General
- Target Masquerade_Total.zip
- Size 726.2MB
- Sample260516-pgmlhsgx2q
- SHA256 47264ba928f43bbd4cc1503e465d62a9407989cb93a427359a13095675b8c5cc
- MD5 aa84048e9b3c819038efeb453a2e9e11
- SHA1 fd389debcb2de842c72bdf4f0e344ce96f9e7bff
- SHA512 49bcde000ba3d1a7bb11aeaf83eb7d831ef56af4aff1ca1cc7c003cb43415c1c536907f6cb7712e6575563104f68366ef53a06ed93fcad591b3570bc97863945
- SSDEEP 12582912:2FqxfjL3dLhH4yD4IfuoQeSO44eJZAJX+dJlniZfdG1gmHTIWh0j1:ptL3dLphEpfN4eJZARSnnIE2h5
- TLSH T18D89331AC563F231CC1A7F3895C74308A0DFA64B50B2E7421B7AB64C9F63ACD6366749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BackupTemp/assembly/NativeImages_v4.0.30319_32/Microsoft.P08ac43d5#/e2231f4ee94d7e93b3016504b334f43d.dll
Resource
win10v2004-20260513-en
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
BackupTemp/assembly/NativeImages_v4.0.30319_32/Microsoft.P08ac43d5#/e2231f4ee94d7e93b3016504b334f43d.dll
Resource
win11-20260513-en
3 signatures
900 seconds
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://34.18.145.228:8080/
Targets
-
- Target BackupTemp/assembly/NativeImages_v4.0.30319_32/Microsoft.P08ac43d5#/e2231f4ee94d7e93b3016504b334f43d/Microsoft.PowerShell.Utility.Activities.ni.dll
- Size 608KB
- SHA256 563ec0a89e43580d8f6ff32260bdaad82d1c1fb2f97e3592bf0c1b9c19c9406b
- MD5 22f22d0018ad3b09368fe4d779816188
- SHA1 1ccdb2241a10f7d17923acc0caa3eb5bf67559ea
- SHA512 9dfc21525adcaaadee7fb39023c0da303656800da766f3e503516125b241bbe2a6f7623da8325b337c60262263863be84b158070f565635a528b2ce6d1f31f17
- SSDEEP 6144:lUb4E5BCx8SP1ybpDpvoLKT7MkXwc8UQVYSLaX22L5Un3USRkxdVRxE8wI:2b4kqHop1AcMKD
- TLSH T10BD4280667964570E0E5E77144E0ABB59E28F48D1214DAEFC234F26FAA3DE7E1EF1060
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10