f9981ad6fe78627a96f6b43ef8e2018f2daf443424d986fabce97f90bf01346b

Sharing

Copy URL Twitter E-mail

General

Target
09092026_0347_08092026__0225503FiscalGXRGSL_skaoay_FERACarg.vbs.zip
Size 2.7MB
Sample260909-eca2ta1dph
SHA256 f9981ad6fe78627a96f6b43ef8e2018f2daf443424d986fabce97f90bf01346b
MD5 e2b017d9bc17fb022e184024c0254728
SHA1 678e64d15cece622f4c5597a1ba3be2aacb7cbc6
SHA512 b1a9d4216613912c949a93a61d46f7d2f67864cb9a839a706556ecc45dfa9d1b530ed5f7624d15a7a74af953cad483f36d1ee59bb33e26f1f18454b281d97c7d
SSDEEP 49152:3fGNT25KfTYTS0fM1jmPmZwS7yRCEIoDH0Kqawu7zR/2XuWg7fLCQEi9:3fzKfTYpVJ4EpjMawER/mc7fuBE
TLSH
T1C8D5337DBC997508B720D370B75A868C8DC083C9E619869E2F1D604DCB0AFB5AF7168D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _0225503FiscalGXRGSL_skaoay_FERACarg.vbs
- Size 3.8MB
- SHA256 386ec9fbad1de49f272c3ec34d085f060aaa3f9e49cc0cbb33b9d151ee71456c
- MD5 2464e216388366d05d83a8f046d794c7
- SHA1 bd25590f374b181054465c7fd59f8b06dd617cd9
- SHA512 958522ce52309bde894b7b8b8c7a41932ddc6b19f545a322866f452f051ba8502f62f338530b9456a5c6272ebd2ddcc58e9ae9d4c1d7ba8a0b00ca138c6b67ee
- SSDEEP 49152:+eIYuO3l3u5UsoJ4EwnzbFY3ar5XJkeIVqfKEL2k1GX67x8s:+2s
- TLSH
  T1DB061236E6A5050B09E1476AF04A2173BF7FC423874D82A6CC8DF22939DB49FC17E5A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/csdmfc/xfqqce/zqhi/lafk/fudu2.pdf
- Size 30KB
- SHA256 d0d35d4867fabb3036c92f1ba72565b55424668ea6541fa8f3c06a164652cb5b
- MD5 14fe56d2825d9540424f4834442a5eec
- SHA1 6a586e30ce42b761720bff7b6a4258baefda87eb
- SHA512 1c064ec5bcc335ba715a2413d9c07ad932e5347dbc9fc39c84f0f1e0a2277ec5abbf9bd91f845525c012932c5b3a605fcc91d0eb84dcc08144d48658bf864ed8
- SSDEEP 384:pHkou43a4Bar3uqW70bW6EIy4jrG70ClGNNGmuGkvJ9dmUWMNv5itbFoIdcV8fXB:OVhW14jq70RNkGwJ8
- TLSH
  T1FED2930DF245BAA0D46147E15F383679653F73296CCA5A905DA3C72BEA018EB3B7CC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ~/csdmfc/xfqqce/zqhi/lafk/youvd1.pdf
- Size 10KB
- SHA256 c085ee00e47a11fa266ce884948ad3f14c7502e83779bc3c0c130deb96922caf
- MD5 66045b311330ea9d0423a08e7753663a
- SHA1 b6cd07d0559c35e203d1313a291e9071ebd1ed3d
- SHA512 1826e80c6f48016132a27e06403e0cd5446efdd53f3d13bc88fb15313fafb25d842c72e6efbe1b91b28995e9b7aed9f12b7f09fb4d35b8c2496c1e2c3d9d87e9
- SSDEEP 192:wIMwfv9OIEbTmLCLRLPUEUAZWovdLl6S29gNfRKPH1yFf7VpbPUD1i7t+U0Tr+CF:wIM89OIEbS2JUELZWo1Ll6S29gN5KPHn
- TLSH
  T1D6320916B9456CFCD55683C22F65789ADA2FF63030C494817CED8C078B40E52FD5F946
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/iyxqnn2.xml
- Size 38KB
- SHA256 a5b88f84fb563b4c97faea5074f94ff8991ab04bc879c96fda32039f73876d34
- MD5 e3b3357c99116495ea512e11aafcf658
- SHA1 301bc26d07455b97fb3fd8ec4108b49bedf28518
- SHA512 9a403cb9bb63a246fa51cd4f75eec4454cd35ad428771544712d89dcdeb5a1c85a5521f90749db4c731e2276bf968bfb88744da26c8842ebc92ba79dd20bde68
- SSDEEP 384:lsbtFMFjxdLsDTMtHKMYGjJqoRnPV5TiUdK7W9RY/5CYJL+mcXfeM+:qtOFFdLsD6KM3jJqmndyW7Y/5rLJT
- TLSH
  T1E103728735304EE1EDC00D7A91E65E734C7CD2284BAB90D7A6B601962E413E63E3B79D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ~/obmc1.xml
- Size 38KB
- SHA256 a5b88f84fb563b4c97faea5074f94ff8991ab04bc879c96fda32039f73876d34
- MD5 e3b3357c99116495ea512e11aafcf658
- SHA1 301bc26d07455b97fb3fd8ec4108b49bedf28518
- SHA512 9a403cb9bb63a246fa51cd4f75eec4454cd35ad428771544712d89dcdeb5a1c85a5521f90749db4c731e2276bf968bfb88744da26c8842ebc92ba79dd20bde68
- SSDEEP 384:lsbtFMFjxdLsDTMtHKMYGjJqoRnPV5TiUdK7W9RY/5CYJL+mcXfeM+:qtOFFdLsD6KM3jJqmndyW7Y/5rLJT
- TLSH
  T1E103728735304EE1EDC00D7A91E65E734C7CD2284BAB90D7A6B601962E413E63E3B79D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10