1b697f71242601e03eb2ad24d3940b94de7da0ddad3ede0ed42d7dc9812eea8b

Analysis

max time kernel
14s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlandLuaNuker V6.py
Size 15KB
Sample260505-a7hypaet7w
SHA256 1b697f71242601e03eb2ad24d3940b94de7da0ddad3ede0ed42d7dc9812eea8b
MD5 244cb6aba5bebc86bbbae6194103d581
SHA1 b229eea30912cd7d60e2ecc304344bd358635b80
SHA512 d3207f17432c61f26e57fbcfcaf2988485a9d7d5e7c08a891b89a34de2b4a14674057a19ade5eba3d0a8c4362e7b9f3a35c968709e9471ad5f89c40c202b15e1
SSDEEP 192:k7yJ54WCRRUumAGat5rPVhueAdlwWqIU3Mv4Cf8Xf8N9tChtZH9p3X9lE+qhZ:kG1aLrPVhueAd+Xf8N9t2tZH9Zg
TLSH
T10372F224D910A1DA5397DC7724A3B4831A3F24138A0E6A2439BDCC865F5C636B4F6DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BlandLuaNuker V6.py"
1⤵
- Modifies registry class
PID:3360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-1-0x000001F3E5B70000-0x000001F3E5C90000-memory.dmp

Download

memory/3360-0-0x0000023758EF0000-0x0000023758F9F000-memory.dmp