General
- Target support.client.exe
- Size 305KB
- Sample260601-hxtlfaev9v
- SHA256 b289af869fb9678b90e1aea12a460bcb58bb0751d2c421d5fefb3acc5a69944c
- MD5 ed415ae569cfe773fe67af3fafc709ad
- SHA1 0ced6ffaf0bf51727d06b11a1aa3305872d9c0ae
- SHA512 23eee169bcc66a725f032953539d9b06b3ee8fc89dadc4e7c187e31a0aee64891fd02c8b9642eeea1ba2d1fee7e3cae8ecc9c17c011911cd1f76f643e11805c1
- SSDEEP 6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9
- TLSH T1DA647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
support.client.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
support.client.exe
Resource
win11-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target support.client.exe
- Size 305KB
- SHA256 b289af869fb9678b90e1aea12a460bcb58bb0751d2c421d5fefb3acc5a69944c
- MD5 ed415ae569cfe773fe67af3fafc709ad
- SHA1 0ced6ffaf0bf51727d06b11a1aa3305872d9c0ae
- SHA512 23eee169bcc66a725f032953539d9b06b3ee8fc89dadc4e7c187e31a0aee64891fd02c8b9642eeea1ba2d1fee7e3cae8ecc9c17c011911cd1f76f643e11805c1
- SSDEEP 6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9
- TLSH T1DA647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Executes dropped EXE