e2d51ed831c9f6277b84996d2e5f9845b6eb1c95e27e9999908d4f9090c1ab55

General

Target
27082026_1511_20082026_Instalar.lnk.zip
Size 109KB
Sample260827-skvm3saa93
SHA256 e2d51ed831c9f6277b84996d2e5f9845b6eb1c95e27e9999908d4f9090c1ab55
MD5 a7301b063b4b5e668e4366ac51a2a37b
SHA1 4993eec04a06139c1132d0c76b97f0fe5245f439
SHA512 a550ce42ebce938166b7a5065e06d359db7bf5371ff901ddb61d85b72226ffd89f6f1d7e1e49f86e64ecd5e9a26c88e40f30f8e1b9625effb36bb2a2cc5d242b
SSDEEP 3072:vQxaQcacjSskJiwlWOylYI87QP7WMaWq4NUtT3L2Wxdfx+ZeC:veaPaaS7iwlWOylmQtq4SZ3qWxdfx+n
TLSH
T190B312AB809AC66B39D431D6374A550F44A45B1AE7AF6C1F5F3E48388A23A036E71D34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Instalar.lnk
- Size 2KB
- SHA256 a703e53a4558667027b1555f3dc1e4e4015a5d3e0c797d12a4efa667886217df
- MD5 d95de5f2cca7a1f9ef81e1bb30854343
- SHA1 c26fdde1b5bf05da205a991189a5f096a2c6775b
- SHA512 60cd7672e7f3af15001b907ae044d6ba579084f22279e84c04afbe2316693b4a84e600a4d9c493c6d2152c79d2572ec08511ffa7b2cd12803ab13d382abca7a9
- TLSH
  T10651F1152FE60771F3F1C972587B6A1AEA3BF647CA414F1D50C8060D5C42A00A829F6F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  microsoft-update-cache/Setup_210.exe
- Size 84KB
- SHA256 3cf77a0f9ec79fd6e3896bbac765ccf95ad9ff6c5e12ed1ac3f8f542cd21b111
- MD5 742b56fd4b6cef28a915c7f0be396335
- SHA1 d47f7683cc118707712f38ad23e43bc20a1b8b27
- SHA512 f4e9d0646521bc7e42cd3cbc09369a8aa998c69859f26db00ad8094e2a792eb9c464d574a8d10928a5b5c1ed8aa851d79c7282b3c6c6f16c947efb1260b5c66d
- SSDEEP 1536:Qz8k7T/NKRPc7R3kUTDmdA0H6X+mGZvMMQ9nJrj:Pk31IPctkUGdA0adMQ9V
- TLSH
  T1AB83071EB29834E9D16A9238852A0215E672FC3117111BEF27E4F23E5F37AD1AF35E50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  microsoft-update-cache/version.dll
- Size 175KB
- SHA256 879e94c533004386f1f4441a2c108705d6fa1011418598b7c0e3719114d5404c
- MD5 5df6b51e8361337ab7ba350ea3a32879
- SHA1 8868f6ad8029e20187b7b51d46e607a264e5e1c5
- SHA512 384608ddb604d453507f00ddc396ad330d4a1c221c9555fccce5d905a408ceb3436a2a68b3231a5f73945cad4caaf4b8a945e19f090795d2818354ce33d2872e
- SSDEEP 3072:WtmCnB7ttpfAU2VQUACx/TPM78Um8tYNpOjkiQcThRjNq9uoQ+0f:WtmCnB7tPfv2VQUAcT0VshdcThRnoQP
- TLSH
  T1E404387D76A900AAD57A9138C592860AFBB3702123111BDF02D0C27D9F17BE87E3DB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  microsoft-update-cache/wtsapi32.dll
- Size 20KB
- SHA256 0ee3793aab982c28a07acbd94275035d68ab36b65e84c33a47e2d320eb924cc9
- MD5 62cf481daf5702fdb48929c8523d1765
- SHA1 38fa92506473fc39b1d92c49ae9af58399a24729
- SHA512 e0b1a8bd42e26c1e33381677439de3dc9dfbfe8c3a75728d284402a110892c6864c8bd77bb45cc8ce904724345ddf5049f657af378005d152c2b3960e992b3d4
- SSDEEP 384:FDPCtiaNG7uggnYZei6+RfXlPNuAMl3Dc1WiW9YW:oeRZei6+Rmlzc/W9
- TLSH
  T15C92E64D728702FCCED3D6B8D5B64FB5BAB1B84154120E7B0798C23A2D614D26727F4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6