hxxps://phisher-parts-production-eu-west-1[.]s3[.]eu-west-1[.]amazonaws[.]com/331f1185-2a2d-4d80-a09c-a778676cd6f5/2026-09-28/eme0u24010cdl0rk4vl4ifudmhasj83gv4oa17g1/d4acc750324c5ba8300c09bad748a1480dbe3716376dd36174740790159a6483?response-content-disposition=attachment%3B%20filename%3D%22%22%3B%20filename%2A%3DUTF-8%27%27&x-amz-checksum-mode=ENABLED&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QETINJOAJ%2F20260928%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260928T043006Z&X-Amz-Expires=2973&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGAaCWV1LXdlc3QtMSJHMEUCIQCKmxwLcTTFsQJjRpf6cNcmjbXbGNetVn%2BHYHrL27CbEgIgTbZ44zt%2Bui6Q%2Fb0gV4QzVmoz7aLtoDkuzLGX%2FRVKYyAq%2FwMIKBAAGgw4MjMxOTMyNjU4MjQiDAnTi8WrHciSgBVOrircA47T1A8z7ryOKzOExwU%2F5mV6drf8XSTZWM7P3fWtG7u04vqLGH7fvYV7xfMoE0uQJ6y1bvYCVB%2BW%2FyjO6dDgOo5njqSovgYLUfKhAgutYxiLchbA6Ej7x5sg%2Feci9vHYzlKW7uPxvENggWki190LrD3olIsTC6YERsxAOO5VvzJBGCUYNAGnUMlPMH8SrYi%2BrRAM0oYBTDpTHPfo6ZA4yqBIaaNnLGoiS7bdmqFiXXDhgw2JgBNhz%2BHgKNCJ6zdGmUqnAmYb3xjOwqM0wJnX16jLp83nSvyFBSfzOlXJsYp71j1xslI6GSdffWwuBamO8h%2B7bAppeG8iArCD8ANg4yaOZWbUjd23bnJ4YHNkpX886Vk8A8OTUHAdNg45UFiOGi1e1TA06EH8oHKuM9%2FBPmIHS%2FxHWN0O8hin3gP2z5gSFaER3MuvZggwd%2FFGSBjTg0hzm1fbXKmHAq6sz5BEpSPzhHmZASy64%2BdJvD2TLmYbsY6bu%2FK0QPj2kY0xDUEl6wAASScA2iq%2F%2BYMH0mYqGOLehbg8IvKneInhbGYnyXhaca0cqfI0P%2Bv%2Bcnq%2FyXCaTY3S6nuPolxJSrNymOs5nx8AaeplCpZQTThM8AvmC525rSN9kQx2QBSeXH%2BxMIvJ5tUGOqUBd5JyjwsQlW3BSSLZtvpwH6MbLS%2Fk9A0AMyt%2BuypTR%2FWNMTUhE17IEXl8yVHiVn4bzVP2rmymoDLUkvJ43d48jxJ742l85pgjlxkEk2hTVzy6EW6Sct7IasJ0A6kghHPoZNTbafOFXkYPegKX4ipE6JONj%2B%2BzjNVVEklMsp8463MnBrnrC2mHS2DA0MJ%2FYjW%2BjGDptPQlHP40QD7%2FrVKfBlVxuAxl&X-Amz-SignedHeaders=host&X-Amz-Signature=87715517183947116583cc5af4ec26f08fe17ce7cfb239c1df60837589b03cf5

