2e18394457424727246f796b80d9c36ce095791b279c2eb55f61158eaa27edda

Resubmissions

07/09/2026, 03:31

260907-d3anasbr5t10

07/09/2026, 03:26

260907-dzah5awtbs10

Sharing

Copy URL Twitter E-mail

General

Target
Trojan.Asprox.zip
Size 224KB
Sample260907-d3anasbr5t
SHA256 2e18394457424727246f796b80d9c36ce095791b279c2eb55f61158eaa27edda
MD5 9077ec98bd1a022616452acdc2d59799
SHA1 b70a2e8f750b9ff50f6d747725c0ff0ec5ad7823
SHA512 45c6b984d084509122a4c8afe0e82f8a179614fe7f0498c9dfc37fe7561cd60a47224e7b724f9b381ec9802221d28819d11fe8ab01309b4110e49005fa9d261e
SSDEEP 6144:SVSkzVWbiexiQOCJAsCOrastbs+6HdwNg:S0kRiiTQOcnraEsZdL
TLSH
T14D24234F43F3EA367DD6BB6C222CD54DA55320CD8A60E08AA3175744AD1F62C794BA0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Trojan.Asprox.zip
- Size 224KB
- SHA256 2e18394457424727246f796b80d9c36ce095791b279c2eb55f61158eaa27edda
- MD5 9077ec98bd1a022616452acdc2d59799
- SHA1 b70a2e8f750b9ff50f6d747725c0ff0ec5ad7823
- SHA512 45c6b984d084509122a4c8afe0e82f8a179614fe7f0498c9dfc37fe7561cd60a47224e7b724f9b381ec9802221d28819d11fe8ab01309b4110e49005fa9d261e
- SSDEEP 6144:SVSkzVWbiexiQOCJAsCOrastbs+6HdwNg:S0kRiiTQOcnraEsZdL
- TLSH
  T14D24234F43F3EA367DD6BB6C222CD54DA55320CD8A60E08AA3175744AD1F62C794BA0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  newAsprox.zip
- Size 122KB
- SHA256 217ee4bdc92290e7f67fd89bbd63109c5f1f90bdbb886c3956de571e2b97a29a
- MD5 cd2d62121475256daadfd93715af72e0
- SHA1 a00a5aba61b7f8e9439019e2c1f074081fcfcf64
- SHA512 e61b5f1eabec99b5300b8cb03c8ccf37ec6aef1d047ac3565f003110ec35f63954230b72d9d6c2b443abed448465b6b21e785dad88914eb37b82ebf9c50393b7
- SSDEEP 3072:7vEuQvu4HBqS5pa0jCASpi8GnlOFaDeyfSTJo24FBPFKay:7X4nd++ncFaDt6GBPy
- TLSH
  T1BEC31246D026D133C85336EC6F7A6A33003D74620F609A3E169832D796B51E7C77769B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  WalmartForm_San_Antonio_78218.exe
- Size 90KB
- SHA256 f1b8a10f27cc597281bdd423fd7e9829ecbf036ebe6e7e00d054c55f01454bd8
- MD5 d062d420e2ac73b0211afe30063807fa
- SHA1 c3ba72fb3f48bd3b4a5fe8b04e3f8b8398e624c1
- SHA512 761ec98c589349e4e511fc255531c5f074b810c56b9b3cec1d9477ec383686e6b8c1d99840f67540c8e83ededc5abf573371b2743ae5a5f58c3900fe9bd8e599
- SSDEEP 1536:eTFOnhmTIgT+jv+d6tS5s8li+C89pjIk7xpPnXv0HX0cFNFXf3FBsThnzUsHR3ey:eBTdPj22FLnIS/0HEQFIn5HRg/
- TLSH
  T1B69302C8D9BD0160D4108AB561EFF9AA8637EF1F10711643B62DF432587374A92E4DFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  out.upx
- Size 138KB
- SHA256 0388cf2ed6137ad8588ac187487529c36a5813785038cfe9eec929e5e6575567
- MD5 95b134b537955543ab95accc02ec1b0a
- SHA1 d5fe14e8b3e93d549d29735fe1b9c89a4c3375f9
- SHA512 5d5a97ae9b4d4637376f2726bb7989407dcb91d1835713b67662b3f054c84cadb040aad0598910d3348a8faaa18a297db6a2f169ecce234948a9260856d5c229
- SSDEEP 3072:VHUtRGsaEKCUkccrx3/N0dRzlcO/+N5TLEvbUOT:VcRNapdkRvUzlcO2N58TU0
