d6d8f2631ad911445bff9eabb63b787424d71eefd5ded544878b58c2d62ab07f

General

Target
10092026_1438_06092026_JP#949654190829.vhd.zip
Size 5.2MB
Sample260910-rzpvpsvejd
SHA256 d6d8f2631ad911445bff9eabb63b787424d71eefd5ded544878b58c2d62ab07f
MD5 e0b0e91005814daa26d7243108863aaf
SHA1 addcfd66e110e5aaa3b83d9ea4096f82ad849a92
SHA512 117fbcdb92adf88cc700d9d77fee352ec77cdf0cb6f281618a77d7e00ff858c5d5f3089f2e2daf28a479d17becbe586915a44a7daba3f29054c3b309fa5356ad
SSDEEP 98304:dUvsS5LXq5WCNxpI26qIB5eZSuW+k0RmC6LdDKs+vGVxSgwDAM9hAx:SvXCI2E5ezNmpLoyxW9HAx
TLSH
T1404633B13C0173CEFD4EB53AE164BA74D4E1A5A76EF596FB80B85172AB43700274A318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CF.84913855.EXE
- Size 3.8MB
- SHA256 4090a0b9014c607ba076841b2c2d957e031a7612f6ae46151dd41517d53cfdc8
- MD5 eb02dd65c981a8c626934e5b96b43302
- SHA1 004c1571fa1e75fd13b54ddc75fd07a2aa967087
- SHA512 064c1001adeb825d1760b4ae0f9b22296fe9961bd038c974a6e771000352d402eb274f8dcda48d98417208a9660e65b895b48d54009e1dc30b88ad82d28820f9
- SSDEEP 49152:fTuYooyIQvMCbSwkQEk/exEnnHL75LErl0GPjyziET9/7buChgpXd62:fTuIygwiZGnHL75L/cv
- TLSH
  T1A506BE01FF428171F8E30A7A92FF577E4E39A9104714D4D3E3D419AA89316D1BB3A39A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  LUA51.dll
- Size 5.3MB
- SHA256 b80b7063867b98696aff86413a5c0d0a2f72f40e864694ecd0ee07d026c728cf
- MD5 37db98e632dec6020bc7db77e2e53c60
- SHA1 1e3ce43e9f637d0023f8bf65bfd2ff191cb6186c
- SHA512 c0c7d64af2e9f3332d1c0b2060f4459c8f0a1b32b2e83b248ee8e0c709d36b24fdb7479f0cca5ca7ec15a54df20de7376a3e18d9f974d1de0231b659607c8c49
- SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpetnC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpInhEN4O7NADtVb
- TLSH
  T18546C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4