1f152d92c72ee6019cd36f2710f34446bb68ef8f16844d0ff0d2c87406e4ae7b

General

Target
28082026_0224_27082026_Account statement.IMG.zip
Size 4.0MB
Sample260828-cvsngabf36
SHA256 1f152d92c72ee6019cd36f2710f34446bb68ef8f16844d0ff0d2c87406e4ae7b
MD5 eea4e7af4d5d476339c3a9aa0ad30290
SHA1 5a63966e015b09023dbcdf845554018fa5b952c0
SHA512 0e3df780c2015667b9a7575465cd1b7c19c5b138d44360bbdada484342f024d3761c76e91b6334a05d1e913ad23cc143a3afd5d33952dde862e98a462e96b17b
SSDEEP 98304:mdZqRYoeOrW6v5DYD6bhh+m+e86aeJZ87mi4ISWM0AG8gIb3Tqe:ecYhOK6RDY2D+ZF2ZfLLWMngIX
TLSH
T1A916336A754B870B58FDD065FF7FEBC8245B861B7428438A04385DCD0A13BC2AD9CAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CIT.Number.20260827124236.EXE
- Size 206KB
- SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
- MD5 8521949e487368f1708d68ffcc581665
- SHA1 a2c753371ba79eb673ff4987d9044af9c7a1b89b
- SHA512 7722abb534f11dc71ac0797d881eb5c2dee524e19d99c219697efa1037164d92a23a5f098f76e5471f1bcfbcb05b44c497ba85f724267cb70591a448af4358ba
- SSDEEP 6144:UJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg:SGQ8y3CtcoRv6i
- TLSH
  T1CE247C1536D1CC72EAE3083564E8D676597DBA703FA649D7A384033D7E207C12F38A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  arPhaDump.dLl
- Size 7.0MB
- SHA256 53376d74ce5d281ff9e7754c54c551c350dabb2573f8a2b969e661c15e97c938
- MD5 2c126238de7f6b2b4d4416ca56d6a717
- SHA1 7437e9d63dfe00a35150899ea96d489a4a60eedc
- SHA512 d7b3184cd95efeea0b75f2404b159233835f5f9a577a48d5b4d74763452a655b8404f6c50279fc8de0934f194f2cc929eeb71a721621ca17d3cacbd4268381f5
- SSDEEP 98304:rR/b0jde9gl7Bjro8iFg9rggUqrmdr/+sp3I4oYv/7yIaBBuBBI0/z0XqhS3tvpr:kn3Uqrmhp3sbIaPkBI2aqhctn5
- TLSH
  T112768C1377D0D8A5E223C374C981E6FD466E8E610F58429336CF3E3A78738915E686E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4