ca539d8cf77f36d34a10988d08b6fbb3e564e016104a0cdbdca7c91cf235f324

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:13

Target
SomalifuscatorV2-main/src/util/obfuscation/scrambler.py
Size 6KB
Sample260603-pd1c7set4s
SHA256 ca539d8cf77f36d34a10988d08b6fbb3e564e016104a0cdbdca7c91cf235f324
MD5 8919f5a356e4e22101269159e961c7fc
SHA1 4d1b51b94b0222738213b3868ecbfd0573e84afc
SHA512 118ded060b2f1a28b101d7c606819c04424c52fec528766809b4e34402b86219ef00e9d4f31f1150c38e8a50f00c5bcaae0040a87cb8fc447828ae8dd91b3b24
SSDEEP 192:smIkpLzx2rWw4GOKVkSysgSrgSvTX3LFb/X5:skorWw4GOMkS3gwgSvTX7B/X5
TLSH
T198C1540278B3642DE5E3C93A31CB6067510DBC23869D4CA4BD6D4E281F6247CA1BDEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3276	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SomalifuscatorV2-main\src\util\obfuscation\scrambler.py
1⤵
- Modifies registry class
PID:5104

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact