109f43b694217649eb88b730dd6a5af8fb872757af039284e6e92dc2f594a6c4

General

Target
X57852BA0-8492127-202608~.zip
Size 5.1MB
Sample260821-phqdssek91
SHA256 109f43b694217649eb88b730dd6a5af8fb872757af039284e6e92dc2f594a6c4
MD5 626da1e99a25085885ebae95d1dcc99d
SHA1 a66c0804cfa4ef59fa5982d93ff1b932f480494b
SHA512 309b87180e1cbb2300f35a3b08edafb774272f3e129c4e4bb8a69f5b23ad05f0c1bfe8233cd5f24cdb0f8e1d5d5baf5d554b007742e44b84192eddcabbe6044c
SSDEEP 98304:nRzHkm0TvGrdSy8kWtpEps+xbg8WoPV93pOfjFDjh3rNPVwAsTXGzykRdt:nRzv0r638kaks+xb8oPVgFVwANzP7t
TLSH
T1303633A0D0B949E9A2F6F9145B40181DAFCEBC2F63CEA4790B017F99D4E344A4CD1A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  INT-Number.20260821072146.EXE
- Size 3.0MB
- SHA256 53a4e54f23228c129e2f3d6f34ac457878e49ed2bb5ac13f05c10a55693d2dd8
- MD5 9033f5bed49269403341abcfbd8244eb
- SHA1 b2c8ddc97ec6894123ceba781ca0311a25472a3d
- SHA512 bef1c4c9fdb148554ccb84320d0164e9f3d4ef27ccb238592a6d56d27b7b901bbcd4540075c5a3302ecb6853ad4d4f827e39de7d75f7c1de6fe7a7ee9030009a
- SSDEEP 98304:16NPHPNYDT1g+8UYEP8deLgOgBnr9HUAi58:16NPHPNYDT1g+bYw8deLsnrtge
- TLSH
  T1A9E59D22F9019432F8E20077D7FE4BBE492DAA30172894D3D7D518A95AB05E27B3B357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  hdp.dLL
- Size 5.8MB
- SHA256 0b6124e5013faa3c836d478ceea1634a42430448a3a2046c9864f727310044f2
- MD5 efdf85f9ced3ac7b02d42706432ce9a5
- SHA1 de1375627552494f0fa670fd410d06e05c9f2474
- SHA512 659dbfb0a94bb17d4d51a726a803c2d1df3d21404dc53747d4937815c9a22c36e1e6d270cb3460de3659db6ac4b93302f03e7c12fe49dfedbc2769d021503b64
- SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmjnrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm/i1RZ4O7NADtV6v+zZT
- TLSH
  T15956D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4