General
- Target SOA.JS.js
- Size 3.3MB
- Sample260812-j73grssclf
- SHA256 c32805b1b784ca74d11592f8ffe833e68ec28a6727786b99767d09dd4e2d8e46
- MD5 641a768256b4e6b34a0537ef4fca922d
- SHA1 f5eb411425b6782e1c82b21416d6c2d51cd1a97d
- SHA512 93bfec8ead629b3d137025963e4bd9a1b6f8b963cfaf2cb9954d10c1572512f4e3a2d1f98c24ecbdc6d5dae46bb4ec5ef9ba4a4fa66d596c5a924911c6aea87a
- SSDEEP 98304:ZFuOojyBFjvx0KQ4Ul3279N+hF5SO365gL3cZRmZZsK:Z1FL694U49N+hi5ggZu
- TLSH T1E7F5C772A01559E9F93E771EC25F6A000FAD299B3364E91F3E7C0944BF6272A11CE493
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
SOA.JS.js
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target SOA.JS.js
- Size 3.3MB
- SHA256 c32805b1b784ca74d11592f8ffe833e68ec28a6727786b99767d09dd4e2d8e46
- MD5 641a768256b4e6b34a0537ef4fca922d
- SHA1 f5eb411425b6782e1c82b21416d6c2d51cd1a97d
- SHA512 93bfec8ead629b3d137025963e4bd9a1b6f8b963cfaf2cb9954d10c1572512f4e3a2d1f98c24ecbdc6d5dae46bb4ec5ef9ba4a4fa66d596c5a924911c6aea87a
- SSDEEP 98304:ZFuOojyBFjvx0KQ4Ul3279N+hF5SO365gL3cZRmZZsK:Z1FL694U49N+hi5ggZu
- TLSH T1E7F5C772A01559E9F93E771EC25F6A000FAD299B3364E91F3E7C0944BF6272A11CE493
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger