Overview
overview
8Static
static
373j3B9.7z
windows10-2004-x64
873j3B9.7z
windows11-21h2-x64
1KanvasWebserverLinux
ubuntu-18.04-amd64
1KanvasWebserverMac
macos-10.15-amd64
1LinuxScript.sh
ubuntu-18.04-amd64
6LinuxScript.sh
debian-9-armhf
6LinuxScript.sh
debian-9-mips
1LinuxScript.sh
debian-9-mipsel
1MacScript.sh
ubuntu-18.04-amd64
6MacScript.sh
debian-9-armhf
6MacScript.sh
debian-9-mips
1MacScript.sh
debian-9-mipsel
1MacWrapper.sh
ubuntu-18.04-amd64
1MacWrapper.sh
debian-9-armhf
1MacWrapper.sh
debian-9-mips
1MacWrapper.sh
debian-9-mipsel
1Resubmissions
04/06/2026, 22:47
260604-2qrcaagt8z804/06/2026, 22:25
260604-2b2vgagt2v804/06/2026, 21:13
260604-z2vgzafz8n8Analysis
- user interaction
yes - max time kernel
92s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
73j3B9.7z
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
73j3B9.7z
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
KanvasWebserverLinux
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral4
Sample
KanvasWebserverMac
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
LinuxScript.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
LinuxScript.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral7
Sample
LinuxScript.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral8
Sample
LinuxScript.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral9
Sample
MacScript.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral10
Sample
MacScript.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral11
Sample
MacScript.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral12
Sample
MacScript.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral13
Sample
MacWrapper.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral14
Sample
MacWrapper.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral15
Sample
MacWrapper.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral16
Sample
MacWrapper.sh
Resource
debian9-mipsel-20260513-en
General
- Target 73j3B9.7z
- Size 1291.2MB
- Sample260604-2b2vgagt2v
- SHA256 29d1ac17f6d9adb836731ff57ea9801d084dd2c923146db005179c2c19f10ffa
- MD5 796c939917abbfd697e8a0daf94af794
- SHA1 074e5ddc637f1b8c4303b86358d3a4a684277134
- SHA512 045e1c24af93afd1b599360c36466b03ed37c9d6a492de6f7b75743b925a6421d43456d38a31982ee3a4ba8d3bbd111506186a7b6430ec244bf3c9a3f5ba47d1
- SSDEEP 25165824:Ht3F4o1opZ1td+rn9uP1zncD8wyMU4xQBRhTK2/9xdl/ORyf:NOo1mZVnPpcD8wDU4YzP/Xdloyf
- TLSH T1E3E933DBD7411961C0BF8236CCD7A115BAB62DFDA52A6406DE06F73034717EABE21381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3952 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3952 7zFM.exe Token: 35 3952 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3952 7zFM.exe