c59a4dc81d1d930fa64c7b0a147334786f463f75687a0b37da678b9244bf102a

General

Target
Contracts_and_Specifications.zip
Size 13KB
Sample260828-w2ql8ssbja
SHA256 c59a4dc81d1d930fa64c7b0a147334786f463f75687a0b37da678b9244bf102a
MD5 fcc90b5eda72eabd28733462b46e7f77
SHA1 f6889674d84e7b4214c0457a9cbd682cf4cc6719
SHA512 fbb7a7d841f40bb792a940d45084e69d9b8a74b3b6434be25ac4bf773857a39499939065144323c6dfbdf7c7d26565675209782515f05633a41952baadd50800
SSDEEP 384:ZrgHaR6V++K2CDGfTUXvEOmoN7W/2bQ8TyfMIj4oW0NI6mV:ZraJE2C0oXcyI/EQ8CMIjGfbV
TLSH
T1C152B0D12BB907B2ACDA747260C4BB32C688C817950ADC9E58CFB5C45A1F87C99DA14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  contracts_and_specifications.pdf.lnk
- Size 1KB
- SHA256 6398a04d43f264241ad46c6bf172e173424f79ed4f5e5467eb1e913ae63f9697
- MD5 511ac68c37bec4d358ce77df83e4f5d6
- SHA1 cb049c93f18218ed0f7f6dd2d2f95554fddb78dc
- SHA512 7d30d6f3af54a9da585f363225fd6bca77fcdfa80c76bedd00a5b22d350e7a976a7391f642b33a345d638307150b5a7bcd5ff7a5d1993e0d6ab42193b6ee73e8
- TLSH
  T1E71126A02AED0754F3F19D32583787201839B4148D12C25D454111445CA2E14CD3AF76
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2
- Target
  styles/styles.min.js
- Size 30KB
- SHA256 0ff64c81f7848abadca3b7e3698d969730fd3307e4d7b4d2f28135ae868b41d6
- MD5 a8c735c67603ff33a30d58993f91c2b2
- SHA1 46dce32016f628209570b59bc797b9d6e5eb1fc5
- SHA512 9a83d6ca7617fffd85613752004491d1d41db35f71a489ba3b2c189e40690c391ee6089621fcccfd312127e69884c5da9649a8fa32fb54a127b2d76ce3861646
- SSDEEP 768:UfJttuvOLp42R4hfSA7GWUB9KjOrR/h0BqdrN1tmjiR0YAgb4f0G0:e4qyWBDk0OSi0
- TLSH
  T1DAD2438627C06888DD1BEBBF3B35A2E4D4155DE6D7C1088DF6143868F9F9D0A9AC47B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral3 behavioral4