660f7dcf6cd804cfaf77e8a262a18a7a4c0c2cc6ebae1200b1579594e5baa9d2

Sharing

Copy URL Twitter E-mail

General

Target
BundleCitrixWorkSpace.zip
Size 819.5MB
Sample260910-r299esdn2t
SHA256 660f7dcf6cd804cfaf77e8a262a18a7a4c0c2cc6ebae1200b1579594e5baa9d2
MD5 605238907573d49e46ae8c6d10bddf35
SHA1 902187a81bf57d4acf877f6b0e20723e65a63476
SHA512 584936fc1cc04c0856411329d6ed55bcc5be2c8ae351923a42280ba03050d59a628317f90c7cd83c721bfa154b02242a75e6d8b11f04f1a9ce776be66090e137
SSDEEP 12582912:pezhn2B+Fe+JyLHW1qX93QekJtxU+f7Jlm8+0FRUzNEYhs0NA4jLKhq:pC+ce+JyLHW8ObJtxUlERGNEYx/Laq
TLSH
T1CA9933C28648AB51F588A23FFB016E30866D95E3D29697DF6233FF20BD133D2455924E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BundleCitrixWorkspace2026/install.bat
- Size 511B
- SHA256 ceb435b083fa9fde19a267be7c7a0f1de41f949d5b6bbaf17714c76e7eea7c40
- MD5 6448c038e39f0a2774af05db99069621
- SHA1 d028b52f46c11556a4edb25e2a423eaf7650e370
- SHA512 069ad7083e08cd5f973ad456af88b306d2200c9d03fec095921948d38e8dc8369f356318de4fb579895dfb82b2c3b416b18e58236dd204f2111fa568aef87fb7
- TLSH
  T142F0C0173A262F6E170FF5F794E2C620386F21422010CDC371788219740C708DF5068F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2
- Target
  BundleCitrixWorkspace2026/setup-files/CitrixWorkspaceFullInstaller.exe
- Size 819.7MB
- SHA256 58e8d6af96f31bc4ba18dda6b327a3c175757031c6b4cd8d5c9eb0bcfae3ba6e
- MD5 a94da55804c62e54a86e3899d86f0e70
- SHA1 26d47e9418e21b3ce0183096e5132b48a9678a37
- SHA512 e8d7c74808edb2ea5b215f78ec1111a2fd9c8239608b90a97e79c8f67a48de45336d70fcf51b5a96eb05dd14f10644588102072f9531bb35285161e1eecfd97a
- SSDEEP 12582912:OUmFqxhRXvptCtVn6w0G7vKoeXjZI6JO4fhzlpeHuCjaAvwCRi+xNILV:OzW/ptCtVn6imPXjZIi4HDjaAtNNWV
- TLSH
  T12F9933C277B49111F5CBE23EEA425E308E289D93819E559B2E3EFC6C39333D15528E49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  BundleCitrixWorkspace2026/setup-files/install-script.ps1
- Size 2KB
- SHA256 2b106fcda88f8d011a73ffb7434e882355ebf94f18da15ec74231b7da93a3049
- MD5 44f8d7d7b63ef5c7de85b474a0b8e50a
- SHA1 74e65f932625a4fcb934e5130940f03d2778e6cc
- SHA512 f545b56cdff1d97927adcebfa69d1f908b7c5b3e6344ecb372c06cfb6fe27166233d69aa7bb482ce9ea7aad2d57dbc1f194cb706a4b40b6d0d0e0cda8bfa0122
- TLSH
  T153419C2D111A29583AB7029FD052900AEEDE70EE981D1AB43CDF85192FD703E89F5F76
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral5 behavioral6
- Target
  BundleCitrixWorkspace2026/uninstall.bat
- Size 247B
- SHA256 0fa4003800217d29dd9175f600657b8c29346a591dde367f7ffb8126c46e0724
- MD5 82d347190a0c4ddf3f10c9fb5cc2fafe
- SHA1 520d64999d96728db38e022851d4eb6d3fb969f4
- SHA512 4b0c40ecbfc190f3f0b6e860ef6a20efe4133a7612b436b6271a643abfb9d493eb48f5cc2163e89f165ccf2cec9781ebf1545a822d9e53e4e54bf6e6a915db8b
- TLSH
  T174D02B0F3A4B3E693B50B6D2B8B2D10269AD518110145DD121FE1426B540B485A2058E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
behavioral7 behavioral8