General
- Target August _ WHM P.O 20261199 - SIGNED.js
- Size 1.3MB
- Sample260820-jdxdnavwcv
- SHA256 629ccd6b7ffe5f2e09ca3d7b1d9c7d5a591875446a349b146eee3c134ffb73dd
- MD5 c0883c9c5ddbcb0f2252ddad27fc9b3d
- SHA1 1a4d516d17a2278dcb0b37d06c9f7aff6e6e8990
- SHA512 f3fa24a594ac24204fc6b1f2a1b4835421e255eeaaf7f3d3604128f255f7ce4acb2b85c39c3b5f5d8ce0191c8452009fe572766b0493fec3c4afc0e401bb5aa0
- SSDEEP 24576:V+X5J62IJi++GmUQv4u/uV/pNOAP3oGSbeHy2pMcX:IXRIQlU8r2lP3oGGeHJ7
- TLSH T1E05512E9F650AFBCD22BFE2DC353AA50262D58C060D6FDFF2DA4DC6E25693028617414
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
August _ WHM P.O 20261199 - SIGNED.js
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
August _ WHM P.O 20261199 - SIGNED.js
Resource
win11ltsc2024-20260709-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target August _ WHM P.O 20261199 - SIGNED.js
- Size 1.3MB
- SHA256 629ccd6b7ffe5f2e09ca3d7b1d9c7d5a591875446a349b146eee3c134ffb73dd
- MD5 c0883c9c5ddbcb0f2252ddad27fc9b3d
- SHA1 1a4d516d17a2278dcb0b37d06c9f7aff6e6e8990
- SHA512 f3fa24a594ac24204fc6b1f2a1b4835421e255eeaaf7f3d3604128f255f7ce4acb2b85c39c3b5f5d8ce0191c8452009fe572766b0493fec3c4afc0e401bb5aa0
- SSDEEP 24576:V+X5J62IJi++GmUQv4u/uV/pNOAP3oGSbeHy2pMcX:IXRIQlU8r2lP3oGGeHJ7
- TLSH T1E05512E9F650AFBCD22BFE2DC353AA50262D58C060D6FDFF2DA4DC6E25693028617414
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1