6932e11084e8ea374897f99e457bce733005902f052a154adaa8c6ec88f76d04

Analysis

user interaction
yes
max time kernel
32s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 11:41

Target
nogibogi.exe
Size 2.5MB
Sample260530-ntyzmsbs8z
SHA256 6932e11084e8ea374897f99e457bce733005902f052a154adaa8c6ec88f76d04
MD5 e30f9ce72d38439df1a266533b68ccb6
SHA1 ea38ceb92d892782e6a7278642b3497379ddae45
SHA512 72550f2aacb56bb528feabde79b7ebecc4658c5c3c0258acaddafb2c37dad2905ebe762b8e25a9c49d52080d56a3e6fbd25fa3be73c7d5dc8bc15940459bb145
SSDEEP 49152:SW6HmCx2wasP2xaEJcOJ3d9AUgdPI/GoLd/HM8x79FU2nm9Er2:7tu2xaacUviC/HL5Hz9M
TLSH
T195C5E096F3E95945E027B5384746AE0FE2317028035087E77FD54A9D8BBE9E0CB3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\nogibogi.exe
"C:\Users\Admin\AppData\Local\Temp\nogibogi.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300