General
- Target phish_alert_sp2_2.0.0.0 - 2026-08-12T110134.775.eml
- Size 874KB
- Sample260812-tjcasabl61
- SHA256 e317bd1389efb4b2254704dfdf47871b5c586290be01adf97e58f96a67a4507f
- MD5 f7992b33bcfb633738a11a92f9c3c5fd
- SHA1 ef66f8b1ade0c02888ef9db26ec3e1000f74a9a9
- SHA512 b40b5b483e4209ad94b021d8c212be443a0732090c84999c125ad5c54d885d3e5d5deda2497212c3baeda55a6b54ed3d121b1c2c7dc3e5ee673902196f479705
- SSDEEP 12288:cgzxgPfg6f1Fmy3v7aYooI6/cuJWpdgzAq/+BN3mtzqSjJ01FxcIPhUpYeFq8k:cpfNNFmqvkoWdI1/c3mj901FxXmFk
- TLSH T1A115F12680D03FD8DAA6662CA17A733D97F405874D2E6B48A727BF497FB6C140A16073
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Somerset County Government aids.eml
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Somerset County Government aids.eml
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
somerset_Scan020825_06082026-protected.pdf
Resource
win10v2004-20260513-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target Somerset County Government aids.eml
- Size 615KB
- SHA256 6bf8401933d68fa51b2089dd4f29d640e18e67cfa528f9100d3c4e575d972b75
- MD5 25075e696615c223eb2619dffe4fcfe3
- SHA1 7f95785364dea795696af909b0d65058ce9adbbb
- SHA512 d50dc502d9f3ca2a53dcbfdab237cc9f6de4a17dd1d79488b7aa7b393cb2bcff25cae491a9c4fc11be6af283e7ec031c79331b5ae00cd4da83b9eb4679615f65
- SSDEEP 12288:n+UOHV6K8jMKQQcBT6Yey8xDSMURyzP7CjQXpv9Ax9NO9C4Jk6LwW3vH:+t6KKGPYmG7/RC9NO93rvH
- TLSH T1E5D42399EEA02B6F06325379B616789076ED334B1E8237136264C72332F907463EB295
- MD5 SHA1 SHA512 SSDEEP TLSH
-
- Target somerset_Scan020825_06082026-protected.pdf
- Size 446KB
- SHA256 23ec016c20fd39b46c80ab0bd004d9d746f1fda43a95b030617a57730ac88a28
- MD5 6d701499edb3ab39b61c9358b0eb405f
- SHA1 31570122d06d2a3c28735d68fcaa3b723ed57e50
- SHA512 f813418e2350047090388227db12962a48b0abaf7b89cf40afd9f7e393780c991a2e943b768a8aec0361cbe46590b63dd9a6b34cf93ad1efa30c9bb99108df24
- SSDEEP 12288:Qv0LIjsUSP9IkkuCTUv8Y0IM5qrFLKd1ThIxrb:QMLIsLP9IImVY0ITRLK/2xrb
- TLSH T17AA423382ED089F77F0D160BD83F4FC693A0A88E149E4F5562C8589699F4A7C3A64CC7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
3System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1