a18b9dac277fa57555bdd7bcaab43dedd58c2481d63b28be31879d448b586ae8

Resubmissions

19/08/2026, 19:29

260819-x7c4rsgp9z8

19/08/2026, 19:24

19/08/2026, 19:21

19/08/2026, 16:07

19/08/2026, 15:57

19/08/2026, 05:45

Sharing

Copy URL Twitter E-mail

General

Target
AccessCard_G6a8542a69f7b5754.zip
Size 814B
Sample260819-gf2eaael4s
SHA256 a18b9dac277fa57555bdd7bcaab43dedd58c2481d63b28be31879d448b586ae8
MD5 6f0a017cf8d1225d800d53f0b03c669a
SHA1 b745cd5c4eaf5dc19bf852df6d320e2599540f85
SHA512 ee67285463caceb10a776ae44042960bdee2ca815ffd356d46fca78cf46e5be965a1451f686d8bab9ddfbd8c536a1d022bd4486b76fad8844e43c6b3de1bc360
TLSH
T1310146CCE7629A55D4069F312E184469606B88B594CB718D5D5D04EDEA28EF20BC340C
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  confirmation.vbs
- Size 1KB
- SHA256 4f421ff46b2dabcff8719ba28deedd1740999f67923e021824aaaf1de6637754
- MD5 aadb9fa044d37c92eac13065e6897165
- SHA1 9c60ae28ffc2e67c95e9663a886977fb2368ca59
- SHA512 a4429fd65bd282fde76449bd5f226655231ed390e1571e3414d8b56cf1d2d6b54e0d83e9bcd1b5cb52c1e5a5f2d8f11283e95b0bf17561b929bfe429d81f46d3
- TLSH
  T15321202DE903BCA34D33A7A29927841AEE70E277112A50A93640CC442F353B07B892C3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor google defense_evasion discovery execution persistence phishing privilege_escalation ransomware rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2