D4308A19353E7B761BEE59343D7BFAFA665C95F649CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral3 behavioral4