Sharing

Copy URL Twitter E-mail

General

Target
https://phisher-parts-production-eu-west-1.s3.eu-west-1.amazonaws.com/331f1185-2a2d-4d80-a09c-a778676cd6f5/2026-09-28/eme0u24010cdl0rk4vl4ifudmhasj83gv4oa17g1/d4acc750324c5ba8300c09bad748a1480dbe3716376dd36174740790159a6483?response-content-disposition=attachment%3B%20filename%3D%22%22%3B%20filename%2A%3DUTF-8%27%27&x-amz-checksum-mode=ENABLED&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QETINJOAJ%2F20260928%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260928T043006Z&X-Amz-Expires=2973&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGAaCWV1LXdlc3QtMSJHMEUCIQCKmxwLcTTFsQJjRpf6cNcmjbXbGNetVn%2BHYHrL27CbEgIgTbZ44zt%2Bui6Q%2Fb0gV4QzVmoz7aLtoDkuzLGX%2FRVKYyAq%2FwMIKBAAGgw4MjMxOTMyNjU4MjQiDAnTi8WrHciSgBVOrircA47T1A8z7ryOKzOExwU%2F5mV6drf8XSTZWM7P3fWtG7u04vqLGH7fvYV7xfMoE0uQJ6y1bvYCVB%2BW%2FyjO6dDgOo5njqSovgYLUfKhAgutYxiLchbA6Ej7x5sg%2Feci9vHYzlKW7uPxvENggWki190LrD3olIsTC6YERsxAOO5VvzJBGCUYNAGnUMlPMH8SrYi%2BrRAM0oYBTDpTHPfo6ZA4yqBIaaNnLGoiS7bdmqFiXXDhgw2JgBNhz%2BHgKNCJ6zdGmUqnAmYb3xjOwqM0wJnX16jLp83nSvyFBSfzOlXJsYp71j1xslI6GSdffWwuBamO8h%2B7bAppeG8iArCD8ANg4yaOZWbUjd23bnJ4YHNkpX886Vk8A8OTUHAdNg45UFiOGi1e1TA06EH8oHKuM9%2FBPmIHS%2FxHWN0O8hin3gP2z5gSFaER3MuvZggwd%2FFGSBjTg0hzm1fbXKmHAq6sz5BEpSPzhHmZASy64%2BdJvD2TLmYbsY6bu%2FK0QPj2kY0xDUEl6wAASScA2iq%2F%2BYMH0mYqGOLehbg8IvKneInhbGYnyXhaca0cqfI0P%2Bv%2Bcnq%2FyXCaTY3S6nuPolxJSrNymOs5nx8AaeplCpZQTThM8AvmC525rSN9kQx2QBSeXH%2BxMIvJ5tUGOqUBd5JyjwsQlW3BSSLZtvpwH6MbLS%2Fk9A0AMyt%2BuypTR%2FWNMTUhE17IEXl8yVHiVn4bzVP2rmymoDLUkvJ43d48jxJ742l85pgjlxkEk2hTVzy6EW6Sct7IasJ0A6kghHPoZNTbafOFXkYPegKX4ipE6JONj%2B%2BzjNVVEklMsp8463MnBrnrC2mHS2DA0MJ%2FYjW%2BjGDptPQlHP40QD7%2FrVKfBlVxuAxl&X-Amz-SignedHeaders=host&X-Amz-Signature=87715517183947116583cc5af4ec26f08fe17ce7cfb239c1df60837589b03cf5
Sample260928-e5mlbavs9j

Score

8^/10

Behavioral task

behavioral1

Sample

https://phisher-parts-production-eu-west-1.s3.eu-west-1.amazonaws.com/331f1185-2a2d-4d80-a09c-a778676cd6f5/2026-09-28/eme0u24010cdl0rk4vl4ifudmhasj83gv4oa17g1/d4acc750324c5ba8300c09bad748a1480dbe3716376dd36174740790159a6483?response-content-disposition=attachment%3B%20filename%3D%22%22%3B%20filename%2A%3DUTF-8%27%27&x-amz-checksum-mode=ENABLED&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QETINJOAJ%2F20260928%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260928T043006Z&X-Amz-Expires=2973&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGAaCWV1LXdlc3QtMSJHMEUCIQCKmxwLcTTFsQJjRpf6cNcmjbXbGNetVn%2BHYHrL27CbEgIgTbZ44zt%2Bui6Q%2Fb0gV4QzVmoz7aLtoDkuzLGX%2FRVKYyAq%2FwMIKBAAGgw4MjMxOTMyNjU4MjQiDAnTi8WrHciSgBVOrircA47T1A8z7ryOKzOExwU%2F5mV6drf8XSTZWM7P3fWtG7u04vqLGH7fvYV7xfMoE0uQJ6y1bvYCVB%2BW%2FyjO6dDgOo5njqSovgYLUfKhAgutYxiLchbA6Ej7x5sg%2Feci9vHYzlKW7uPxvENggWki190LrD3olIsTC6YERsxAOO5VvzJBGCUYNAGnUMlPMH8SrYi%2BrRAM0oYBTDpTHPfo6ZA4yqBIaaNnLGoiS7bdmqFiXXDhgw2JgBNhz%2BHgKNCJ6zdGmUqnAmYb3xjOwqM0wJnX16jLp83nSvyFBSfzOlXJsYp71j1xslI6GSdffWwuBamO8h%2B7bAppeG8iArCD8ANg4yaOZWbUjd23bnJ4YHNkpX886Vk8A8OTUHAdNg45UFiOGi1e1TA06EH8oHKuM9%2FBPmIHS%2FxHWN0O8hin3gP2z5gSFaER3MuvZggwd%2FFGSBjTg0hzm1fbXKmHAq6sz5BEpSPzhHmZASy64%2BdJvD2TLmYbsY6bu%2FK0QPj2kY0xDUEl6wAASScA2iq%2F%2BYMH0mYqGOLehbg8IvKneInhbGYnyXhaca0cqfI0P%2Bv%2Bcnq%2FyXCaTY3S6nuPolxJSrNymOs5nx8AaeplCpZQTThM8AvmC525rSN9kQx2QBSeXH%2BxMIvJ5tUGOqUBd5JyjwsQlW3BSSLZtvpwH6MbLS%2Fk9A0AMyt%2BuypTR%2FWNMTUhE17IEXl8yVHiVn4bzVP2rmymoDLUkvJ43d48jxJ742l85pgjlxkEk2hTVzy6EW6Sct7IasJ0A6kghHPoZNTbafOFXkYPegKX4ipE6JONj%2B%2BzjNVVEklMsp8463MnBrnrC2mHS2DA0MJ%2FYjW%2BjGDptPQlHP40QD7%2FrVKfBlVxuAxl&X-Amz-SignedHeaders=host&X-Amz-Signature=87715517183947116583cc5af4ec26f08fe17ce7cfb239c1df60837589b03cf5

