a35d2d99949e980210195f5e30ff4a8c650e40a3cb0de4b8c4ec8884441b4a18

Sharing

Copy URL Twitter E-mail

General

Target
qiToISnRXng576w2WROLFFp3fuBfHg_v_2026-09-08T10_10_18.905Z.eml
Size 10.2MB
Sample260908-l71z2shl9v
SHA256 a35d2d99949e980210195f5e30ff4a8c650e40a3cb0de4b8c4ec8884441b4a18
MD5 250e5c756649fb136ec9ba99b62ef9be
SHA1 6f3fb5b60e4675e4614841e569ddc8ae7b3f5fb2
SHA512 9ba0817b09d3eeb33bfcf71505e0ece9a915d2a640daf798df374aff345e933f6ec2bfc75aae63a15ccff92180268d0313dce6589eacb05b6fa2c67061823066
SSDEEP 49152:xDT/NRila54zLoxkLtXJBKDoJXZjH20niho7lzCQq/X84i8RnRzs7sjai6c1L/kF:xD4
TLSH
T1FDB66D3AFA5600C681FB85D2E1422B9C9191BF1C979357F1F076B032EC8B6E72A4275D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  qiToISnRXng576w2WROLFFp3fuBfHg_v_2026-09-08T10_10_18.905Z.eml
- Size 10.2MB
- SHA256 a35d2d99949e980210195f5e30ff4a8c650e40a3cb0de4b8c4ec8884441b4a18
- MD5 250e5c756649fb136ec9ba99b62ef9be
- SHA1 6f3fb5b60e4675e4614841e569ddc8ae7b3f5fb2
- SHA512 9ba0817b09d3eeb33bfcf71505e0ece9a915d2a640daf798df374aff345e933f6ec2bfc75aae63a15ccff92180268d0313dce6589eacb05b6fa2c67061823066
- SSDEEP 49152:xDT/NRila54zLoxkLtXJBKDoJXZjH20niho7lzCQq/X84i8RnRzs7sjai6c1L/kF:xD4
- TLSH
  T1FDB66D3AFA5600C681FB85D2E1422B9C9191BF1C979357F1F076B032EC8B6E72A4275D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  CMZ Detectors and RI Inward DC.pdf
- Size 962KB
- SHA256 48e823895ac315136ac4807b17e8ee067fcd73460ed4af35b86e6a6608640024
- MD5 9b971ec8d44c1bc80a88bc6b0fcc202c
- SHA1 270641bf2c322942ee4f2e22fb14e0c2c7f7b591
- SHA512 791a3057e787956b4e290d099da2e8abf25157a580a5e4f5212fbc9608f0f0df9e5d0f65cc7b71c3ff1abdc122b1639a9ad2d3c2264a4247579d8daf91e56661
- SSDEEP 24576:0ju9hsSoijyM/6t9yNfGCq9delMEemMX0HutEbiEVc:0yb/jiaN6ElRUUulEVc
- TLSH
  T1B12523C9D42444EF2EC803F190F92CA1EA9295BCD7BDB4413A1B3D08578EADB5F541EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Chubb_PPM Calendar_2026& 2027.xlsx
- Size 57KB
- SHA256 d1189924407268a4608242362ca518a6328336413e9c8efeac33fa9b60d08245
- MD5 d1cc98f857a092b09173355e6945919a
- SHA1 fc0881e6dde287c308b032cdad6ec35e76216cfa
- SHA512 a7a6a1a9c5bcf10a6b147c4261bfec3a05fd159c9a2cf7c3ea125fd0e13951be903ebc789eff4f2b7bb4c34941f7519cbaf483cad837f13caa2edf7d982cc3b1
- SSDEEP 1536:vL5KUJeN1jSuASyxsJGphczkOATn4mXx7Q:j4UuITphcHAT/X2
- TLSH
  T13343F190D6280CFBCDE4607D8A8E0952764C3020B7817B9FB8BADE1C46A574737F958B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral5 behavioral6
- Target
  Critical Spares Inventory List.xlsx
- Size 10KB
- SHA256 5b887eaec10551562442380e0f35bbe55356cd495e001634ecb89502712151f5
- MD5 c594a3663714dda8e59765437c9f2ec4
- SHA1 0c3d7a234b7e265ccefe2a7c3037d1d237025c65
- SHA512 3af76264cf7a6bb29f5db8cbc0d62931e153f0ce48a80cb486c3fc3e3f87a9998eebd1ff630d3f6aba9a6c1d326e7c7b7133de649c3f48d7ed67128389a711f1
- SSDEEP 192:u3BYumOAWIs/H5b3UELtDRcJ6+TgfYq3bILaY+iNsj1HUO8:ubmOAWHx3JeJPMYsELaR10O8
- TLSH
  T1FC226C6DD485F81DC2B6F0BEC56F12B642A8298187019D8B2229B6BC5BC571313D73DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  FAS Standard maintenance Procedure.pdf
- Size 76KB
- SHA256 fa5b9ba8c1dbc74d3d124ed9da98e8cebc2fb73b7abc80a47de312f7be129f72
- MD5 5403fac763d962911fe189c75911c7af
- SHA1 9eb2cc621c417f6894c60ffaa4ae2ec9ff0546d7
- SHA512 cb13ee9992cd79333415622f5b117553183ad2d54d2d45667d45f1e9a600392bcf154d1539f869e50a7931676c61c7ce6e5cdc34e0b0be977fb45d37d919697e
- SSDEEP 1536:MLjmUOutmbGzS4r4uwrEkosjpmaCIgmJidFiWS:1UPRSw4uCosjpCKYdk
- TLSH
