a41727f44f812c75ff6ff77958925d8c2e5266b9c38e904d06541ca530850c4e

General

Target
a41727f44f812c75ff6ff77958925d8c2e5266b9c38e904d06541ca530850c4e
Size 217KB
Sample260819-yjgbysvtbz
SHA256 a41727f44f812c75ff6ff77958925d8c2e5266b9c38e904d06541ca530850c4e
MD5 82d0792724b5e66affe3d4286e65bd50
SHA1 7cf93dd7d309ffc64933bc8512d57df677e8c804
SHA512 0166b6540e31c002245c75d05fb8a75ff3d4fcdaba0e555dc6f784e0fccb2b46cffcb4ceb5c421e14ec0e271762b9e3455ae4ee50d03786baebd947739ef270e
SSDEEP 96:sPKDx9jYTDQvUbAZ938DU2KULYT1+njva32KU+YTzGHS2rtL:I+YIvIAZ938DUMYhcLUFYd2hL
TLSH
T19624322433F90149E1F3EF777DF9BAD95DABF673696142AA408253094910A00FE2673B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  Rozrakhunok_vysluha_viskovosluzhbovtsia.xlsx.lnk
- Size 33KB
- SHA256 93a0e97a4e620d1ed4bb07c2863823787e433f8a032d1851bb8dcd9711bb3f00
- MD5 6ba07ca28bc017be3298ef48e202ddbe
- SHA1 ee42437e6a8848acc4ca0667bd32629d17820da1
- SHA512 96519e6c02050988323b8d6bad299b96ae9cd7fdf88a7f1914bc0bf4851e9ad6f9989131d51fbaa21129a42e6e87f130edb56a082f8f918c599a139ce35a9d4d
- SSDEEP 24:8d/TbPfCDx9RlYaInZNIdbxWNl7DBEpmJMrGvlxPlpYZ+3W9M+ZJmMfMS8Mg:8lHPKDx9jYT8dVSRNE+MC9bAZ90C8D
- TLSH
  T114E2F42432F54089F1F3EF366DF9B6D55DEBB76276614199008346094910D00ED6973B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  VYTIaH_iz_nakaza_rozrakhunok_vysluhy_viskovosluzhbovtsia.pdf.lnk
- Size 77KB
- SHA256 e88687f5d39bd5211137732a90a0be6e1dc601d0ddb3f4ae4fb7fbedae60d099
- MD5 8e049139f0fb357392d7322242e1a1c1
- SHA1 d43dba256309988b25e134ffbc1e9a95f9274afa
- SHA512 983f23121bb1aa364b9ff218f3bf3520475812e6e251863ee06d57c4c99beccbec17787903181049bca1f1cdeb194b36ffaf63b4ca8fc436455c3e83a67c906c
- SSDEEP 24:8d/42WPUcUlYaInZNIdbxFPRSp+UOiXEu+njVHqzlWaSZJmMn:8l42KULYT8dVFPRy7jEu+njtlaT
- TLSH
  T1D373113033F90109E1F3EE32BDF5B7C19CABB977AC62169A448143090911A40FE2A73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4
- Target
  VYTIaH_iz_osoboviy_spravy_viskovosluzhbovtsia.pdf.lnk
- Size 106KB
- SHA256 8b9db1f5256b949d00dea4610d64138c566dc5ada75cf8dffa7bbe764baa3508
- MD5 a7a4fda845f63ab911eedf562a70cbd3
- SHA1 708449c3a73728e048e295bf1143d4fad3b0bdd4
- SHA512 72ab415fc2c5e83e7aea98099f191b9480564e3d182d3c6764ff0d5196c7ba3e23cbeb1d28a74a4b2a42a4aa0fd60e5cf3b1c412469f164938d5652ce97aed35
- SSDEEP 24:8d/42WPUcFlYaInZNIdbxMxImK1WOHBnTZzs+m9lIlWbZJmMr:8l42KU+YT8dVMxGHHBtu9lfq
- TLSH
  T1E6B3C03477F90119E2F3EFB1BDB5BAD59DABFA736961429A408243094920900ED2573A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral5 behavioral6