406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c

Resubmissions

27/04/2026, 11:33

260427-nn5v1acx4m9

27/04/2026, 11:24

260427-nhr2yscv9j9

27/04/2026, 11:18

260427-nec4macv4k9

Sharing

Copy URL Twitter E-mail

General

Target
main3.exe
Size 51.9MB
Sample260427-nhr2yscv9j
SHA256 406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c
MD5 134f36017a71db319fd4a1fe4846a508
SHA1 441acaf87391993d7631f678d42e07be12eeb3a9
SHA512 f5ab4d43ab27db3877154822934a07a31a6b3d9a6e057589458ae136032e1d512e2c56f44d592f8f5031828ab500e8fffcb4a6529f9fb97090f25c02038a92f0
SSDEEP 393216:UPiPBmzWjK72kb7zWjK72yPA8EwXtrs2NuDYV0LP1CPwDvt3uFhC4Sx8Fe9Xbpho:UuYzWjK72kXzWjK72yPhbVSLkbeOh
TLSH
T124C79D0276644055FA38D0788593B552DB39BCA727E092DB329CB2782FB3BE11F7E644
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery ransomware

Malware Config

Targets

- Target
  main3.exe
- Size 51.9MB
- SHA256 406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c
- MD5 134f36017a71db319fd4a1fe4846a508
- SHA1 441acaf87391993d7631f678d42e07be12eeb3a9
- SHA512 f5ab4d43ab27db3877154822934a07a31a6b3d9a6e057589458ae136032e1d512e2c56f44d592f8f5031828ab500e8fffcb4a6529f9fb97090f25c02038a92f0
- SSDEEP 393216:UPiPBmzWjK72kb7zWjK72yPA8EwXtrs2NuDYV0LP1CPwDvt3uFhC4Sx8Fe9Xbpho:UuYzWjK72kXzWjK72yPhbVSLkbeOh
- TLSH
  T124C79D0276644055FA38D0788593B552DB39BCA727E092DB329CB2782FB3BE11F7E644
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery ransomware
- Renames multiple (147) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Renames multiple (147) files with added filename extension

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2