ac6a6e9e0ca44d20bab82b78232d5e4f32b520c9c8821a60046f79fb8dac77d0

Sharing

Copy URL Twitter E-mail

General

Target
04229ArchsufeeDigi0Evid-35871.zip
Size 2.5MB
Sample261029-1e56mace62
SHA256 ac6a6e9e0ca44d20bab82b78232d5e4f32b520c9c8821a60046f79fb8dac77d0
MD5 b44e3dd8be4e56521b4fc37177bb85e1
SHA1 912441673cda1cff37a80c6000f2090f2952dd1e
SHA512 1563484b8743c0eb002d997a40c75c0e3bc5d518f0cfc0b4dc8e29c4265bbf9033cc7b4669ef3949fda4e0f78b05772960718bedb93b6f96c676f7c8c37394b0
SSDEEP 49152:hMZfLIEMzKUJpKda4yIY86gFyhSlfXQDDtvhkE2Ms9:8f0EMYyIh6g88fXG/h2Ms9
TLSH
T1C0C53308A33E1029AAD6869F4EE451042E35D5580390E59E4FE77E0A49BF0AE7F15CFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Fact265662S80XPVI_3E92_Conc_Com-Pend9V220-sbpi.vbs
- Size 3.6MB
- SHA256 b92b333da29e1dde170d60f424e7dfa432c3a07903c454671721e770d5eb2ad1
- MD5 f0a49ddffad0ed5eb5676f728407e1a1
- SHA1 4fd1c6bc2665bb1fe66768381dbe6b2aaa0a1e3d
- SHA512 2439ee80d780f511762df64e5eb4bb0f041a733e3b254fba88a3ec2519f5ee00ab954e2a10ea7bb22060a4fd7310ddce5c57e90d5b6191b7bbb7c5ec3b3a8b0f
- SSDEEP 49152:+oWO58sd4V1j5orIfiHX2nTPkt/0EYqnQzznNxAHnlACPvg:ml
- TLSH
  T146060237ABA8010709B2477AF14A6173BE76C423874D83A5CCDDE21935DB4EE827E5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/aglj1.xml
- Size 20KB
- SHA256 39768457bbeb5af3d537b8311c73e2d5dffc4a6e9a29ab5077341a951f2468d1
- MD5 1d93a7ab93e4b1e7233e77523fcc676d
- SHA1 a0b3c36c6df20ea5c705669756887c3eb74f757d
- SHA512 3b0a9564639a0c796ee6ae382d851da7fdec444c7203dd9155ed4773620ba1724106c679a29e9e4c47d739f627879c6b01d1c667d2e7de4526d226cd8fc1d80d
- SSDEEP 384:qkqM+ObiQVns8VBSIRw/eDX9OUOZ2OPVIdvYuYJL+mcXfeMQ:qkqM+uELKX9OUOZ2Od+g3LJp
- TLSH
  T164924997BB048072E9CD4A7450B7D23B487977411FC120E3B7E80A5E5EA87E22B74A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/ivgnfj2.xml
- Size 22KB
- SHA256 ed6131702df41a1c2c4ab1027614bc028c61d54c3261d7090d43838a79bd9266
- MD5 b80e8c6c63a953fc1258d28996b0ca8f
- SHA1 161c6845c2663b574d226fdf9bde0f256d72ddd6
- SHA512 253834fbd6c121674b2af71cb591e210563d18e29b8511fd854b25eec52d5137de66d03bbfd0b79ae7f4a2ffb8398ce7f68d99090f01f9a863e53edeec4f4f96
- SSDEEP 384:fnj+rwTA4EnRteUcDGNMK6jzZBUcDG1BIXFhl:f8QrusDG6KglbDGc1h
- TLSH
  T1BEA20A62C7945C12EDB78F3170F4C6056F70BA85AAA5C5FF910CC0568FD2B8269B837A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ~/mrar/lesxpc/gahxbi/kojp/ptcd2.pdf
- Size 25KB
- SHA256 d8a939595c8105ece6189b480d96a6884e9790fc93980c385d666da57f372d88
- MD5 eea518aed26f9f80d92dd6849b3bc8eb
- SHA1 ed41fd87b9b173d7729878e280479807cef5417b
- SHA512 c93b98f08aaf2bac86f9b57ace0bea267bfaa0d23874773e0b7087838ff179e246f331aa5847828142ce26e5e22e192cc72a464df6caf30ed50e8d9aaa129e17
- SSDEEP 768:M57rOIaJhtyGeMmH6PqrDcUFsw3q7f0vtO3iqKIA+h3:M5nO5JSG8Rr4UD3qne+Z
- TLSH
  T1BAC29E4A2547C550EB0742DAFB2FBDA7A149B30F2268C8811D6D9DA21A57FE4F20D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/mrar/lesxpc/gahxbi/kojp/rbhnds1.pdf
- Size 46KB
- SHA256 62ed2c5c059fa01e792f87270f280765cbdac7faf5c6fc29c23995280e5cebf5
- MD5 5111fca3672e6da61bdfb9d0ca9967fd
- SHA1 9081075dbac4e7b1e271022d0ae1d5dc7407036b
- SHA512 64358adbfa91b415a153c46108b935730602f9453a28e9f6cfc9d855e7f7dfb91140c6471169c5b1e77f19be76632ad313a67a83095374dbe71f13d9d2dd28cb
- SSDEEP 768:VbBW8qkZ1DtGhQdG1gELYWhYGls6igH1U9cdn0bZ9lmjpCx4MDM/:dDR1BGiwjIGls6i01ScdmLrXD4
- TLSH
  T19723E15DAD268FA6F5F153703F3879926A68740221DFB64C30385B4734A1E70648B36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Maps connected drives based on registry

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10