General
- Target loader 1.6V.exe
- Size 6.8MB
- Sample260825-sfbpea1sds
- SHA256 e0287a64a11e9caba038dd3195c5b1667a9701940b4fe38fae25178b24ec7c51
- MD5 98afbec715f3b5e7a6a46a4fb8c099cf
- SHA1 8cf2178c9da95342fd366aebe45b9e5778f6491f
- SHA512 f4339167a89a8b82cd3e1e3c485b6911cab5559df84104589279471d8c389c802e57c065855040ad3873d6cd2430ee88466492f4fb4a4a616ba50e1e7ec68f8f
- SSDEEP 98304:eRdAvWahHRbQAJI4Ny9da8MmnWap175clX:yA+ahxfw48D
- TLSH T10E766D4369EB48A5C5EA937492875372AB30FC2547286FFB6698C2313B73DC0693D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader 1.6V.exe
Resource
win10ltsc2021-20260513-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target loader 1.6V.exe
- Size 6.8MB
- SHA256 e0287a64a11e9caba038dd3195c5b1667a9701940b4fe38fae25178b24ec7c51
- MD5 98afbec715f3b5e7a6a46a4fb8c099cf
- SHA1 8cf2178c9da95342fd366aebe45b9e5778f6491f
- SHA512 f4339167a89a8b82cd3e1e3c485b6911cab5559df84104589279471d8c389c802e57c065855040ad3873d6cd2430ee88466492f4fb4a4a616ba50e1e7ec68f8f
- SSDEEP 98304:eRdAvWahHRbQAJI4Ny9da8MmnWap175clX:yA+ahxfw48D
- TLSH T10E766D4369EB48A5C5EA937492875372AB30FC2547286FFB6698C2313B73DC0693D721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3Visual Basic
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1