General
- Target main3.exe
- Size 51.9MB
- Sample260427-nec4macv4k
- SHA256 406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c
- MD5 134f36017a71db319fd4a1fe4846a508
- SHA1 441acaf87391993d7631f678d42e07be12eeb3a9
- SHA512 f5ab4d43ab27db3877154822934a07a31a6b3d9a6e057589458ae136032e1d512e2c56f44d592f8f5031828ab500e8fffcb4a6529f9fb97090f25c02038a92f0
- SSDEEP 393216:UPiPBmzWjK72kb7zWjK72yPA8EwXtrs2NuDYV0LP1CPwDvt3uFhC4Sx8Fe9Xbpho:UuYzWjK72kXzWjK72yPhbVSLkbeOh
- TLSH T124C79D0276644055FA38D0788593B552DB39BCA727E092DB329CB2782FB3BE11F7E644
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
main3.exe
Resource
win10v2004-20260130-it
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
main3.exe
Resource
win11-20260130-it
9 signatures
150 seconds
Malware Config
Targets
-
- Target main3.exe
- Size 51.9MB
- SHA256 406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c
- MD5 134f36017a71db319fd4a1fe4846a508
- SHA1 441acaf87391993d7631f678d42e07be12eeb3a9
- SHA512 f5ab4d43ab27db3877154822934a07a31a6b3d9a6e057589458ae136032e1d512e2c56f44d592f8f5031828ab500e8fffcb4a6529f9fb97090f25c02038a92f0
- SSDEEP 393216:UPiPBmzWjK72kb7zWjK72yPA8EwXtrs2NuDYV0LP1CPwDvt3uFhC4Sx8Fe9Xbpho:UuYzWjK72kXzWjK72yPhbVSLkbeOh
- TLSH T124C79D0276644055FA38D0788593B552DB39BCA727E092DB329CB2782FB3BE11F7E644
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Renames multiple (172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)