45a9880a1172385a56b043c1d312cdb04deac545fc1833c09d82fcd1e0cee406
- SHA256 45a9880a1172385a56b043c1d312cdb04deac545fc1833c09d82fcd1e0cee406
Behavioral task
behavioral1
Sample
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/ah_monitor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/ah_monitor.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/engine/ah_monitor_cmd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/engine/ah_monitor_cmd.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 45a9880a1172385a56b043c1d312cdb04deac545fc1833c09d82fcd1e0cee406
- Size 5.4MB
- Sample260528-gvb3yah15x
- SHA256 45a9880a1172385a56b043c1d312cdb04deac545fc1833c09d82fcd1e0cee406
- MD5 95b1a2a129e4e693c382777f3382a6ee
- SHA1 ce3fe52717ccd3b74dcaf857c20d6981d2d000df
- SHA512 c9c8a1720f04649ff841f4b509adfaaa732b309fb9f9ade372ccfea2cb7bdd5ceba1a158c67e5401dd35239719805ec1a53db1665c81da5a7b7516c69d21e2bb
- SSDEEP 98304:DmfOl+MRqv/VmwN4Sl5URgtoG9M/UVyujODaqNXKzFZjf/8ytwI0UpJ7V:DmCfc/NNzDxtoYMcVVODaqXQ8yt8UpJh
- TLSH T1644633FA4575BB1ED1FEE2F3D975CBB2259E29D708E648402339D7701804EA7A50383A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/ah_monitor.exe upx static1/unpack001/946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/engine/ah_monitor_cmd.exe upx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/ah_monitor.exe unpack002/out.upx unpack001/946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/engine/ah_monitor_cmd.exe unpack003/out.upx
File Explorer
-
45a9880a1172385a56b043c1d312cdb04deac545fc1833c09d82fcd1e0cee406.zip 5.4MB
-
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/ah_monitor.exe.exe 3.8MB
-
out.upx.exe 9.8MB
-
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/engine/ah_monitor_cmd.exe.exe 1.8MB
-
out.upx.exe 5.1MB
-
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/platform_config.ini472B
-
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/version5B
-
946110ec-5ae4-4374-bfdf-b71e4510b4a4/info.json6KB
-
946110ec-5ae4-4374-bfdf-b71e4510b4a4/platform_config.ini472B
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/ah_monitor.exe
- SHA256 5f72ff3cbfcc505e80be3e6a86fab57f6506e6a655ebb36b521ffd430da7fbf0
- MD5 71d0d99c83cd156bdcb90d8b34b11e9e
- SHA1 03ce9e29fa87c735011734c06a2b377daa7f0002
- SHA512 dcbed302a8b901b9d365dbbbb04d5565ff9c8a2e74bd5c961fa5207c3b155830e0f4db1289e8faa5b47c12eb85a0eeda3d30274f066f6f006c56bbde94e4fb5e
- SSDEEP 98304:KdbnOMtvY2ed5LiNCPLCTHPvEi+SV4PGUHSAWgkS:hsY2ed5LwmAUlPNnk
- TLSH T151063383D201E611F683C13C377C969EFBAA96FB7EE154419980F7A494387B11AD808F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
10772256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
38KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 123722cf22e68746507476a08f9d6aa41cabb6a50076b52254a451c2c2ba1abe
- MD5 a6168e464890ebd420391342355ced79
- SHA1 1a8fbb48ae8eae3aa2194cdefc2730dfe1f4e322
- SHA512 fb2096619091eecf5d94415a5a5c3632d7d9258c781ee0548e060e3054fe907f9c00c8f33f2aaf543cda2b1eaeb5c32f128b1c325a1b44b2623305de3febefcf
- SSDEEP 49152:J1a78u1ISrXbDbLrb/TivO90d7HjmAFd4A64nsfJoZr3vC82tGGQI2NXZBduWEwg:LSrX3UUGdYboWER2lLpEAaD1RnO7TcK
- TLSH T1E5A65B43FB4150E4C5ADD2B486658212BA317CA95FB02FD33F50F6B82B72BD45A7AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
