General
- Target WandEnhancer.exe
- Size 1.1MB
- Sample260510-nylj4sfs2v
- SHA256 dd0d17892e4f9435adfffe0fdf7cb8e05c82cbc1b6741afd7afa772a2edd982d
- MD5 2352d5290d8a6042e97200bf72a25d4e
- SHA1 869fec4292d98fd68d14e5c1c8db91598497fa57
- SHA512 2e0ad56578e774952711f37cd87184bdc62cdba0182b017fc87027053ddc87c0810b6356c71b1382c71436072edc69b11982173774df47600e8b36ffef4a3faa
- SSDEEP 24576:QAtDKHcHmABLUBEolhlr6F8fpWWTB3G2Tb2yz8:QqKqHLUBEolhlrb7B3G
- TLSH T16F4528406FA4DE26F5AF1B75A074403846BBFC41AA6BD74FE608BDAD1877304BC1076A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WandEnhancer.exe
Resource
win10v2004-20260130-en
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
WandEnhancer.exe
Resource
win11-20260130-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target WandEnhancer.exe
- Size 1.1MB
- SHA256 dd0d17892e4f9435adfffe0fdf7cb8e05c82cbc1b6741afd7afa772a2edd982d
- MD5 2352d5290d8a6042e97200bf72a25d4e
- SHA1 869fec4292d98fd68d14e5c1c8db91598497fa57
- SHA512 2e0ad56578e774952711f37cd87184bdc62cdba0182b017fc87027053ddc87c0810b6356c71b1382c71436072edc69b11982173774df47600e8b36ffef4a3faa
- SSDEEP 24576:QAtDKHcHmABLUBEolhlr6F8fpWWTB3G2Tb2yz8:QqKqHLUBEolhlrb7B3G
- TLSH T16F4528406FA4DE26F5AF1B75A074403846BBFC41AA6BD74FE608BDAD1877304BC1076A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.