482fdefa1457e22a5d666708b46d30560e5ce40f3059294802acfb84e39318c9

Sharing

Copy URL Twitter E-mail

General

Target
23082026_0059_16082026_payroll.iso.zip
Size 5KB
Sample260823-bccnvswvax
SHA256 482fdefa1457e22a5d666708b46d30560e5ce40f3059294802acfb84e39318c9
MD5 a6a98e9bd7d8e4ab07498b6fecea88b1
SHA1 6c34e41383c4c84f7a4c257afd20529ea2441155
SHA512 7eb22f1029cd3ab5aff396c5a4aeed49499bad7234803883e67d456800d5b5c13557531d5859cbcae087d204b34837623f8c9618900d0e08abf089f5c72d3a44
SSDEEP 96:NOE+opplgElyb/k/BQhkcQec7yO6eGFFEP9iiM8+qkMLLqPbbIVLt:N+opDgEEsyhQecpbpWlPXIL
TLSH
T16DB18C89A6B0F110C3069E7BF2D52AC227691C4C35AC025A4FF03DD7B46A17E163ED95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  payroll.iso
- Size 64KB
- SHA256 a940b2ddaf0ae4ff86186c27177d149fa9a4ada23d6b871f8e4bef622a459e8a
- MD5 5c31d8d7e7f2f3c87374cef0a4b8e892
- SHA1 83ea8d2bbd00a7a22628ab30335967f4afe1fc2e
- SHA512 ee0c884b80c687b7f7475ba5d0493833c6dd968651327d7ffeeb39926cfdaa6ccddc08607fd2b959faaa0a87d00ae5db80fc194c2f10f3c770b95a81d730e021
- SSDEEP 192:4A87kbacfO0hGTjLJSIhksapSHmBNrYXNRcFuLRL/sG:4Gv7IBkjSUNrY9mFuLRL/9
- TLSH
  T193533E3D2EC6A515E0634771347375982D6BA08BD0B54587320C63F227DFABA99223FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  payroll_helper.vbs
- Size 8KB
- SHA256 f09d508169ab56092971a9eabc2bc535385032a9f326af8adce59ab1f160c0b0
- MD5 4599f8e8febb6aed8b8ae826f2e1fa7f
- SHA1 b38c0e2c157f6033614bb72d5a10a61ce953c7cf
- SHA512 7c87fc736289205584aab9a18202776c54918e9d62dcff3b51af57f63671d04e93e9cb9ea913a38a1b46ffb2ea7bf3290d67b30ac8747aa7a8cbfd1212a57185
- SSDEEP 96:iArbKiV9ZEcfc6M10hGTrrDWiUCJSIhCL41apStVHipLIyzNgWY8:zbacfO0hGTjLJSIhksapSHmBNrY8
- TLSH
  T1D202B23D2CC6E029E05753A0343379DD6D68849FD0B599CB2701A3F221DDEBA95262FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution backdoor defense_evasion persistence rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- GoToResolve remote administration tool
  GoToResolve is a remote administration tool that can be used as a backdoor
  backdoor rat
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  salary.pdf.lnk
- Size 1KB
- SHA256 55390ff5d619126bcb98b7f1977563640f2a499f20891dd859f2d893205ec922
- MD5 d3bd2723341a2fddc11dd3b54f91f759
- SHA1 a89e608777a4d22f630bbe12e1c3247561851587
- SHA512 c0af13e0a1aeec109b5c47182d9d6ebbcaab4d4ec1488b5585e285c98a4f1917837ed60e8f1bb7cf9646775d44cb4423ac1b38331fc178fe1749ce1ae6582c39
- TLSH
  T10C41C0191BDA1B25D2B2CA3728BBE3218671B815FD278F3D06C456C91D25200FD36F2D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware backdoor defense_evasion discovery execution persistence rat spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- GoToResolve remote administration tool
  GoToResolve is a remote administration tool that can be used as a backdoor
  backdoor rat
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  salary_2026.pdf
- Size 524B
- SHA256 dd432acdb4eee7a86900dad57f5282a14e796c439289353c5e7cf46a97cce9dc
- MD5 e3e8898a35643b98394ffe8f5a96a5fc
- SHA1 7a38d4a1ead02737a967de7f1c348bd5934c186b
- SHA512 6d099c8a1ddb93f342e7d7471d2d821a6bead21d58dba566bef3418f56ca31cca21f42a1da25e5bd55dea551a7ddbdcfb7308c9f5aa23e26fc188efc3ed6ca5b
- TLSH
  T184F05208EA1EAC8CF812CC01227B3D2D10ACB242D3CC38D3332D9B448480D38A383AA3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Checks computer location settings

Executes dropped EXE

GoToResolve remote administration tool

Loads dropped DLL

Enumerates connected drives

Checks system information in the registry

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Badlisted process makes network request

Checks computer location settings

Executes dropped EXE

GoToResolve remote administration tool

Loads dropped DLL

Enumerates connected drives

Checks system information in the registry

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8