04de4e30f83774b7adf190ba6769a305377fb83ec5995e0805950f45eb59e270

Sharing

Copy URL Twitter E-mail

General

Target
0NotXLDOR_6H7P_66718ogtl.zip
Size 2.9MB
Sample260822-g1pafswtfy
SHA256 04de4e30f83774b7adf190ba6769a305377fb83ec5995e0805950f45eb59e270
MD5 b901819822474592cb617f670568fd23
SHA1 31adb3c3879bbdbfa94677ace9affe36a35040bf
SHA512 343f0409af89137c935812b53dd720b470cafb072ea0b33f5750309b67c0fe31a8e4da85f199110d59da538361e95dd1f5c860e1d741f88f10f5617de9a15287
SSDEEP 49152:AbUEWHDFaek+D1DS2XVRL3NfCYJNpFECF6K2HZnjjWniyLTHy5kSAQL3MpdDTxAe:A8jBRDSEVvCYdFE0diy/+dIdBAe
TLSH
T17CD533C434A2B898DD053FB9CB60028D684BB31CCF65B2AF97337DA524604D5687B9F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _9360EnvXAHDYK-GVRQkkxn_Instzrxakr.vbs
- Size 3.8MB
- SHA256 f0a042219698d240d447fad98dd14fa48804cb939d68b476083c830e614a4e98
- MD5 fc6766a08eec16cfa83269455b5691b3
- SHA1 10118d8e2d681fcf85233ec290dd9e026ef43423
- SHA512 4507dc7a28ed61857164146fc719bab58d6a3d30b8cf3ae734eebe1fb129e6826a2fdd0adb4eb31872233c3c99b3d4eecb8480c4c5a65a3ff5ad6fa2263983b3
- SSDEEP 49152:h9YcXTbnfJGz60GAQHzDGRZOREh586uZ7IUN/KAhRFJ:j
- TLSH
  T1950633721D556D571B648B9220FFFF3C5EBC88DF8A88407D2A8CE0C656EEA45C25B9C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/dbkdbe1.xml
- Size 37KB
- SHA256 575013468196d8fc0d5529dd150a8291e8067a28744d60f891f88bd4d6914150
- MD5 ed9e51bc2b3daf5be2f26aba12187ccf
- SHA1 d46338ef081bee8547eb4a16277fa0f5e0f6aefe
- SHA512 60144c4b2a22a6cdecc1ca5eb6ae1b8952ad01c87d5be71e3912bb58907248ef4394d1f1ebc2951631849bd39fe48577b160708e2f6dac00def2824201502778
- SSDEEP 384:86qmRgdGBXNyEIYi2mL4/y8RLVHyDww61GJ:8ej8YiDLk5/EwB1GJ
- TLSH
  T19803D57246808D4DD7277A3064C45E3F9A3771D12AD1B38631C4B875DAB0342ABAFE6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/eerc/eibjr/yizy/zvcsk/rtro1.pdf
- Size 25KB
- SHA256 28a23ec17b9321c2e3f3e6400a9cb5de8e7a0a1c26c65697b68a329a64ab8b2e
- MD5 a87ade81184ca1adbaec6682ef3f2ae4
- SHA1 c09768ee4065d960575977130b1517052d844135
- SHA512 e43757880c523ec949e69df4ed72318b890ac9612b79924698b483d44c3220ebaa865a61211420be1f1ae42740143b7409c6fffed3bf8360386c4f3224a78594
- SSDEEP 768:8Xr8MHAaXyiUzmTV/sAvTHd3jnFvZ0FiqKIA+hP:i8WA9zmTV/fvTHdzxQe+R
- TLSH
  T1E5B2BE485243E5A0EF43ABE7BF0DB4E29249770F12E889618D1D8E464A87FF1F54D1CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/eerc/eibjr/yizy/zvcsk/sxakic2.pdf
- Size 79KB
- SHA256 4ba1561579a55e0c125f2ad16a1b74961f9372c187f9d6b31023bd10b571f4c2
- MD5 d804a3f81c488ffd958940cee740fec4
- SHA1 33286f08ed8f8faaaa638d92f9e32478d23690ef
- SHA512 e1721363ad12099ee447663f0f98f32600cf4734eef5ebb8422b9e4406e8c6891c3f2d52aa707bf89ed6fb9e5ede290a1643cba3dbc96b130d3cdd524c4ee480
- SSDEEP 1536:eOSV+cfeY/y8SIWI2MoE98zu7KKHm3N03Povj2cbb:eTVReY/yv8loE6cK2m903Mj2s
- TLSH
  T157838D53CD099B839448C3F87F572D6C2B1D670DA9C57AFE10220F8ABF989616C5A06F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/eqaggq2.xml
- Size 21KB
- SHA256 1d1636ff8d193f883b181efac6d7d5404d8dc1a51027f318f82e1437699d68db
- MD5 9c6571a544b026eda6bfd3d76d91949b
- SHA1 af4a8df59d302ad80e18b044aeed80162ba1019d
- SHA512 eab0211d2ce863babaddd568f09c15b1c564a2df4d98b3925a1a72238cb40e17538f9b2b70adb6021414ac7514a567539a80c99940dccbb18eded5bd80141c03
- SSDEEP 384:HMjVatFafETT5bw/HcqS8QTAm+d6NSIYisgTty8RbmL4nNyBxd:A0db/2FMN/YiJB5ALNd
- TLSH
  T1BBA27E694BA86537CDAB0F3078D1D2124BBA77893EA2D1C7700CC4465F833965AD73EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10