General
- Target grandcwel.webp
- Size 23KB
- Sample260528-ync54abz9q
- SHA256 87ad97d24759db7d3edd97946f3e76d6eb70194cd0fc53b6535603bc3c0c262a
- MD5 8a1409260326c61a4038d4e0fc9132a4
- SHA1 cef4f9c8d20567022959eaef190c2c4a86d4b344
- SHA512 26cd5f49bbeaded8b57178359413f1e4fc910fe3627dd1575adf028fd66efcc60d31e864abd0ad02262a72e5b77f00ac3b6d27876ef14d3b14053d5413037b35
- SSDEEP 384:/RgBQ3x+TEEGA7Gagv+hHVc8Gar0r/yHpzUGGdpwA3omnEBlfhD4QzXRCKtKjtbS:cyx+AEGA7GkRLwr6HhUGGfw0op7fSQrB
- TLSH T127B2E1782A291B71C2B444FA84A07B3D3F061E899241CD5D8505B403DFDB9B9EE66DF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
Behavioral task
behavioral1
Sample
grandcwel.webp
Resource
win10v2004-20260513-en
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
grandcwel.webp
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target grandcwel.webp
- Size 23KB
- SHA256 87ad97d24759db7d3edd97946f3e76d6eb70194cd0fc53b6535603bc3c0c262a
- MD5 8a1409260326c61a4038d4e0fc9132a4
- SHA1 cef4f9c8d20567022959eaef190c2c4a86d4b344
- SHA512 26cd5f49bbeaded8b57178359413f1e4fc910fe3627dd1575adf028fd66efcc60d31e864abd0ad02262a72e5b77f00ac3b6d27876ef14d3b14053d5413037b35
- SSDEEP 384:/RgBQ3x+TEEGA7Gagv+hHVc8Gar0r/yHpzUGGdpwA3omnEBlfhD4QzXRCKtKjtbS:cyx+AEGA7GkRLwr6HhUGGfw0op7fSQrB
- TLSH T127B2E1782A291B71C2B444FA84A07B3D3F061E899241CD5D8505B403DFDB9B9EE66DF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.