General
- Target Fleasion-v2.0.0.exe
- Size 123.8MB
- Sample260428-hdps5ses7x
- SHA256 059578c22adef0f98745dea0938b4183190e055672c991a7ebe0a87b5d8fb29e
- MD5 082aeab88d561d2da715d863da5f5476
- SHA1 f3a7913d35f4a44d25fc704243da151c52ce6277
- SHA512 56585879517c07111a61c6cd3036d9277b9d05e3dab61276174f0c4e73014bf8e8eb4c361bd10b66abc5f9238219d481d4c63ecf8b20e30b878104289cf51dca
- SSDEEP 3145728:3UoLuHJ75WHbgGnP4laaeyF8XBBIps7mVbyYzObu8aXmrTUgn/:3rup7Kgw4M1lXBBlaXmce/
- TLSH T19758337536A5531BE063783EF0E7D99073B4AC88DF5A817942B83DF335BB18248AE542
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Fleasion-v2.0.0.exe
Resource
win11-20260130-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
launcher.pyc
Resource
win11-20260130-en
28 signatures
150 seconds
Malware Config
Targets
-
- Target Fleasion-v2.0.0.exe
- Size 123.8MB
- SHA256 059578c22adef0f98745dea0938b4183190e055672c991a7ebe0a87b5d8fb29e
- MD5 082aeab88d561d2da715d863da5f5476
- SHA1 f3a7913d35f4a44d25fc704243da151c52ce6277
- SHA512 56585879517c07111a61c6cd3036d9277b9d05e3dab61276174f0c4e73014bf8e8eb4c361bd10b66abc5f9238219d481d4c63ecf8b20e30b878104289cf51dca
- SSDEEP 3145728:3UoLuHJ75WHbgGnP4laaeyF8XBBIps7mVbyYzObu8aXmrTUgn/:3rup7Kgw4M1lXBBlaXmce/
- TLSH T19758337536A5531BE063783EF0E7D99073B4AC88DF5A817942B83DF335BB18248AE542
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Drops file in Drivers directory
Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates processes with tasklist
-
- Target launcher.pyc
- Size 206B
- SHA256 557d5f6d79a2fea97feecc6fddf0ff18d97e0ca477f3502afa18495c6a0d420a
- MD5 693b34de096abcba892dfb3aebb63688
- SHA1 17c7716db14077ddfd851a7532cfd114fa8084d8
- SHA512 1efa3279e151176a3bfce29c9268214d66d0709d6c221e9b743741d14db24335886daf236ba4854f95be7b6f323e2fa2a3e0f26b6dfbdc8c58b44afb5803a725
- TLSH T178D08041D5607A12C64C0734B4FB95F615718C4C9293D45310D9262E1FED3559C50985
- MD5 SHA1 SHA512 TLSH
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1