- TLSH
  T1BAD3CF127882C073C0526D7049B9CA79997F7E361F72648B3B6916BE0F316C2DA2935E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  d0000.dll
- Size 74KB
- SHA256 c56792bea8ac5fbf893ae3df1be0c3c878a615db6b24fd5253e5cbbc2e3e1dd3
- MD5 0d655ecb0b27564685114e1d2e598627
- SHA1 9834d2149842cb807dcfd6b9282eebbfc27f64dc
- SHA512 657172e7b19bfd286d7f1f6336ff8638cf9a62686f72f955a3dfe519a923c1aa953bdf4f533c39cbd6b9c10dffa2101f0f0770de2696f3a8e79c413a535a25ee
- SSDEEP 1536:MS1LKOuMVMCL5D8Nbv5BXg06v/0DNHUYbLOyZeZjOLfJxFwKW01uGR/xOi7OCAf7:MS1HVMCL5EL/9KCRihn
- TLSH
  T118734901F3C1913AE1E2507C86B562BA683FAE70175588E367E03E051A787E79FB5323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral10 behavioral9
- Target
  olderAsprox.zip
- Size 101KB
- SHA256 055b91fdb33432d2914191cbeff3c58fa9a2a69653608f44d897ddc1de253890
- MD5 99dcbf247189143cc74b8f98a06a3bdd
- SHA1 508dc8107083a158262eeb0d8cd7d344b25556e4
- SHA512 922b4848ba4cc0cd7665fcdf381219439831d1389e74aea10dea58230853c9fba342adc9c43039b7b92b9d8d5206e60dbc3b62db60cfd4179e09bd43c98cb4d0
- SSDEEP 3072:HxjpomoSHNbOIRA31C/bhs7dlKBiXc1luYIZUFp:HjfHN6ICENqlmLuRm3
- TLSH
  T17AA312D9BCC0DB1D858993B45C4C681E653D842F35AFEB5B386C4FA5838DAFC8681096
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  80000.dll
- Size 66KB
- SHA256 0abbe08ec50615e8c1e87192d61b1419e7780251a035e72ffd92e0c6cde60ca2
- MD5 400439a05c61cfd61625749a7f1fd8f1
- SHA1 8f5b0e02f9c6ff5547410e45554996fb64df7002
- SHA512 2b05470280fde4fecda63035fa397798ae6b18f529a634040282ae9f8969ddaea488662e9f17848db0443b0ce99aa35bd43e01ddaa295c81629c95ac06514beb
- SSDEEP 1536:i1CNFN96i6NI7q8U3gW6v/0DNHUYbLOyZeZjOdfJxFwKW01uGR/xOi7OCBKzR9dT:i1C3NSeW8UF+hT
- TLSH
  T1E3634B18D202832EE997107CE5F4D6B77C2A9E300785D4E367E2AE4545B5BE3EA71313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  US_Airways_E-Ticket_Print_Doc.exe
- Size 92KB
- SHA256 4bb1d2130bb7ac35a03eb2f1eb483fc74103cea2086f3fc6984cb8724bcbcbfc
- MD5 53fec0c29fb30de88c9a6a369e8cae62
- SHA1 597b9aab24a0bffce34407f5ea8c5082dc4bb3b2
- SHA512 852645ae4e7cd4f9f80061f01a56715b3240a7831f00f72f897d12809cd0bfdffdcb218aa15e89b99bb269e83e82cac2d5adfda628969dab8b8f4fac7698bcb8
- SSDEEP 1536:IKt4CZ0XlXogPZEtEFNxVJz4sqAbyYPNwHBTUeC3R0FrPQxnLiaO:34CZ4YghAqVFX3PahTULmkn
- TLSH
  T1E993DFC2BD85C472E28145366076CC5A4219BFBC69A4E507BED47EC322BB283D17B91F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Suspicious use of SetThreadContext
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

UPX packed file

Modifies visibility of hidden/system files in Explorer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Enumerates connected drives

Maps connected drives based on registry

Badlisted process makes network request

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16