69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8 | Triage™

Login
Reports

Overview

overview

9

Static

static

9

BulkFileChanger.exe

windows11-21h2-x64

8

Resubmissions

22/08/2026, 03:37

260822-d6gwsavway9

16/07/2026, 03:36

260716-d5xwlsfx6t9

16/07/2026, 01:46

260716-b619badz6x10

15/07/2026, 15:01

260715-sdw8bsh13v9

14/07/2026, 13:53

260714-q66alagy4w10

14/07/2026, 13:36

260714-qwkk5sdz8r10

14/07/2026, 13:36

260714-qwbm8sgw6z9

14/07/2026, 08:33

260714-kf7g3shv6k10

25/05/2026, 16:27

260525-tyaeqsgs5z9

25/05/2026, 16:09

260525-tmaalads3p9

Sharing

Copy URL Twitter E-mail

General

Target
BulkFileChanger.exe
Size 130KB
Sample260525-q8m7ssh19n
SHA256 69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8
MD5 2dfa351e02f71650ce635970c995cc59
SHA1 ad06195853ade67cdccabc0c7ece7cf17317f7ee
SHA512 52439034ec1c21410f24755db3d84dbea1a64ecd0119478a6b3d7425bf8ad0c585390dc4e2af6463689f97dd303360849108ba0968a836c517b7ca3411dc5788
SSDEEP 3072:WFvLAdnnVYKlwMaofGPP7lzbwNZGCFG6IdSEnvrZq96S:EjKvKlz1CX
TLSH
T124D3280673F805E9E4BBD675CD324622DBB2BC684934C72F47A4D98A1F23321BD25726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

BulkFileChanger.exe

Resource

win11-20260513-en

windows11-21h2-x64

28 signatures

900 seconds

discovery execution persistence

Malware Config

Targets

- Target
  BulkFileChanger.exe
- Size 130KB
- SHA256 69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8
- MD5 2dfa351e02f71650ce635970c995cc59
- SHA1 ad06195853ade67cdccabc0c7ece7cf17317f7ee
- SHA512 52439034ec1c21410f24755db3d84dbea1a64ecd0119478a6b3d7425bf8ad0c585390dc4e2af6463689f97dd303360849108ba0968a836c517b7ca3411dc5788
- SSDEEP 3072:WFvLAdnnVYKlwMaofGPP7lzbwNZGCFG6IdSEnvrZq96S:EjKvKlz1CX
- TLSH
  T124D3280673F805E9E4BBD675CD324622DBB2BC684934C72F47A4D98A1F23321BD25726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistence

© 2018-2026

Terms | Privacy