f0821c684c465c9949cfe1e03c525275faf8f0b0266b5882b66d6d44eb228b68

General

Target
24082026_1416_24082026_CIT-Number.20260824134702.IMG.zip
Size 4.4MB
Sample260824-rlbe6ayhmg
SHA256 f0821c684c465c9949cfe1e03c525275faf8f0b0266b5882b66d6d44eb228b68
MD5 97752c02c32997319f405d8ec6cc36ec
SHA1 a087964f723188bc50bcbb4e1893c2d55bed5fcf
SHA512 862d97783275b51edbbdf91f4314ea950e283573b4e571f8821cac8832f4916d43459e65a39b17f0818c070e961d54fee1e9bf801548c88c8bb3417d94a03a99
SSDEEP 98304:H1oamORiWClyNfBAFeM+rmtg3ogFr8Ice/SzxFyn/LfX:HXRiVlyMe5ocoIc9xM/7X
TLSH
T19F2633DBAC61E2EC95F4242F77CF2BA2A5F6CC6B503C3E7650985298181E5EC90C4E47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CIT-Number.20260824134702.EXE
- Size 1.9MB
- SHA256 4bfa832e0b5d59d5498d85071020167e97b06c69aa43cca2cfccd0c91d535c1d
- MD5 c7d924f8b54c44e1edaa87f9b280bf39
- SHA1 9d2f655e4320e82f3774d4fe6bbc18b5857dada3
- SHA512 db24aa1727eda71e59abd7af3f27e9d02cd7535e420829fbe2c06df2a6ce7caf56f2d4cef4576ee86902364fc4107b15fe75da46ec9f9ae8a26831ae15501aed
- SSDEEP 49152:RRyEN/rc7xPAr4ooPRU8EpbExYYBt3v24/pL4zp:RB475AUooPRU8EpbExYYt3v24/pL4d
- TLSH
  T197958D00B662D075C853A075A41CE3393E611E098B3B8AE3DBD57E957FB11C2173BA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  nW_Elf.dLL
- Size 5.6MB
- SHA256 12e69c188c8b9b428dab8fd73cdf3ce6ac0ea33309e00907f45afc8401afee2d
- MD5 d52da57625da1e97c7bc6b27a42321f6
- SHA1 d3c0dec751aff693452b1b6bf23318fbbc32b642
- SHA512 ea950a03b58e74129e8801f4181df818d7dc08c67120fa77617e1500a21b22c4378f1fb47db0568bcad5dccf3aacbb63351f50abb8911ceb7e1b854451bcad88
- SSDEEP 98304:2V5P7S+0l2GSiJPnzHLmLIDakLaKQJpXFxr5n6fyq+nkDOByQfoOiGBx5A2NwKEx:ahOz2GSa1LaKQJpXFxr5n6fyq+nkDOB8
- TLSH
  T13D56D0113D5C80BEE0AA12338F69A2EDF3BE7DA03B25315B1680F629FF357425A1455B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4