User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:f9b25e18b406c47d1f0be4584ab0eebade52ad147ff9ef64cb9aee4549250f60
General
- Target f9b25e18b406c47d1f0be4584ab0eebade52ad147ff9ef64cb9aee4549250f60.zip
- Size 832B
- Sample260822-bpvp7sem2w
- SHA256 cbae3d62635d1cd11905abe3b7167cadc93cc0663d1669b73e04b2766d8e2671
- MD5 21fb7eeb8c912830b29de47b274262c0
- SHA1 addb4e8cf83961d27d4499d6c384f3324ed0151d
- SHA512 3139e8d2cd2c1206e8f28de5bd60918ea3ca5f947c6da374f3a943031abb12ce22c905e33cc4ed790420fec271ce414e7df3f3febe70ef659a58fd2f807b2f48
- TLSH T16101866165297703CF8F477201443A9C066683104D884FC32FFB7EE4503D75C1B52047
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
N_fiscal_-K73WN9.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
N_fiscal_-K73WN9.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://documentos.alfatransportes.site/h/estagio1.php?r=391C7CE85D88
Targets
-
- Target N_fiscal_-K73WN9.lnk
- Size 1KB
- SHA256 5cfed7767ae4b49cddf1d6e441149513b68a1338140a75055288ebb8f8113ecb
- MD5 59e6245f3992eddb4d97f214f98d4e34
- SHA1 0748f832df6bd079a39fac163a59ef1dc7afb5cd
- SHA512 30799099080d530a29ce876312cb4306cd543c4c854d13dcbd9aba76535fbee3efbd5f14e5b210cbfd1eac54609523ae183edcff23e3a4f6e014ec42d047707d
- TLSH T153319C407EFA0654F3B3CEB2847B5B2485BBB8668D25CA1E0051454D5033B06E23AF67
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.