5ee2f94f05dd266a716ff5affdf6f6cc5e15eca8a6f5c07b8e43acda63bde23c

Sharing

Copy URL Twitter E-mail

General

Target
1PactRZ98A5nocy93588_8087_UCG2CRatif23396.zip
Size 5.0MB
Sample261113-pcwcvsbs3w
SHA256 5ee2f94f05dd266a716ff5affdf6f6cc5e15eca8a6f5c07b8e43acda63bde23c
MD5 54dfcf6ef1553417e580e91d3ff01712
SHA1 0fdfd9ab5839fbd60fdabf3754b2416850568dc5
SHA512 bbe3860b00ace254421702d0ba55a73c8a8345c1189a412048c19a16c63712dd089b99b3c93014c162ed4b053c29fd16c0b330b07a1cc07141017023c10a0bc1
SSDEEP 98304:iGo7oYK1HSHYA9R+YJKMWhH1HpwOwSVwESr5BTUwG3pXzHZ/Rni2A:iGafHt+xpHwSVGr5DGZDHzTA
TLSH
T10D363333605910E0673872F13B96FC1FE41703A9161267D39776788C63BBA6AB1ADCD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Franqu8Intern6-Cod-Cerr-tplgtcNum163030-Extern-FUIXHF.vbs
- Size 7.0MB
- SHA256 478e2f7937a751525ade56cd4d4b80b03804c28852ed03cb371da3c8714d236b
- MD5 f7fd23a4cfec3e42801518f553d35859
- SHA1 e063638b81b80d94dd02afca74f4b69c58437b09
- SHA512 a9fb165f3aefff6465c28064a175dd789f9eb8cad9504ab8c598d97d84d9b31cfe65ba1b638515b4fc4bf7fa6bce1b16f47124bdae9b1a25e285abadeb7c2c16
- SSDEEP 49152:t2uQh7Rzh8xzQaIC/EovNODIrqGDN3d4v+uFT8pkVHoMQxaorgjnkzOxV07oJfoH:l
- TLSH
  T13C760236EBA8051705A2476AF00A6273FF77C423874D82A6D8DDF21D368B4DE816F5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence ransomware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  ~/hgqsm/hjhob/djnyu/oglrkl/gskty2.pdf
- Size 24KB
- SHA256 e5953e034a05460eed3b99a55887adff98471b1a1ab1bb958cccdefc76169b2f
- MD5 0d35cd1ac7f5cd85b909c6d387cdf741
- SHA1 79db70b6b9b4427f6a3128cfbb77ae99e57cbeae
- SHA512 37729d7165585f052a4d7f1a55093f97cdf21ccc2bbff1b8c1eb5d91737a8e532f2c85b8403e67a6fe01f771d3897224f12cad0bcc0e9a7d4be8cd0639a8101f
- SSDEEP 768:EqKgmQHghb3lHY2cr7vwi4gJbik3+VVFHRkiqKIA+hk:/mQHgpWP4OJbikOzV6e+S
- TLSH
  T136B2AE0C5103D960DA2B17EBFF0E688752A8F34F61608DA06E6D4D558993EF4F94E2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  ~/hgqsm/hjhob/djnyu/oglrkl/hsrvf1.pdf
- Size 22KB
- SHA256 d6a3ad7f39bfdd099fe5a878c0e7ef5c0cbbc54abb8082907ffa9d70621befd5
- MD5 4eef9bd6f9b64015e03cca66d66109f3
- SHA1 669e73ea6c4fa218fd208fe793064343311b0777
- SHA512 33358562e5034cac30395b5a1403221330bcdd3053e7acce8f8e3193d72b4da1bbcd8071df45dc3fb6e8327c1dfc4099c18e8f7ebf5d802b0d3cc0c00d0daf85
- SSDEEP 384:eP7vdUVl8cE0jwBj03wj/hSlBaDEXbbGAWl127Wwc35B:ejl4lQSwVuUkPD7WN35B
- TLSH
  T16FA218B2E5A41D8CEC828F8644B53DA4082DF623D6CD7CD150B54F81B99CE9C7B036EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/uurp1.xml
- Size 42KB
- SHA256 3550cb86af43eec7b5944659c60977180408d59af62daee1bb059f865db94136
- MD5 94c5694d5663ae96a05df1cfbe9f0e37
- SHA1 635f57bcfb193e53179119ccc36b6a64e6d15dc7
- SHA512 d33cd71138c9b25fb351780dcfbf12d0e1335a38c8f6814b8b1d412598bf1dcf8478be0100c37e123f7d7a010419a452f8d4cb78061ef1ac8fd4720fa3a4a76d
- SSDEEP 384:5ek4k4+J2keNyEIYi2mL4/y8RLVH9CKguQ:MkZJPTYiDLk5/U
- TLSH
  T1F113413946085C0EE727FA3175941A3E45276DCC6BE0F3861198A53C9D703236BAEF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ~/viop2.xml
- Size 46KB
- SHA256 992484d2d4aa3d9522406823c5fafe7809be48ee4bc13733bf14eea333c61234
- MD5 5e84f38f9b3b0b3cd01babaadf33abc1
- SHA1 d2514ed1befed05329a23e648f50f9344e246a61
- SHA512 5f7d308fb98cefbdd6102fb93d3ead85f3475a57eb846763497b6bc1a5186eb645cec7e100c609b8af969e2d4a0237affffc703ee2efbf1d2cc8192aecb55ddf
- SSDEEP 768:wiO8S6pjf11dUBBBI4JDOE7YeQ7yx5Kri5fDnuGGHdSLJ4:wixzpFURPJDOE7lQ2KrilbuGGHYy
- TLSH
  T1BE235B66AD0040B3FEE10636EBFE9C8A5EBC61161B2CA0E72777409D6D546D36B30B46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Executes dropped EXE

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10