320763f4ac63a15f2a9b690c1d7adc753c3d8665b1371578f80a25417673ec95

General

Target
25082026_1506_24082026_I.T.R.Number-20260824231719.IMG.zip
Size 2.4MB
Sample260825-sgr3sahf46
SHA256 320763f4ac63a15f2a9b690c1d7adc753c3d8665b1371578f80a25417673ec95
MD5 b4360e34a03b73b99c6825e58ea91c5b
SHA1 353191b870ef10f573f44c79446d108a2946fc97
SHA512 e85fa8c895b8e25d1d0afe7f8618c9e4dd1a3c9e7a6bf8e58030a62e34658d1843498487bbb9c182e39b45e5739e39e6b9a86b2613b92983520fba62cf831426
SSDEEP 49152:JedFwZHBU/sT27t/Oba8lCm8RVjphv+0w7FJOZdIXP7+giy4:CkHVTKkCfRdph2ljFqgS
TLSH
T15BB533485F85E16578CAD17F6E339EE427D433121C4670C1B78EA225DA8D02D8CFBAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  I.T.R.Number-20260824231719.EXE
- Size 206KB
- SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
- MD5 8521949e487368f1708d68ffcc581665
- SHA1 a2c753371ba79eb673ff4987d9044af9c7a1b89b
- SHA512 7722abb534f11dc71ac0797d881eb5c2dee524e19d99c219697efa1037164d92a23a5f098f76e5471f1bcfbcb05b44c497ba85f724267cb70591a448af4358ba
- SSDEEP 6144:UJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg:SGQ8y3CtcoRv6i
- TLSH
  T1CE247C1536D1CC72EAE3083564E8D676597DBA703FA649D7A384033D7E207C12F38A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  arphADump.dll
- Size 4.3MB
- SHA256 53d7e3c7be67f0c0b2513df889c5d0b516a92b4ea0ee9f01fcc022195c75508b
- MD5 15e07bdfb91622e4384696a9323802e8
- SHA1 09fe792a3f4262d566aa6ad3686f36afdf133ce0
- SHA512 afdfd29811bff32e91140bc89777108bdcfad2d7a6c20ac67fae215de0074233945e344ec7b73d4b7b13756ad31ca87f3f731b5254b0c669a48808fd58a06407
- SSDEEP 98304:AzmgmbAKZGfcFy9/ZB/TSVXRWNoDhCWt8ZQjg6mEsQDdjbhCzJK3w:e8sPbxvoDhCFTwb0zg
- TLSH
  T11526490336E1C4EBF22642B1E485DAFA926D6D501ED4808339CFBF3739678509E762D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4