a035c2a2023e24e9a53135e960d32d2540b6cb35bc8b6ed17139aa949b11e319 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

CertSigner.msi

windows10-2004-x64

7

Resubmissions

22/04/2026, 04:35

260422-e7w8jacz4t7

22/04/2026, 04:15

260422-evnqmacx3v7

Sharing

Copy URL Twitter E-mail

General

Target
CertSigner.msi
Size 47.4MB
Sample260422-evnqmacx3v
SHA256 a035c2a2023e24e9a53135e960d32d2540b6cb35bc8b6ed17139aa949b11e319
MD5 f6f53c88d58c045dc0564fca93e70b24
SHA1 135f4e09d8229666e0c98e6a982959e5b94f6836
SHA512 21ebbd098d379b76591fc9b9240570c6590e3fc2675f16efd174bbd722528a78e520060a6ecedf571c665b0319b96312fd5c5af78959577cd58ad74c8e2124a1
SSDEEP 786432:sDTGLG1e1OySYDThjd53xFRimsFG6jQhD0abBwHjIuuE5RqUoCLfTfJwf/KPQY3j:8GLG1YzDThT3xFUfG3hwabGcuuLUNPh5
TLSH
T1C2B733A73D522C76D45D9D3F12720B469B3B6EA85B01824128A9B26CFCFF1E45D389C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation pyinstaller ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

CertSigner.msi

Resource

win10v2004-20260130-en

windows10-2004-x64

20 signatures

150 seconds

discovery persistence privilege_escalation pyinstaller ransomware

Malware Config

Targets

- Target
  CertSigner.msi
- Size 47.4MB
- SHA256 a035c2a2023e24e9a53135e960d32d2540b6cb35bc8b6ed17139aa949b11e319
- MD5 f6f53c88d58c045dc0564fca93e70b24
- SHA1 135f4e09d8229666e0c98e6a982959e5b94f6836
- SHA512 21ebbd098d379b76591fc9b9240570c6590e3fc2675f16efd174bbd722528a78e520060a6ecedf571c665b0319b96312fd5c5af78959577cd58ad74c8e2124a1
- SSDEEP 786432:sDTGLG1e1OySYDThjd53xFRimsFG6jQhD0abBwHjIuuE5RqUoCLfTfJwf/KPQY3j:8GLG1YzDThT3xFUfG3hwabGcuuLUNPh5
- TLSH
  T1C2B733A73D522C76D45D9D3F12720B469B3B6EA85B01824128A9B26CFCFF1E45D389C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation pyinstaller ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Installer Packages

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Installer Packages

Defense Evasion

Modify Registry

System Binary Proxy Execution

Msiexec

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalationpyinstallerransomware

© 2018-2026

Terms | Privacy