0efbb1f02b921410f6f9c334f2d24f63a39775bd112880abc1af91fa74bebd63

General

Target
Disbursement_DocRev__2026.exe
Size 18.3MB
Sample261102-xrgf9agb52
SHA256 0efbb1f02b921410f6f9c334f2d24f63a39775bd112880abc1af91fa74bebd63
MD5 8afd359cb61cdce982c3b54a1aeaa9cc
SHA1 723c48d4874872d8795f9704372a5229c7d33f71
SHA512 19c922e6462eeccffce790660d0d63731d93b22ac45f2213a684bf8858bf5a730c4015f8b8675f6c37008422863c91243ff88958440cef25f8edfea460450f98
SSDEEP 393216:qn6fkFRoKZJ3aNhE7A0/DUvIT0TYDMJ5kF/145mwuZu+ERNMKQ:q6fuRo+WC7bUC0TYDMJI/1kmw9RNTQ
TLSH
T144173327CD631DF5D9030E3AA18706857B5CC8889C4AE8C5E9893537B1B58D7CE3ABC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Disbursement_DocRev__2026.exe
- Size 18.3MB
- SHA256 0efbb1f02b921410f6f9c334f2d24f63a39775bd112880abc1af91fa74bebd63
- MD5 8afd359cb61cdce982c3b54a1aeaa9cc
- SHA1 723c48d4874872d8795f9704372a5229c7d33f71
- SHA512 19c922e6462eeccffce790660d0d63731d93b22ac45f2213a684bf8858bf5a730c4015f8b8675f6c37008422863c91243ff88958440cef25f8edfea460450f98
- SSDEEP 393216:qn6fkFRoKZJ3aNhE7A0/DUvIT0TYDMJ5kF/145mwuZu+ERNMKQ:q6fuRo+WC7bUC0TYDMJI/1kmw9RNTQ
- TLSH
  T144173327CD631DF5D9030E3AA18706857B5CC8889C4AE8C5E9893537B1B58D7CE3ABC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign spyware trojan upx
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- DattoRMM remote administration tool
  DattoRMM is a remote administration tool that can be used as a backdoor
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2