General
- Target tmp106qhlqd
- Size 611KB
- Sample260601-26rb8aat6j
- SHA256 f0925a77cf0d973c935b9f65051bd27bf75887949adc3a06350210a2523961d9
- MD5 a2792875c6a476bcb0256aba2a50bf7b
- SHA1 571b871cb0f284489c28d9fc72057d6beef77057
- SHA512 29aa5d8f29a0e3e8fc10cf2b8d457ffddd7c518c6eed3b8270a3387f463a550a4e3a3b75c678ce3abba3190f4a8607953d0e77139fb65266d29a6ccd907f000b
- SSDEEP 12288:5BXOviwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1Au:5BXNkN/+Fhu/Qo4h9L+zNNIBVEBl/91l
- TLSH T127D47D06F243EAF7C4970570124BF7BF4230E6318412DF8AB6889D5AB9379F52A4E356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
tmp106qhlqd
Resource
win10ltsc2021-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp106qhlqd
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp106qhlqd
Resource
win11-20260513-en
0 signatures
150 seconds
Malware Config
Extracted
Family
-
xorddos
C2
-
http://aaa.dsaj2a.org/config.rar
-
ww.dnstells.com:53
-
ww.gzcfr5axf6.com:53
-
ww.gzcfr5axf7.com:53
Attributes
-
crc_polynomial
EDB88320
xor.plain
Targets
-
- Target tmp106qhlqd
- Size 611KB
- SHA256 f0925a77cf0d973c935b9f65051bd27bf75887949adc3a06350210a2523961d9
- MD5 a2792875c6a476bcb0256aba2a50bf7b
- SHA1 571b871cb0f284489c28d9fc72057d6beef77057
- SHA512 29aa5d8f29a0e3e8fc10cf2b8d457ffddd7c518c6eed3b8270a3387f463a550a4e3a3b75c678ce3abba3190f4a8607953d0e77139fb65266d29a6ccd907f000b
- SSDEEP 12288:5BXOviwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1Au:5BXNkN/+Fhu/Qo4h9L+zNNIBVEBl/91l
- TLSH T127D47D06F243EAF7C4970570124BF7BF4230E6318412DF8AB6889D5AB9379F52A4E356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10