64675b3cd1bdc1191497fd96dad4633b17717451753a5b5d8101f260bd4b2c53

General

Target
21082026_0134_19082026_Number.20260818131124.exe.iso
Size 6.7MB
Sample260821-bzag1szfpd
SHA256 64675b3cd1bdc1191497fd96dad4633b17717451753a5b5d8101f260bd4b2c53
MD5 14c0c175a91318664b5f0a7f584197ad
SHA1 31f6a77eda64909a6044f5316dd1709942370662
SHA512 a9492384c8eb9fbbe981a0dee1ab6fe650f8dde034864ea0e3e299fcda427629e9721c714072aca6b7f99ce928e53eb790624ee064d15c6b8d205fc7a8833691
SSDEEP 196608:j5sY2vCKrJajDBivatCZ4O7NADtV6v+zZR3ro20aule:9svvuDAN7kbV
TLSH
T18A66C012BD9D4437E0AB02318EA9B2BD25BDBD602B2420D767C4BB19ED703D16E3561F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HDPgms.dLL
- Size 5.5MB
- SHA256 0f5e09cbca892269687a147242a1dc669c9824f79f11e29f61afd2d89ddd4bb7
- MD5 d3b8c31ac156fd95234d539381d521ba
- SHA1 e6de58a7ce7a7f046c9d9652a04bf8acee75a072
- SHA512 b4146c4813bc653f4a3faad79f82b8adfa52b75a1ecfce059d8aefd55b2fc6640ed9178bacc99ca5b4d95d9ebfe5e1b6184561bd023aa04ca5440f1b1600e492
- SSDEEP 98304:n+592Sc6kY2bI6bD5E6RGxKrJajDw+ivZJyJtCZ4OiZrq1DfPHNADtV6v+zM+rwy:+5sY2vCKrJajDBivatCZ4O7NADtV6v+d
- TLSH
  T17746C0127DEC0467D0AB13318EAAF2BC31BEBDB43A25612B2684BB1AFD317515E0551F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Number.20260818131124.exe
- Size 1.2MB
- SHA256 233a7de23438d09cbb277a0ebb11f71a2af9c53d2cf5ac9e4af368de0bf20a3f
- MD5 0eb29371e8a79d9d88d4b38e14e7fede
- SHA1 011ace7a722fde86968304ad2e1adff3857cf203
- SHA512 729e5381747479c5d9d06a2868398858be6370ab0b72ec468707fed0b9c1525e828d658f280ee786c3d2353ecca3617d61e5c189c5c1ebb8ce7b978df454a94b
- SSDEEP 24576:cxcrYVkxc3bY9uB6TfuiBNNSuuOqF5Cb7KhU2k8V9TsfTlYN:cxc3cf6Tfu+YlfF8XL2bV9ToYN
- TLSH
  T14E457E21F501D132F8A704B286FD9B6E992CEA20071450D3E3D85CAA9EF15E27B3775B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4