400af984778fae55c8ad6cefe6e034eb18c8e291ad2acddcdf666f79016cb594

General

Target
24082026_0906_22082026_blockchain1.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀tarkovvv.lnk.zip
Size 4KB
Sample260824-k28x2avemc
SHA256 400af984778fae55c8ad6cefe6e034eb18c8e291ad2acddcdf666f79016cb594
MD5 ef4aa0f2d4fd2a65165168febaef35ce
SHA1 c85f9e2754f1efb3fd082627098abaf8ad5183af
SHA512 9b0c26bf48306aadb4dd935f8fc40a3d26c2d55e43b4e8d85b0dbfad0f3e31eaf8eafe09efe28a521ab4afae75352d8502818e30c22e15ae8335a6901891a3d1
SSDEEP 96:DdapDIp40kcCBUZj2ld+4fgCBUZj2ld+4fU/:Za+p4Dtz1tzU/
TLSH
T19991B60593EA7291D8E23D3BD84D22791AA4240F742B949F99D0F4E1CA5F3B907DB50B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  blockchain potok2.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 14KB
- SHA256 3e68410a174a44e9784cba0eaf042bad47e2077eabf3640a2321b981229b80d2
- MD5 b1242f8f41635faa29e984d3e69ef81d
- SHA1 a95ccfe948580e61dcc84048769962a20fa87aa6
- SHA512 2225a609671764ebf8d4b4d6d1dd7c33db8920258f859ae8644cbce36f1503c17624acd39af4133dc4d7e68ab0ef92d8791545aa9ba2e9e03876ab8c2461a612
- SSDEEP 48:8kmMlWgYZMlDX954/aaWCYnvRM/vWczTD7pMI9IltCadrL9B:8k7N95iaaMncMCloL
- TLSH
  T1E662C030D7BD0259D9BB893DD45E52106A737522E63DCD5A52CC230C53A3906E46FF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  blockchain1.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀tarkovvv.lnk
- Size 14KB
- SHA256 103a366cf2d7ea71b36ad10eaee681536ee53d949c873798e2924156ad35207f
- MD5 9fe8c26873f92f05bad7a2d000c84455
- SHA1 897d15bad500ebed798da033b79124a263029529
- SHA512 099213ef3d4b9c976775b7fa5e3ba7a8a8aa7af5a4ec866f78cf50c3dc0b44d46990e62dd1d27dc98147ac02678974ef32b5a297b8ade8be8a2935dca0c540fe
- SSDEEP 48:8MmMlWgYZMYDX954/aaWCYnvRM/vWczTD7pMI9IltCadrL9B:8M7Nw5iaaMncMCloL
- TLSH
  T1F262E12097F90359DABB893CD86E92106A737511E63DCE4E12CC234C53A3915E46EF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  blockchain3.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
- Size 14KB
- SHA256 3e68410a174a44e9784cba0eaf042bad47e2077eabf3640a2321b981229b80d2
- MD5 b1242f8f41635faa29e984d3e69ef81d
- SHA1 a95ccfe948580e61dcc84048769962a20fa87aa6
- SHA512 2225a609671764ebf8d4b4d6d1dd7c33db8920258f859ae8644cbce36f1503c17624acd39af4133dc4d7e68ab0ef92d8791545aa9ba2e9e03876ab8c2461a612
- SSDEEP 48:8kmMlWgYZMlDX954/aaWCYnvRM/vWczTD7pMI9IltCadrL9B:8k7N95iaaMncMCloL
- TLSH
  T1E662C030D7BD0259D9BB893DD45E52106A737522E63DCD5A52CC230C53A3906E46FF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6