428736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
534KB
Virtual Size
921KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/engine/ah_monitor_cmd.exe
- SHA256 7964b189efc8b4dec5d3b048d20b1b4816aa6d495c49d08350e47e154fe63eac
- MD5 6b762923d151c14ca3c7f37c5aa11a4d
- SHA1 c10c27608f7807fd876482734bf88722ee00eba7
- SHA512 12d2b89e2217fce0d9bafeab063085df24587d30c2f538e52ad9f6c58b510caf52d6eeeeb149cedc8b04d8613794af815ae93e46f0a0d708053b9f73e651a0d8
- SSDEEP 24576:ofXQosHXfFcz+Czu/5lWgdJPCbvdGnVelyzOUtKI+AnxoiZudi+sP2ja+bta7moq:o9opCzuxlWgmbimPGHSVd/ft+Xs
- TLSH T1078533472661D90AC7B59330A35B1B047BBE927D0A5BC420A5894FEECD39CF2576BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
13366304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
11.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 0430cbb0dce1f13a197604eff3d98dfa93d0ee37299e13ffa600118d6d35e136
- MD5 1d81184c41d9bf36b3bfc05d1f86cf15
- SHA1 fb6631be0b045caf9771bcd4789d6d0f9a99842c
- SHA512 c6dc454630829d40cf22149c52bed4e98a3c37b2131824e87ff6b84d29f2d50c3683bfcab6a33cce4242ddcbfab6fe522a812b209ab2ee1ba1445489c918baf0
- SSDEEP 49152:MxoInkCLHrb/TVvO90d7HjmAFd4A64nsfJrklE/cM2iGtT1j0+uvA0Kbw2PdcEek:KZ5lEAo+uvAJcfEN
- TLSH T1CC460747BB4140A4C5ADD1308965922266317CB84FE06FD73E14B7B82F36BD81A7BFA4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
419104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
221KB
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/platform_config.ini
- SHA256 2fc9c5571b832bb9f2889172a0a7267fc85487c413ab91a404777a8bffd70afb
- MD5 6e0bb43450bea50b4b8e2db2e9d95ab7
- SHA1 56a96c70d14f254efd328e22a7abaf2efeea052e
- SHA512 9bd58e5549eb96f6fb61d0544431e34f855bc33ee9bbb395397b11db3d643bfb74317085b706603bc38d07f93ae2d1709e841bb8e808938d5a7951346f1d6366
- TLSH T189F0D4C091A427DE58D5DC1874192432093D1099E3A1648B1757874415CEAAB6FBD5EC
- MD5 SHA1 SHA512 TLSH
946110ec-5ae4-4374-bfdf-b71e4510b4a4/ah_monitor/version
- SHA256 20d2cb096d1ab41a4140246d12f07bf6b8cb743fd48122b72532c03d44c5c14a
- MD5 1237637816a1ef8e3a33c1191d9dea66
- SHA1 e5906c31c05c50ae1bcfde5f3a47eee483bc23c9
- SHA512 e6bcf72302fdf2139b5f9d77dc0be3458daef8ad42b81842371dffb98307479a8a8e053eac8f27eea9cbfc47cb60248ab0fecd994bab3c2359c1a9d5dab508fe
- MD5 SHA1 SHA512
946110ec-5ae4-4374-bfdf-b71e4510b4a4/info.json
- SHA256 1c4c2814954f3704ad92f2641d326c5e6532c27b49789f948928c0e75e0f363b
- MD5 98a4b12c3ded6a4dc87e01222db8a257
- SHA1 7a707511a5eaa50ef6dbb1230eba50079f567e54
- SHA512 381f157e3038ac8008e7e6fe995a00999b1c6a300b9fefec088e98ff5927b4eafb4bb32537bcdecf795285780906fdb4aa147163af43400f4301ab47f876c586
- SSDEEP 192:ET5cebl7+FLSZ3ECpgvrPldDIDpvj5SZjJb:U56xS6Cwr9MpVQb
- TLSH T173D11819C9AA0C6FF86452A909EA4286546110AB0C553D80364D9E7D3F8ED3FE0FA76C
- MD5 SHA1 SHA512 SSDEEP TLSH
946110ec-5ae4-4374-bfdf-b71e4510b4a4/platform_config.ini
- SHA256 0200df4dce31b62303b8d0624aa62e7ba1add4f50f29dc497777f04346ad1d5f
- MD5 62aa0fe5da7c2ed21572eaebfb6f3260
- SHA1 8f129dbb29d9ffc28f30c747ef85285e8bbec7c8
- SHA512 8eb6af45172c519931606d151ac972a3498f1598a518c36569924a06461004cc64bd99572f3226a8270f4173fc209040360b3c5dad4eb9cb0623daaa156ec8e0
- TLSH T1BCF00E8081A037E99695E828A4590823052C41A9A360649B232E8B40018AAAE1BF65DD
- MD5 SHA1 SHA512 TLSH