General
-
Target
hMedZHEjguvARU.exe.tmp
-
Size
213KB
-
Sample
240916-zpvbfayhqa
-
MD5
786bbc7994411f56459429d69dbc2dde
-
SHA1
202cb1f1621b7d6846841c63c287215588910f3a
-
SHA256
e1e076c568c4736358eb0455e24e33e7c0802f0216df838c0dbba3860fd08ecd
-
SHA512
38ba0a39ff2c56c168c5ca6caae7f1ec68aae28aecd87c1117c4d261e5364ff975c6316661d9471e91fcdcf4c173c9b6695157f7f3cc8d8bc8b741567a30746f
-
SSDEEP
6144:igkegmCtnRPF9cCGr/uHkBV+UdvrEFp7hK8:igkeGnRNh4uHkBjvrEH77
Static task
static1
Behavioral task
behavioral1
Sample
hMedZHEjguvARU.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
hMedZHEjguvARU.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
hMedZHEjguvARU.exe.tmp
-
Size
213KB
-
MD5
786bbc7994411f56459429d69dbc2dde
-
SHA1
202cb1f1621b7d6846841c63c287215588910f3a
-
SHA256
e1e076c568c4736358eb0455e24e33e7c0802f0216df838c0dbba3860fd08ecd
-
SHA512
38ba0a39ff2c56c168c5ca6caae7f1ec68aae28aecd87c1117c4d261e5364ff975c6316661d9471e91fcdcf4c173c9b6695157f7f3cc8d8bc8b741567a30746f
-
SSDEEP
6144:igkegmCtnRPF9cCGr/uHkBV+UdvrEFp7hK8:igkeGnRNh4uHkBjvrEH77
-
Detects Floxif payload
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-