General
- Target Hashbang.exe
- Size 275KB
- Sample260425-bb4e7agv3r
- SHA256 54bad8b7b445a4ce65dfdae52c2ec350f3ac865981792dd1042cbd0326eddf2b
- MD5 bbdb5a492905d9cac7db872f4107636c
- SHA1 1f4ed0a9eea707cc0660166009db8dcdec76cb32
- SHA512 130a7619dde85343e00feab47e9d0d01c5c75e380692baa327c06ca26cd73f05886976fa9b3bd0bcdddb71cfe4fd053aaaa2534a6bc6d91e8e56bd1d4a2d039c
- SSDEEP 3072:dBo/wbCsr47MC7ukb51h4hGFVbDf1QGz9J/R0418PWZ8m1X8BQSarudtEDIhRCLP:31bfkWkbF4Ah1QGz9OrdE9f
- TLSH T164546CC5B7C5ACEBC6054639899B83293738F5D05B839B17193872312E23AD0BEC765B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hashbang.exe
Resource
win10ltsc2021-20260130-en
23 signatures
150 seconds
Malware Config
Targets
-
- Target Hashbang.exe
- Size 275KB
- SHA256 54bad8b7b445a4ce65dfdae52c2ec350f3ac865981792dd1042cbd0326eddf2b
- MD5 bbdb5a492905d9cac7db872f4107636c
- SHA1 1f4ed0a9eea707cc0660166009db8dcdec76cb32
- SHA512 130a7619dde85343e00feab47e9d0d01c5c75e380692baa327c06ca26cd73f05886976fa9b3bd0bcdddb71cfe4fd053aaaa2534a6bc6d91e8e56bd1d4a2d039c
- SSDEEP 3072:dBo/wbCsr47MC7ukb51h4hGFVbDf1QGz9J/R0418PWZ8m1X8BQSarudtEDIhRCLP:31bfkWkbF4Ah1QGz9OrdE9f
- TLSH T164546CC5B7C5ACEBC6054639899B83293738F5D05B839B17193872312E23AD0BEC765B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Indicator Removal
1File Deletion
1