  T1A073CF245D4E3CCED14847C15B3E3D2EF49CB1A2A1CC51A9372CCB8B47A5E2E996618B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  FIRE EXTINGUISHER Standard Maintenance Procedure.pdf
- Size 96KB
- SHA256 266a53ea2224884b0a29c027fa81b31317e659288de1996abe0de53f3f3df0fa
- MD5 31c652e955ab40b5bae8ba2467e597ee
- SHA1 1b22a4c41bfd83a7bc591ac596475e4290f760ab
- SHA512 73e3d5127d0fe0bb760c9e4aae98adf0eb77aca35058ff1134c963e724f509a5d49879771a4d12cb843391a8edf528e66780d124c0058b1dc3904e92407f90c0
- SSDEEP 1536:2dho3YuTaSef8Rwqk/g2pL8Cn6Ig1d51fAJ3UHYxMDY1IvS6Vl:Z3o4kR/6RL1AUHYxGSo
- TLSH
  T189A3E128C88C3CCDD1479BC05B697819F25CF77262C852A436FDC2C78764E16D86BA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  FIRE SPRINKLER SYSTEM Standard maintenance Procedure.pdf
- Size 86KB
- SHA256 204631a8f81f45898e9a9c30cebb5c94f7dd95c96c4746f9c086598f5f057759
- MD5 c916085ad07c96f7ad5d9948367bc4af
- SHA1 af8658dc13c11ba69ae5e904cb19d936ec08604c
- SHA512 b4c1cde0f9f9afa5b3679eb945606e1106b576f32216763668421ca9afacec02b7a783b2bf63f4208c4cefad3a2834d2d81659026543757af65d8089e39a33ad
- SSDEEP 1536:Kk1HOujQbgr1Lvbue14Ap6K1sTG6J4O+tv67oNTgFCIgmJidFiWc:PJoUJiAphN6J1GvySTgFCKYdG
- TLSH
  T18483C0549D897CCED24983C25F6E381EF66CB261A0C48198377CC39783A0F3D9D7669A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  Fire Curtain Standard maintenance Procedure.pdf
- Size 69KB
- SHA256 2c0121f88c61db01881abf41b5885ed23c80257dd809e69cf2a589bdc43efbfa
- MD5 630bf6d22ff63e28bac1d8caf8f42f41
- SHA1 e284d7679d379e0402799827bd517194e575cec0
- SHA512 66802e8d52ba2db07d7e3410cf0c318d5cbe311cf52ce870fd4efecf5fab2947aa1937e13c25f6341d963a6358931368bd22fefe568a8107bdcfe3a49a670b7e
- SSDEEP 1536:egms6OulIS3OfvN29QFpMEeBZSKIgqJidFiew:cs6kSuWQFpMVBoK2YdG
- TLSH
  T18663C0149D8D7CCCD18997C20F2D385EFA5DF26194C895C9332DC387C7B4E2AC96AA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  GAS Supression System Standard Maintenance Procedure.pdf
- Size 82KB
- SHA256 960639f2af69cfe29dcb4babd326d4e265f118032d3e27b1109bb2c58ce5fbe7
- MD5 c2eb9f72ad98ea7f85f7bd46145c8cf7
- SHA1 191078b3df3e24189acfd5f7bf897cd46cac0a42
- SHA512 89f5eb5a3a07de8e7d6b893cdecbf5f182117a6b6a6f059221324dccbe63200fd4c91a8a11f91cab876fec8a758f453b82faff63a75326a75624cf27265624de
- SSDEEP 1536:cau04cYuTaovWjhLIUX59J/hdjk51G6J4O+tv67oNTgLwIgkJidFi2E:7NLWjh/J/hNku6J1GvySTgLwYYd+
- TLSH
  T17A83E0689D4C3CDDC1498BC14F1A382EF96CF26274C841C93B7EC7978395E1AC62B65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  PAS Standard maintenance Procedure.pdf
- Size 158KB
- SHA256 a744d6c198a699c03de981c9264eb8553671c056514124cdd3d5ae373a9d135f
- MD5 d13d9624cc2e660ec956920046ba2680
- SHA1 5475444f772d46f5161ee7023aa25342c0dfc56d
- SHA512 6dd3207c3a6467c0082f97a38570d0731417331c0966d42c8d016869a8864fe9d48844170647ebc3d12c5c32ac9da134eb77949dfbfd6140f77332db7dbad43e
- SSDEEP 3072:1lfVZgBAk6J1GvySTg475YdwBXII/aJg44MVqlT90Lf:1lf4BR67Gar4vbqbqlqLf
- TLSH
  T117F3F1489E4E7CDED1068BC65F6A7C5FA25DB262B0C441983F3CC79783A0E2DC66750A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Qualcomm CMZ Q1 PPM Tracker.xlsx
- Size 17KB
- SHA256 58e90eb2817ac0c6f6aad6e112cfb35a2cef55cf88bb68038e5076eb4f883ca7
- MD5 cdd13a3c3c5149b6e836730695ca9425
- SHA1 03b72a6141f28d163f273fb53b9f1f94981bf3fe
- SHA512 035e3ea8ce760dedb4aaa4238c17d07c609a3e5dc41bd405402dd8eee2f8a34518547f4d6197f1524e04faa8392ff666fcc6a1d1e80f0f11b6d25b3b4570ee54
- SSDEEP 384:znVVYz8S5K4pyGf05nEe/PsSDhFQ7iwW8kUgQQs08SH2R5bVH:j7YYS/E6wnEeMSDhFQFkUgQQ0RR5b5
- TLSH
  T1EB829D2CCA21BA3CC9B7283EC00985E2595D2197E383F58A3890F14D1B453DA13DF9CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22