General
- Target 13082026_0040_12082026_photov_337659773081.lnk.zip
- Size 1KB
- Sample260813-a1fvrayare
- SHA256 463b80adb41b5b4b61d9dbf5090b33eda549f3ea5e58ecf979af82958306edd9
- MD5 7425e97d51bbdf12863d17b8c80b6682
- SHA1 cba455b24a31bb14b234d0f30430b1ae7d68e471
- SHA512 080a0c01ed8b4ff32078541b537ef3e6cded845bc27a5b116fc9a2fce618049faffc11a7f2d596ddce7082fc58b3e25383756bbf9de7afea3f81b9959ad05674
- TLSH T17C2196E896990810CCA3EBB57DBE7DDD53EC9D04A00434DF2387680E020749E9E97714
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
VID_863403929922.lnk
Resource
win10v2004-20260513-en
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
VID_863403929922.lnk
Resource
win11ltsc2024-20260709-en
9 signatures
300 seconds
Behavioral task
behavioral3
Sample
photov_337659773081.lnk
Resource
win10v2004-20260513-en
8 signatures
300 seconds
Behavioral task
behavioral4
Sample
photov_337659773081.lnk
Resource
win11ltsc2024-20260709-en
7 signatures
300 seconds
Malware Config
Targets
-
- Target VID_863403929922.mp4
- Size 1KB
- SHA256 e41f656b3ba4e0265d87fcb7639245aa5d88b82a9d6cd69ad1bae187b4f6859a
- MD5 a863eaa73b3874fdff7e38d168cba511
- SHA1 a196908d0be70b60e8346fba6d95748138dea708
- SHA512 3754f7246fdf56d92aafdd9c4bae031ab74d6f6e51fd2c334fd4a39902bd0c40dbe94a369af82889963364df5653b1a3ecbcbfe2da7061bcc3692ccf733b7bda
- TLSH T18F31DF2023CA0B18F3B60D37BC3CA18834B8B414AD02D35C4282E0A9A5B6104E13AF33
- MD5 SHA1 SHA512 TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
-
- Target photov_337659773081.lnk
- Size 2KB
- SHA256 a3bd3af53eb49d1399a10c2ae3ce511d7134576d057b6ffeab91891edd85e9dc
- MD5 7a161005d159e4c7fea361ee97435daa
- SHA1 497ba572ec20eaf9ef50655877f0e654a67f80d4
- SHA512 78231f2f0534b0c58aa2c44c4c8b05b55114a511db63646367456cb557b710c493fbb9d3036c414174d402e0da425b75301fcd89918cac6a638e0a5ce013caba
- TLSH T12951D62C57E80205FAB3CA36E9BED501B831B65DAC21E94D05C2914C8472E45F8F6F2F
- MD5 SHA1 SHA512 TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.