f5b713c3d247d3ad387dba54f5eeaec7aabe644482075066b55a880ef7e196f5

General

Target
13082026_2306_13082026_20260813114523.exe.iso
Size 6.6MB
Sample260813-23qaradh95
SHA256 f5b713c3d247d3ad387dba54f5eeaec7aabe644482075066b55a880ef7e196f5
MD5 0760a72626d509fe33dece4bb1e7fb17
SHA1 b596d19c38e7b5359fc6bf853a852d153b3376dc
SHA512 c47e0d1b339343ad86bcd214853176e14f5dbe788e9a44be26e9a3d7889e12966330ac097e60cc0b48292c90663a5af1e156f17b1eb055459e55b232cb7238ba
SSDEEP 196608:At5NFgU1o59Stt1XxvkLZ4O7NADtV6v+zZR3ro2:Y/1qLN7kbV
TLSH
T15666B0123E4C0C67E45623338B5D62B8E66EEDE63BB19E8715A0BF8DB9313418971317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  20260813114523.exe
- Size 1.1MB
- SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
- MD5 13412cd73870016f6f59125e47e076a9
- SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
- SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
- SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
- TLSH
  T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  INV-No.B9D4F2509B0A976A284.doc.LNK
- Size 471B
- SHA256 747475b941d6ccb651ae3ede62b19208beb71bd0ef3af59c29a37a7e1da86753
- MD5 69e823cd59c2b8c3493a464a3ea90f41
- SHA1 a820154aa845a1083a5eb5f014d4e31e07b1b5c1
- SHA512 e16c5f37be939fa9381d904d2cf7e5d2494ced774d3593ba4731f678595fb9be7f3624e2683336bfab5613ca501bb691be8bdd8c0dceb5f9982a9a6f6b2607d5
- TLSH
  T197F04F0C0BC62B12D2A1C136A5BA9F33A6B3AD86E9B55B0D00D207D4181B546F965F9E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Pdfcore8.dLL
- Size 5.5MB
- SHA256 0b7ad10b3157c88837d5b101675cdeae63bd315abb6e17dfd928ced7c9e1b9c3
- MD5 03e071353b7089fbf9d2f4f2ef2a1ca0
- SHA1 89e708e9943159c3185c91593bd9c3f7b048cf8d
- SHA512 98df22265e9e3e728cbcfb89097d1e2db2268be992088366c167000faa687bacfc070aaa0ad2b1b22c6f632bd8069a9d45c874e9929a3855cadba2e870504b23
- SSDEEP 98304:GgWh7V40Yl94AvfqeapSkMdStt1Xx9ZkRuLrrxIZ4OiZrq1DfPHNADtV6v+zM+rX:GgU1o59Stt1XxvkLZ4O7NADtV6v+zZRR
- TLSH
  T1E046CF173D5C00AAE05A1233CE59B2ECF1AEBDE83B76019715A4B71EFD32741CA2456B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6