491f55d44e366e199f9908e064517b1cf362ec9a0820bb169a17f18ef70e2977

General

Target
qtHaSRjEErA29WqEj8HIxyEcezaZGOaE_2026-08-31T09_45_04.588Z.eml
Size 2.6MB
Sample260831-mddhbszdnf
SHA256 491f55d44e366e199f9908e064517b1cf362ec9a0820bb169a17f18ef70e2977
MD5 95ff0429ad7f29bda5424c336aacd1e5
SHA1 31c6ff69ebf1e7af903b349c751b072bcceb647d
SHA512 7481eeec7259928c5f659a113ace4418cf70c11ee3f185cb31a8811e68f306c0b27bc01d07bd3e030adf037d9c6cf5dc9825d895378c4af8d2ffeefee7851fac
SSDEEP 24576:ZxjqXha6WFZRwikCq4gcheWlbRFpukWeKMO45jdb5Noybd7ER/IrabPUr2XKMvKM:ZNsaTpQ2flmM/ddxQxZ+9EhdDiXA3KU
TLSH
T176C59F7A4C4D279E77325C6ECF07643E2D8665EDB24980CF699FB1FCD3660609628CA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  qtHaSRjEErA29WqEj8HIxyEcezaZGOaE_2026-08-31T09_45_04.588Z.eml
- Size 2.6MB
- SHA256 491f55d44e366e199f9908e064517b1cf362ec9a0820bb169a17f18ef70e2977
- MD5 95ff0429ad7f29bda5424c336aacd1e5
- SHA1 31c6ff69ebf1e7af903b349c751b072bcceb647d
- SHA512 7481eeec7259928c5f659a113ace4418cf70c11ee3f185cb31a8811e68f306c0b27bc01d07bd3e030adf037d9c6cf5dc9825d895378c4af8d2ffeefee7851fac
- SSDEEP 24576:ZxjqXha6WFZRwikCq4gcheWlbRFpukWeKMO45jdb5Noybd7ER/IrabPUr2XKMvKM:ZNsaTpQ2flmM/ddxQxZ+9EhdDiXA3KU
- TLSH
  T176C59F7A4C4D279E77325C6ECF07643E2D8665EDB24980CF699FB1FCD3660609628CA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware spyware discovery persistence
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  invoice-INV00061952.pdf
- Size 129KB
- SHA256 7d6297fa15713f402dec521e271e520e25af74f9beb0b06652b52786dede4800
- MD5 2d5a83683212fdb805f20baa340a84ab
- SHA1 3f310c1099f168c480327b349019a1fc719188ac
- SHA512 d5532412c9dc6d23fd5bad91312c7e741d093e54c553c93896452d297dce6134b6103fea32af5de4bb1c17d48de5eac31f510f1659b7203debe16968183ea2d7
- SSDEEP 3072:XdURdyRIoWO1BTII09OnTLGTr6PYAEYI1l:Xd7mHO7/ngOP55Sl
- TLSH
  T112D37D70F58D8CCCE9C7DB3AC1B9384E4A5DF94BA9CD748401798A19E402DE5BB93287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  statement-chriss-team-2026-08-13.pdf
- Size 30KB
- SHA256 75c0c11a58c7215d50dadf86e54e3eaf2b6fb044518b0565e81b5b85bb21797b
- MD5 6e9f46197fb1cfa0685cc97300a046d8
- SHA1 e5ac3667b5aa1eb998719d503a03d106d2d5eeb4
- SHA512 349651e4f200519736206da7ed5fab6439ec38c1e09a8e1a8df8b82e19187e655b68aa30e293dbb593a02ea50b0371d8cb247de31df8d27f35c311c576cd09fe
- SSDEEP 384:+vJkm708t5iSL/dYmIfFqtA6BykW07iQ/kZ6RmH5aAdtdXctNNQxXQY2ZVd0ph5V:OYy7emIfgVykWAA6wp/cOS93YaJG
- TLSH
  T1A2E2E025F40D0CC8F49349523231328D813FF0A756D4B5D0617E8BAE716ECA92B76FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6