Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
13/05/2026, 15:15
Behavioral task
behavioral1
Sample
Backdoor.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Backdoor.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target Backdoor.exe
- Size 92KB
- Sample260513-sm3fpsct7y
- SHA256 c0ac721a1668821e20aff2becd9394ac2a69baa0cb72c5184ba5730b1928615d
- MD5 4aed6c50d0cb331054f1d6ff33553b9c
- SHA1 267c889f50e3136fac831ec01131989e1a2efe95
- SHA512 9e014424811054fff85c3f9521f895a2832db5952d3e776a8e41035905c6498c0134ae44e28d58ea34e4403d02da46c432695457d11d7103152d55f8491c0dd3
- SSDEEP 1536:ohhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6XrG:uhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+1
- TLSH T14693D813FA4AD0B2E42591F145426F32CEBCBC3636492173D38FCA41AD79892D456EBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Backdoor.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4928 Backdoor.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4928 Backdoor.exe