Extracted

• • Target
    RE-11685213011475512067.pdf.lnk
  • Size 3KB
  • SHA256 fbbbeacc763c9bef68226fa7cc2b9e4cc84e321b3695abf3167946888d16f31f
  • MD5 b9205c144529523df57c453ce82d3ea2
  • SHA1 4c19203f02415d8a9565d20623131dbfe3037913
  • SHA512 0eca262391634ce9f82366b14551a2359d7a940f3f2efcf0bec4bde6b81ed95e743068b0de496ee0511c5a4ce56add66605d63268b2ef8b2c284cd8cf2be023b
  • TLSH
    T139618A5136E94324E2F36F37987AEA046535B845DD67CF6E0186C1CD2896A00D83AF7A
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2
• • Target
    _
  • Size 10KB
  • SHA256 2967f53ce9435e341842c9f5a1c521c9bbb7d6d46f9d7106aa54e21ecf974e2a
  • MD5 ae4979c95730bc5c5604b13c0cec0295
  • SHA1 7bfaf5b5e6ce0c1567dd8eac6a7e9e024d73cbd6
  • SHA512 ba04cc68f59176dea661ed46c519b780341cbe9d498a1b91a493f5f5cf4179dd0c89754e2a119be9dd6db5c2281ce9a72a78adc0ccbfe185373a484c8e60a654
  • SSDEEP 192:Z+r55M46xMqpM1CCapgnpXrZst4G5DwEnpWmqkgnkOpg2pOHmHgxySDbA6gxySNk:Ir55RhqGUCigpbZst44DwYxgkCgaOHmI
  • TLSH
    T125220FF731044D21CAADA296B3781093F3EAD35B4B104DC5B15B40FEA85D7BED2993A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    config.ini
  • Size 10KB
  • SHA256 93e6bc6fa0d535e7f2609c59e474d6cd930774f41061162f540cedc46a2feb3a
  • MD5 67be80fc7cee4c78b434728790d3aaef
  • SHA1 bce8d91a8ba7a30cb49a40bff4520064445bfa8f
  • SHA512 6d53fb17c8bc97a7036c5b3609aa465cac656f9e936de4091be66767b1f92e5c98e252ec54dcb47147b63bc381caa5a7e22c8993cb897b08f60120ac0486e501
  • SSDEEP 192:1+r55M46xMqpM1CCapgnpXrZst4G5DwEnpWmqkgnkOpg2pOHmHgxySDbA6gxySNo:sr55RhqGUCigpbZst44DwYxgkCgaOHms
  • TLSH
    T12822E0F731044D21CAADA286B3781093F3EAD75B4B104DC5B15B40FEA85D7BED2993A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionpersistenceprivilege_escalationspywaredefense_evasiondonutloadervioletwormloaderworm

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral5behavioral6