Extracted

Extracted

• • Target
    DE-1901871.pdf.lnk
  • Size 2KB
  • SHA256 6c4409fadda1c44e710ce245ad9d59fd2b816d738e43a32d3b5baafea617c5a4
  • MD5 4f8146fdfb4c04002807c1019f3197c0
  • SHA1 cfc02238b2a7ebe222b5496af1ba09742a0a9d2b
  • SHA512 ccb65b1940f7be5880d62e37fd0f50cbf0d5e181b3a0d9352c1f0985e792717b05fadcec692f094466d532f11560997b9e1c383b40efc3d24e26d644f8f6025c
  • TLSH
    T1E551CB512AD94328D2F29E374869EB046235B881D6678F6E0180C5CD784A600E839F7E
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2
• • Target
    _
  • Size 5KB
  • SHA256 1d5ac18af3553d8f22ae09ae4efd92aab428a436fd9bd1645e78638c5b50c293
  • MD5 b452ade954e93c4acecae9c406f85085
  • SHA1 60eed0c4f07463f0bf8a057e9c79f1d9b1c58e7d
  • SHA512 b9e3a067149a026b43b15fc40d0ed530492262dbe4b81cac79da5c7ff07d198a097cbcf53f922a0a079084faca7ef65333128da2161c752b22a1fe8559718051
  • SSDEEP 96:qvp9TQVftUqjw+57mTk6MuBiSXNMwjIMj3S0DLXLgH8eZT/4fG2Dn/wP1Q6m8DwL:yuHxmTknuBiSeanXXLgH8eZT/rZNDwEC
  • TLSH
    T1EFC191B322584810C9BA42F166421483F39EC1870754CECA75BD80BEBF692BBD2F53D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    config.ini
  • Size 5KB
  • SHA256 d7f5589798264ec51e1b250c55d1a8c6821c3b2f932f5ee0078e0b6770c0e17a
  • MD5 7460be8bf73b1b571c5602c6babb348e
  • SHA1 13f42f9ad5fc06d0adc1743a196185eb469791d7
  • SHA512 49bacdb9a197f3be03147a4f82ee6da0af5b8b9ada3535f383b6a1ade0511f3813a7afde99b1f3de8ada786fd28f6e1915c41e905d8e99c9902bcd746172e4b8
  • SSDEEP 96:pvp9TQVftUqjw+57mTk6MuBiSXNMwjIMj3S0DLXLgH8eZT/4fG2Dn/wP1Q6m8Dwf:vuHxmTknuBiSeanXXLgH8eZT/rZNDwE2
  • TLSH
    T16EC182A322584810C9BA52E167421483E39ED1470754CEC675BE80BEBF6D2BBD2F57D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaredefaultasyncratvioletwormratworm

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral5behavioral6