General
- Target Urget Contract Action.eml
- Size 604KB
- Sample260912-p3gmdscb44
- SHA256 c5fe32e5de97a1c0ff01c7bcbc99d7086a485b6df9ac7cdb37e906f6e1d01da3
- MD5 048c02e929690bcb0a537d08e71f6b50
- SHA1 e35f34239708f1d2ac63dc88366dcb3686d0d1eb
- SHA512 bd942387e85c4981cba4617089728958e7bf163efb73ee5624e3f5e409552426a3ee67d0900bca18dc089552d5c855ca99dbf5115f4293eb5162e346a68fcaa9
- SSDEEP 12288:G35ETPjPNu1JoTIIu4Q3H3KNgrYq/6lm2pNRs/P7IunP9m4QSmWveSI:PPDkreIItQqev/Qmofs/TdnPvPpeB
- TLSH T118D4123E49C2ABCB07329CBF50457A9ABC84D35B6956210093ECA2233E657F0976D4FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Urgent Contract Action.pdf.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Urgent Contract Action.pdf.exe
Resource
win11ltsc2024-20260911-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target Urgent Contract Action.pdf.exe
- Size 431KB
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
- MD5 fbbdc39af1139aebba4da004475e8839
- SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
- SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
- SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
- TLSH T1199412426729EE92D1E1B8F84093E7CC4BB97B090FB991EF9D993485CC79B8319380D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Family: BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
mimikatz is an open source tool to dump credentials on Windows
Executes dropped EXE
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1