c006997765a787324f0ad62db2a591dc3c545497343b4f1828c21d7a79f16634

Sharing

Copy URL Twitter E-mail

General

Target
cukkNotif10678.980050-16861.zip
Size 2.7MB
Sample261009-pjf7hset7m
SHA256 c006997765a787324f0ad62db2a591dc3c545497343b4f1828c21d7a79f16634
MD5 b684e5adedea69831b13c66e7c1636f2
SHA1 b7c4de5958b89cc3ca150d3e3225ff5a8d147902
SHA512 c97e519a518c339b0b0b5a7fc09ca54b065daacfa852a9d9b354e0e8e69a2cffe90a1f55cab2475c5c2d81262176830643caa930aac67c9006e98c2cd93b47bd
SSDEEP 49152:0ZsU8rucYFRyXDNJCTRb1OWugPpAgIGONcjqg4o3o8GpjgLLW:0b8r0aGR4WuSx9ccug4oTGpL
TLSH
T1E2D53300F419858C8F8F7ABDC96B90DD274FB5DD5BB350E3D2213648AFB201B9B68685
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  _FactHKJCT20281-044978.Proc30465.vbs
- Size 3.6MB
- SHA256 574c9bd0592b5a18f04047b642bc7045f688b43f5c354aaeb6c179d5595a0475
- MD5 9146ade36b5c1d894d5d45ca380a6152
- SHA1 d9d2eba9a086b316fae3acbdc26a5424c1412f57
- SHA512 88d740ced46f2978867728af20cc919db163efdb4035e12c5b84dbae4c615aa60d2e7e6a57461922263f94b5b8ed5930548735b146ec657c3c534bd1336406fe
- SSDEEP 49152:oyNzLteDoeJ5+B1+AOe1KYRw4ihP+TKaRmr4C2KVm+YhIj:2
- TLSH
  T113061237AAA4151B09F1476AF00A6172BE7ED423874CC2A5CC9DE22935CB4DE827E5F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/llqpu2.xml
- Size 77KB
- SHA256 2a3a6566b3628c0e13b8fe653446f3538c3c498043c2633ccbb3a9ff16908632
- MD5 bbb0c7d5694183e69ff12249668705a7
- SHA1 082cc5b36e7788ab81360b67a6b79b71b3d6b7a2
- SHA512 41c35bd59e6974da523bda4b5efda5a0aed328e06268fadbcba93a792815460d15603a23fd7510ca5871ee6da0f691d2eab19eff9159bdf917c609f24fde53a8
- SSDEEP 1536:dzLfWeTxL0OwDxm8NLHsLtkO1iZzgRHw4c2DJ7pk/uHVd3u/0HByr5NOna0Ci:FL0Dxm82LM0vr/3TByr5NOaq
- TLSH
  T14C738D2276A0D032E8D25A30852DC6B29F3BBC325AE4D447F798476B5F607E0D76631B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/xmbm1.xml
- Size 16KB
- SHA256 3cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
- MD5 9a341540899dcc5630886f2d921be78f
- SHA1 bab44612721c3dc91ac3d9dfca7c961a3a511508
- SHA512 066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37
- SSDEEP 192:erLXx0hyLsbb3rxVj7WU2WLTYoW4GD5dHnhWgN7acWlbAkWD7DiqnajKs3WoHpZ:Ih06sbbVVPWU2WPY7dHRN77RGlGs3jJZ
- TLSH
  T18F724B45CBEC4607ED232B7085A8D583FF38A3D75816A32929C5F67C0C9A7C5AF21638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ~/zhmj/qily/mdfc/geluc/hcfces2.pdf
- Size 90KB
- SHA256 26cfa79ae9b841b7aaa166371767c1c00b471590755221fab05d1e46d8b35c8e
- MD5 85f7de2b0a5df43979f7735143fcc0bf
- SHA1 3b042eefbc4496231d7ee004714665dd7aa1bd8f
- SHA512 fbc1cf42f2172c5248ea677ccb2f312a9ce2aa012120a80e8c88e7307b3b1fb1b8acbf94b555bd12b2d5f280ca43ee7f33c19d205a27d47a3b4cdf78be89fed4
- SSDEEP 1536:62VCjJTiF2Z4O8d69XXT34teAxbbbPHi+7Xxj0uarUphdVKpW65GijIoAadVKpW3:5oJk2Z269Hj4JbbbK+jN4r6hdVMPGNby
- TLSH
  T15693019D4152AA01E1C5D66A5FD46CC708F7F0C2120805223E6D9BAF6B22FE1F594FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/zhmj/qily/mdfc/geluc/ptqs1.pdf
- Size 24KB
- SHA256 68d8c12391e2294db9e614463e60741e7def8906141fa98db6a4d4504e181944
- MD5 bd766bdf053039564a39096005113bf7
- SHA1 62a23c4ccdcb5046c29c02e42b60b9af532c9ab7
- SHA512 aeb68cb5c5f6c5fb370145c6f8ce2ce9e583cb02f2b3b15518f016177cf053083f1c800388671c578e7bef4d3fd99d394d7a52366d6acc03fdd79bf47b31d6d2
- SSDEEP 384:ORStQttQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLsN:O4pDCpPm38e6jcTJF4p946lPn
- TLSH
  T1E4B2BF834D468D76D4F18B51BF03EF0E5B9A7E44704B7AD710A2A8CA7F24AC29C1962D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10