4f608005d877ca5ecd15095d2ceda5ccbec3807aeecb07d1829ba586dc490da7

General

Target
20260910073640-16DAC23780AE0B.zip
Size 5.2MB
Sample260910-pvd7ascm2w
SHA256 4f608005d877ca5ecd15095d2ceda5ccbec3807aeecb07d1829ba586dc490da7
MD5 e2fe286e8e6390f9101eb7ffa70feb9e
SHA1 8c4ab4e275a53fabba52af4273ee5958445616bc
SHA512 1102b71b8dec31b83587dad96ce5dba8e3180fa9feb6a658782007d7419698bbca604c438627ac241bfc2d8c4690b068bc3334616fbc026e9e8f3e911312529b
SSDEEP 98304:i5LXq5WCNJfI26qIB5eZSuW+k0RmC6LdDKs+vGVxSgXvBXQKYS1Dh:ECfI2E5ezNmpLoyxPvOKYcDh
TLSH
T1214633713C01B6CAF84EF93BB9823EB4D0A056963DE651E3447DA6B2FA03A151F6D205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DB.06846708.EXE
- Size 3.8MB
- SHA256 4090a0b9014c607ba076841b2c2d957e031a7612f6ae46151dd41517d53cfdc8
- MD5 eb02dd65c981a8c626934e5b96b43302
- SHA1 004c1571fa1e75fd13b54ddc75fd07a2aa967087
- SHA512 064c1001adeb825d1760b4ae0f9b22296fe9961bd038c974a6e771000352d402eb274f8dcda48d98417208a9660e65b895b48d54009e1dc30b88ad82d28820f9
- SSDEEP 49152:fTuYooyIQvMCbSwkQEk/exEnnHL75LErl0GPjyziET9/7buChgpXd62:fTuIygwiZGnHL75L/cv
- TLSH
  T1A506BE01FF428171F8E30A7A92FF577E4E39A9104714D4D3E3D419AA89316D1BB3A39A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  LUA51.dll
- Size 5.3MB
- SHA256 1334dd91cbe667bc7b8a4aac085bd0c0e1e6b606ca117ca80819cf6e1d4fc958
- MD5 27979de6993e6a1b990057d08cad4eb2
- SHA1 a98e7d3d38051ba6649a302eb849ae98aa018dc7
- SHA512 a0df96a2f40baa18ff1548ca10ae90c06cebcb6800bc020c3b8b8bf32c3460f344d02a174286fc377db4d1c588af8e774a7fdbff38831ebfcf9ab660f7d5a1c0
- SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpeZnC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpMnhEN4O7NADtVb
- TLSH
  T1CE46C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4