c45bd087ff8dcb62963e60d84f54b868de44b3c8b937e5dbb0f99a8cdefc2c90

General

Target
gh_2026082521066.zip
Size 3.1MB
Sample260826-plnz5swtcy
SHA256 c45bd087ff8dcb62963e60d84f54b868de44b3c8b937e5dbb0f99a8cdefc2c90
MD5 b1407c4fb39a6b2df5f33008a0100b93
SHA1 ccb52f2d49b973470d46f9583305daeecc18a67e
SHA512 ec7fa9786bae01166ee700640971bf1fd9682d7d74e6554fff98f5d29be898e0f81fc179f2992a9d58043732b6c087553514385d9ade75be64eb7661706ac983
SSDEEP 98304:gg5aI24nym5460oESGN4O1wOOg6r3cvoOSDsZbQ:95tnyplSCo3woOSDsVQ
TLSH
T153E53363B4ADDE0A22111234D5244ECD4DE74732B84777D97E3E8A13BE57268E2FA870
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  G.S.T.Number-20260826001108.EXE
- Size 206KB
- SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
- MD5 8521949e487368f1708d68ffcc581665
- SHA1 a2c753371ba79eb673ff4987d9044af9c7a1b89b
- SHA512 7722abb534f11dc71ac0797d881eb5c2dee524e19d99c219697efa1037164d92a23a5f098f76e5471f1bcfbcb05b44c497ba85f724267cb70591a448af4358ba
- SSDEEP 6144:UJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg:SGQ8y3CtcoRv6i
- TLSH
  T1CE247C1536D1CC72EAE3083564E8D676597DBA703FA649D7A384033D7E207C12F38A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  arpHADump.dlL
- Size 5.4MB
- SHA256 8296c899c1d37f15fb00c12b60950e2b60442226229ae52aac8d2a1b02a114bb
- MD5 a5974023e68efa872ec05c45ccf93e9a
- SHA1 382aaa5ffe6468de18175f50311b095050eef47a
- SHA512 967422330cd4d4bb45f32de8c283270c03a45559f2d7efa371cc0cf2128c0c07426ea87d13edc2941c653aba4d99c699c4efa708f86cf7f14cf450753b2acc9d
- SSDEEP 98304:aaTxUs64oh8dWXkINb0YcrjWnS6ULjdf15GvGeYcCv:RTiZ64/crjW9Ud9fhc6
- TLSH
  T126466B0337D184E7E22A82B0E495DAF8A26E9D501EE4858B76CFBF3739638605F701D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4