Overview

overview

10

Static

static

1

k0PLDQfz_‮txt.lnk

windows10-2004-x64

10

k0PLDQfz_‮txt.lnk

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    13082026_0404_12082026_spare parts_Goods_‮txt.rar
  • Size 957B
  • Sample260813-em75asar2s
  • SHA256 508754768098d4b42a5d9146c378d19afa7b73197eff39516d4c98ca0b96e6da
  • MD5 SHA1 SHA512 TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://cdn.discordapp.com/attachments/1494088856646058006/1537027398003073024/JS-L32_CMD_F.cmd?ex=6a7d8bd0&is=6a7c3a50&hm=b16001803cf76b7a035b64fea4bae6df8bd5354dfb19ebcf8274f734b627a15e&

Targets

    • Target
      k0PLDQfz_‮txt.lnk
    • Size 2KB
    • SHA256 65d43d5939f19eaa3aa5dc45654c7505362bd0958d7f598ca383ca5454bfd38b
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks