608d1f75d5e8e799dd0bd25af44d55f381e97dadf42d94d6fa031784908a384e

General

Target
28082026_0158_24082026_IRS.vbs.zip
Size 1KB
Sample260828-cd1mraselb
SHA256 608d1f75d5e8e799dd0bd25af44d55f381e97dadf42d94d6fa031784908a384e
MD5 bd2bd1d57d802181f0ffd467ca3b8460
SHA1 a9185a44fa4b4fb4fab1a381b0f59319e26d752d
SHA512 d5d0539f63058c77099e1d47c345773c7edbbcedcda7cadf982a72d3f319b0231670db7a7347a6d1929e560a20854bdb8e0e9ccd0894c997beee28f58d7849d2
TLSH
T1B72165BCE1C00002F21B713E86A65A118E9CACE7F322569AE2641E6A0DAD557EC8652C
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Targets

- Target
  IRS.vbs
- Size 2KB
- SHA256 afd49a39871ed1ef66d138588ddeaf59b34aeedd9e1d98748804ad8c667dd05a
- MD5 26d802de0019ea4be59ec86dce6bf5cc
- SHA1 4a5f5e3b7719d62714d3bbc79cd7b0ea43eeef7a
- SHA512 d7d7a52fff7219d59de11b6855d29e680b042f702f210bd63536b6fc9c28d1b007d2707aae36b47c27754f7fa9ed5212be00795baca01b75f6bc9daf70ed1736
- TLSH
  T1B551A65B784AA2708975022BEB251960E7EA849F102A441CB85FC04B0F761ADD7D60EA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

bootkit costura defense_evasion discovery execution packer persistence trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2