General
- Target Madium-Installer.zip
- Size 11.7MB
- Sample260522-ceagysct3m
- SHA256 6cdd9c6826bb4503f888427e9a5a8244ae9654e02f6cfe8d5431995b65959279
- MD5 0b007004410dd9c00f7fcc7d0ef47c3d
- SHA1 12b9447c7ac0c806876b3797006bff423c8c8136
- SHA512 5a56c7e0d3eaea591bb5660b6c744103b443714e2f79f68d0ee41e9eb47d9b68f84d03e3bab2ce33c922a3491144e5937b48db205c120de737df207cb510df82
- SSDEEP 196608:zbkbvd2/7wUHebzJQchmv18XwsY63Qzu7bRoi4Wxc9DtVPjN/ehhBlk5jND+S+KJ:z6K73+bzmchDXY6gzu7bRoi4Wxcxr9eG
- TLSH T100C6337511BD3E50CED93F6352D1FC26A8D4882AC6A41773131C329DAA3C725A4EF9B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Madium-Installer.zip
Resource
win10v2004-20260513-en
0 signatures
30 seconds
Behavioral task
behavioral2
Sample
Madium-Installer.exe
Resource
win10v2004-20260513-en
3 signatures
30 seconds
Malware Config
Targets
-
- Target Madium-Installer.zip
- Size 11.7MB
- SHA256 6cdd9c6826bb4503f888427e9a5a8244ae9654e02f6cfe8d5431995b65959279
- MD5 0b007004410dd9c00f7fcc7d0ef47c3d
- SHA1 12b9447c7ac0c806876b3797006bff423c8c8136
- SHA512 5a56c7e0d3eaea591bb5660b6c744103b443714e2f79f68d0ee41e9eb47d9b68f84d03e3bab2ce33c922a3491144e5937b48db205c120de737df207cb510df82
- SSDEEP 196608:zbkbvd2/7wUHebzJQchmv18XwsY63Qzu7bRoi4Wxc9DtVPjN/ehhBlk5jND+S+KJ:z6K73+bzmchDXY6gzu7bRoi4Wxcxr9eG
- TLSH T100C6337511BD3E50CED93F6352D1FC26A8D4882AC6A41773131C329DAA3C725A4EF9B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Madium-Installer.exe
- Size 13.0MB
- SHA256 2ee90a1ea33cabb04324c4c81fbf5e10324555daa15a5ce1cca057c12e61b096
- MD5 b6a989ca0e54d320516e476952805cd0
- SHA1 f2aca808016392bef6bbfdc9e71cd008a0d4b408
- SHA512 fdb50952943a16ed4e809f1fd804cbac63e5cf63cdc9fa9b2a5f62492839af3b79491204b34316b13d82a2e2f8e38ff5e523976e0e02cf408cdd9a962273dff5
- SSDEEP 393216:QkRpe9nk411ZUSKpWVbjkWMWt+bT4OwGe0HTr:RRpe9nk4/ZaWeWZiMiH
- TLSH T16AD623ED80E523E4D8C30A80778A53CE70D0659D45FD5C297AEA2C02AF21DAF564EDB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.