General
- Target support.client.exe
- Size 305KB
- Sample260601-pfb4dsa18y
- SHA256 5f178a9596d1fc74ebcdd3594b320cd77839a56239947ef682945538491bd680
- MD5 ef96fcd7798e53f952033a79c1843813
- SHA1 a6b13e0ae95a2f41d429bc9fb19887865c3db66e
- SHA512 59c43f79da3a3e68b95b5939819be1fbea7dfcefa0fc1e08b1bbb10bf6a72211297ea062d97d8c1d62078be45dbfaee07bf056e8a24c7a93f0a30ff0a2720958
- SSDEEP 6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:o1iw7gryNkSV1hy1Z1u2JLu9
- TLSH T142646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
support.client.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
support.client.exe
Resource
win11-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target support.client.exe
- Size 305KB
- SHA256 5f178a9596d1fc74ebcdd3594b320cd77839a56239947ef682945538491bd680
- MD5 ef96fcd7798e53f952033a79c1843813
- SHA1 a6b13e0ae95a2f41d429bc9fb19887865c3db66e
- SHA512 59c43f79da3a3e68b95b5939819be1fbea7dfcefa0fc1e08b1bbb10bf6a72211297ea062d97d8c1d62078be45dbfaee07bf056e8a24c7a93f0a30ff0a2720958
- SSDEEP 6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:o1iw7gryNkSV1hy1Z1u2JLu9
- TLSH T142646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Downloads MZ/PE file
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
Executes dropped EXE