General
- Target CheraxLoader.exe
- Size 6.5MB
- Sample260522-2nbttah18t
- SHA256 c1a18e7163870b422349a1173e0a6cd0e7829709e3c172196ada87736818fc60
- MD5 ac1a7c7d5846970fa3ba1eccad346737
- SHA1 1154fcf391eebb268ca0558afa6508627ed80055
- SHA512 c37293a7184bc97cca10492cb9fbef9d2ea907cb18b6091da2434c5489e289a7b4d001a2aba4a18ba82721b44c15dd1c5dcbf4d69dda966ceba7ef01703ba2b9
- SSDEEP 196608:BdS5kN51OPnAxHVNYgK0SSsF5mVgp00rrxLighFe/I81ykvm:BdLNePnAxHVNYgK0SSsF5mVgp00rrxLs
- TLSH T10D66DF5676ED81B9C666F2388647C527E7B17E090321C6EB32D09B673F23AE41A3D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CheraxLoader.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
CheraxLoader.exe
Resource
win11-20260513-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target CheraxLoader.exe
- Size 6.5MB
- SHA256 c1a18e7163870b422349a1173e0a6cd0e7829709e3c172196ada87736818fc60
- MD5 ac1a7c7d5846970fa3ba1eccad346737
- SHA1 1154fcf391eebb268ca0558afa6508627ed80055
- SHA512 c37293a7184bc97cca10492cb9fbef9d2ea907cb18b6091da2434c5489e289a7b4d001a2aba4a18ba82721b44c15dd1c5dcbf4d69dda966ceba7ef01703ba2b9
- SSDEEP 196608:BdS5kN51OPnAxHVNYgK0SSsF5mVgp00rrxLighFe/I81ykvm:BdLNePnAxHVNYgK0SSsF5mVgp00rrxLs
- TLSH T10D66DF5676ED81B9C666F2388647C527E7B17E090321C6EB32D09B673F23AE41A3D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1