ca7fff8100c214ede95080dffe4addc10db878e2678986f0fc53c6e49020d68e

Sharing

Copy URL Twitter E-mail

General

Target
202609071542_Correo Sospechoso_Posible Fraude_ Factura Electronica Emitida (64563406)_vsalinas.zip
Size 9KB
Sample260907-xxhlhatfld
SHA256 ca7fff8100c214ede95080dffe4addc10db878e2678986f0fc53c6e49020d68e
MD5 a775c7b42b3c1ab82c10f25f3c0d4479
SHA1 f5e6e61431218e7c3738f7aada0041dc93d7f280
SHA512 83ad33c5e6b210939f5ded81eaa05b14d60034f81c3a2e308a02b52b5a8cf63b6264a3734c3ecd6a7a209eee0973d322566c10db6c89d2f3f25319ae2f3eadd7
SSDEEP 192:DmT4LeeViOJjyzjmmqTvCbYhMMcSp0vGOA3ZOi/WZJri6v3xtirh:DPPViOJGzamlYSWJOi/kJrPx+h
TLSH
T10122B0403727190A94A25A350BFE73F1CD59C8845F37EC0A34EA9C925A6F332B9846C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  202609071542_Correo Sospechoso_Posible Fraude_ Factura Electronica Emitida (64563406)_vsalinas.zip
- Size 9KB
- SHA256 ca7fff8100c214ede95080dffe4addc10db878e2678986f0fc53c6e49020d68e
- MD5 a775c7b42b3c1ab82c10f25f3c0d4479
- SHA1 f5e6e61431218e7c3738f7aada0041dc93d7f280
- SHA512 83ad33c5e6b210939f5ded81eaa05b14d60034f81c3a2e308a02b52b5a8cf63b6264a3734c3ecd6a7a209eee0973d322566c10db6c89d2f3f25319ae2f3eadd7
- SSDEEP 192:DmT4LeeViOJjyzjmmqTvCbYhMMcSp0vGOA3ZOi/WZJri6v3xtirh:DPPViOJGzamlYSWJOi/kJrPx+h
- TLSH
  T10122B0403727190A94A25A350BFE73F1CD59C8845F37EC0A34EA9C925A6F332B9846C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  20260906220723-Correo Sospechoso_Posible Fraude_ Factura Electronica Emitida (64563406)-vsalinas.eml
- Size 18KB
- SHA256 5a6e89acc901f8af72fb6f63717633ffdd36e8db8d6cd2e07820bcf97361812d
- MD5 5cc70c4d65a188a0f7c94ecdbcadb1f1
- SHA1 b049f7ca2b94b788186009fc286f31bd76826654
- SHA512 7bc56c00c7da03bb68d8b8976912f97c522ba9d257d25c13311fb3947c52f7b970fc9f72ad7123507d692066d4e46db22a3240500708cc93a5cbf1deaf938f59
- SSDEEP 384:WAxAOqkFMNyxyVzUultZK0L6mW7gvW/9C2/P+m+A5qRvcQ:WAxAOHTxY4at5L6mausC++mbYRvcQ
- TLSH
  T13382396183031027D724A4104CA49E0D1615FD82A17F88D1BC9FBEBE26DF57F3EA5DA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution spyware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 3KB
- SHA256 2c9725d8b9e70974cd25ad295968174c6eea32515a4c5f12b6d4cf165650886e
- MD5 9fdbacfd9f728f7e0287daf35cf4d1d4
- SHA1 5de17bda3a2c2b99c7a77d77779c06a5da6f1ce1
- SHA512 e17722a2b739689b109398df313e2fcf81a85498319aa32371eb73e54ba742265f98e2772ea3314abacaf87462efba9d58d2c4d86fe60a2784d88de65b244d9f
- TLSH
  T17C51F203E7441F4161670C64B196BB69662E028FBB028BA97C532467CACD9FA53933D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 713B
- SHA256 d761489afee17b4c2306c91e74b0920bcd5a6167bbb23d01692d31855e291ea4
- MD5 6a2ffa945b6cf5753c7193831e13359f
- SHA1 8b18819dd50fb7423fd22c7e3bc1ae1c2c1272de
- SHA512 d0838c6e2940c4edeabfd1c33e0334ea7416103d74c9a9e2e3f1edee91f7464027be73f0dfa1c214396feb740973d218c0173885e106f3e3c7799d6797c6faf8
- TLSH
  T14C012D27A88D22AB584378F07613E45EF09C80A1E468D8D1667E84A990CCCD5BE938DA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8