Resource

win10v2004-20260911-en

windows10-2004-x64

23 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Targets

- Target
  https://phisher-parts-production-eu-west-1.s3.eu-west-1.amazonaws.com/331f1185-2a2d-4d80-a09c-a778676cd6f5/2026-09-28/eme0u24010cdl0rk4vl4ifudmhasj83gv4oa17g1/d4acc750324c5ba8300c09bad748a1480dbe3716376dd36174740790159a6483?response-content-disposition=attachment%3B%20filename%3D%22%22%3B%20filename%2A%3DUTF-8%27%27&x-amz-checksum-mode=ENABLED&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QETINJOAJ%2F20260928%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260928T043006Z&X-Amz-Expires=2973&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGAaCWV1LXdlc3QtMSJHMEUCIQCKmxwLcTTFsQJjRpf6cNcmjbXbGNetVn%2BHYHrL27CbEgIgTbZ44zt%2Bui6Q%2Fb0gV4QzVmoz7aLtoDkuzLGX%2FRVKYyAq%2FwMIKBAAGgw4MjMxOTMyNjU4MjQiDAnTi8WrHciSgBVOrircA47T1A8z7ryOKzOExwU%2F5mV6drf8XSTZWM7P3fWtG7u04vqLGH7fvYV7xfMoE0uQJ6y1bvYCVB%2BW%2FyjO6dDgOo5njqSovgYLUfKhAgutYxiLchbA6Ej7x5sg%2Feci9vHYzlKW7uPxvENggWki190LrD3olIsTC6YERsxAOO5VvzJBGCUYNAGnUMlPMH8SrYi%2BrRAM0oYBTDpTHPfo6ZA4yqBIaaNnLGoiS7bdmqFiXXDhgw2JgBNhz%2BHgKNCJ6zdGmUqnAmYb3xjOwqM0wJnX16jLp83nSvyFBSfzOlXJsYp71j1xslI6GSdffWwuBamO8h%2B7bAppeG8iArCD8ANg4yaOZWbUjd23bnJ4YHNkpX886Vk8A8OTUHAdNg45UFiOGi1e1TA06EH8oHKuM9%2FBPmIHS%2FxHWN0O8hin3gP2z5gSFaER3MuvZggwd%2FFGSBjTg0hzm1fbXKmHAq6sz5BEpSPzhHmZASy64%2BdJvD2TLmYbsY6bu%2FK0QPj2kY0xDUEl6wAASScA2iq%2F%2BYMH0mYqGOLehbg8IvKneInhbGYnyXhaca0cqfI0P%2Bv%2Bcnq%2FyXCaTY3S6nuPolxJSrNymOs5nx8AaeplCpZQTThM8AvmC525rSN9kQx2QBSeXH%2BxMIvJ5tUGOqUBd5JyjwsQlW3BSSLZtvpwH6MbLS%2Fk9A0AMyt%2BuypTR%2FWNMTUhE17IEXl8yVHiVn4bzVP2rmymoDLUkvJ43d48jxJ742l85pgjlxkEk2hTVzy6EW6Sct7IasJ0A6kghHPoZNTbafOFXkYPegKX4ipE6JONj%2B%2BzjNVVEklMsp8463MnBrnrC2mHS2DA0MJ%2FYjW%2BjGDptPQlHP40QD7%2FrVKfBlVxuAxl&X-Amz-SignedHeaders=host&X-Amz-Signature=87715517183947116583cc5af4ec26f08fe17ce7cfb239c1df60837589b03cf5
Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware trojan
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1