d7dcbbacecf5f560cdba086e687de9ab4e0af7c5d8d00762ff61922e1d27810d

Sharing

Copy URL Twitter E-mail

General

Target
25082026_0340_24082026__Serie-01458-DNKNzpsbny.FYVYProcyrph.vbs.zip
Size 3.4MB
Sample260825-d8dbdasvgt
SHA256 d7dcbbacecf5f560cdba086e687de9ab4e0af7c5d8d00762ff61922e1d27810d
MD5 07c9add167e5b347b44fd76cfdb1b5cf
SHA1 3b48a599435dfc1ac9f56ad86dcede1ba4abc0d5
SHA512 c8b310e08502f6bce8fe3f2a14aac4304e0333a875ef1fb8944331d3f600b24112502ac2a4111ff11f80882dfcb87d472ae75ca2fbd74a66561335ddd5e0f485
SSDEEP 98304:tIPOiPF66TrKY3EAJCHvZndlJpspDeQjOc3gRf3f/S/IZ2Ixf0AJhw:tUPI6vKQJCH3JMOcm3rxf0IS
TLSH
T152F5334E883488316410E33BEF414FB649839EBC9D7DF425C6797EDB3CD689781628A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _Serie-01458-DNKNzpsbny.FYVYProcyrph.vbs
- Size 4.4MB
- SHA256 2ec9f5e51b90f12ffde4de308c2f14316563c36f9ad15a38b4df100d9609e23a
- MD5 8791835e065c4a1b39acc45b026d03bc
- SHA1 02ff592da6edabfb3878d7b63aaacac266cbc7fb
- SHA512 6c513873c39815e167d1e3f51be6a58217e471b7d97d46d1d08e35e824213dc677d8b5fb41285e1dfb2024e84763fbf0982f9e2276ecd726f9b533ce397e5ebd
- SSDEEP 49152:kgH8AyUi5s1oRtTnAWLWxaW6OsxqOtoHlmUagm7qFFkI7lYD1wV8GSXMVwA:X
- TLSH
  T1312623706EDD282A487F9A29A12B5E1C1EBC3F0F44589285479631F315BBB81FC3BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/fmlshf1.xml
- Size 42KB
- SHA256 bd69bc6eb3c6df8ee74532723c6bcfa9e76c52113452dd777fd2fd192b07bf08
- MD5 e08dd05ee2aca2a21038d16d22d2e5ff
- SHA1 059ecd848321bdcd5009a5f40d1cb008c6be655c
- SHA512 d5c8a96a8b19136da59d6a88ca74773335cb3c5ca4d7b2274994e8470800cff7db704185c8645c2e6d8857024030fabf54e61646a50f23103cb6dbf96204cb84
- SSDEEP 384:eQZfKFjnc1NyEIYi2mL4/y8RLVH90qM7h8P+:XZfKVcqYiDLk5/6D7mP+
- TLSH
  T185131B70C62B995DF77237301498193E1D2BBDE0A4F6F342A286A97496707025F4EF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/jmun2.xml
- Size 109KB
- SHA256 b3bb763a0cf0679082ff569af9b07c9bd5b08bc5bf63ce6b7ebbd47608de3a44
- MD5 bc2b27cf1d3b9e566038f6c9d0007a92
- SHA1 eed6a1e0b3eb34b1be3e81fda4f2a1c57dcddb3e
- SHA512 10332f7d4cfda926c7d254a5ac5f9ad2177c0266f0a332a7331867f1d38512bff17eb69f226e3193d6546bfccdb7aaa62bb2f37f4cf5d4774ed58334d506a3a8
- SSDEEP 3072:NAX4WCirShYOty/Lo3zaILIdlUfo8zgOZKW9L7yDT:NAX4ZU24OilUfo1OniT
- TLSH
  T1B6B37D93B1D04471E1B21EBCACA9A665A83FFE202D74455BB7E56D494F3C2C0287C2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ~/szlx/dhdyle/btjl/stfvff/yuduq1.pdf
- Size 38KB
- SHA256 fb83dc5c94b5356bbf08a5c3dc9efa6d8812b270132151368d4889f4d926e6da
- MD5 617d685270333d15dc6396c6fbc137af
- SHA1 83284779920af6efdfc446c93cd311c2e61c38f0
- SHA512 5e0fb70babc5bd019665e61bb09dc33a56bea963703ed8d94568b89b2cbb1f7ab28a51954dac4ec263ac89f4023e3c55cfbed488147eb7e9c36f5cc57ea363f9
- SSDEEP 768:L6IlCJijP4KMByHhpNEOcpzI0iZGIqwFxMO1DdUD3mxDYvz4VdmfiIvftKu//31v:L6IygwK9BpNOzrGMmxDMz4V2vfvPFuQl
- TLSH
  T13403E1B06231B809EAD7675DBFA13D49458E3A42CDD128C3D8618AFF7574AD39862EC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/szlx/dhdyle/btjl/stfvff/zftsyq2.pdf
- Size 50KB
- SHA256 c33304d34b9799a06d29ba2a4b160445cd94ba892de077a321d3292458a63383
- MD5 4377eb56186ef009b493c0b00556d61b
- SHA1 85e752e03b8067de74787fd6cd2e4b827f91efcc
- SHA512 01ca5ddcb8cdd5d324af96023a26ff989101f7c1f0f68f79f481c8d722ae516f5bc4f6942470894c418dffb38e3f4cb1fd0f0e479b50b1a656550c3377a95b0d
- SSDEEP 768:PsawPoTXiM4uRy7DDn+pSSLdNyRI7NlHAj7cismMUFi+4BwtIjOYgnpJAPTc0k7T:UaH/4eymSINntpvMejgpJAPTc0ZPA2c
- TLSH
  T11133E178D3277D1AF986EE8245727EEEC538F30451E8A0527BEE1E85A3C1DC626160C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10