General
- Target QUOTATION.exe
- Size 850KB
- Sample260604-nb29cacz9x
- SHA256 93ff044e9247c1136e328b8bd3d225513ab3b2975c8e0e03b8f2c52aec9f0be9
- MD5 77770acd74654634aa1ab5de80acabcd
- SHA1 ca6a35f9350a171d2e56ede7c7e5054b20894a60
- SHA512 485843fa7ef0716fdb8838593bf809c998119d3ed37d5c96e5c7a29f95e83b2392f009acf56cf4ff11a102faf4822676d7ef9b6e135e0333be0a5d889b85bd82
- SSDEEP 12288:Kk7vJjwAMB4Fe2LLirB6pb6jCtcZXpljkdZT3XxoNi+7SPT/EAmd:B7v9KB4FjCrObFtcZXpljwTXWH8rp4
- TLSH T11D05F1161DC72699CBAE4F78C1B214B833F0D90B41A6E7AA2EED01F5ADA7745CD12813
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
QUOTATION.exe
Resource
win11-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target QUOTATION.exe
- Size 850KB
- SHA256 93ff044e9247c1136e328b8bd3d225513ab3b2975c8e0e03b8f2c52aec9f0be9
- MD5 77770acd74654634aa1ab5de80acabcd
- SHA1 ca6a35f9350a171d2e56ede7c7e5054b20894a60
- SHA512 485843fa7ef0716fdb8838593bf809c998119d3ed37d5c96e5c7a29f95e83b2392f009acf56cf4ff11a102faf4822676d7ef9b6e135e0333be0a5d889b85bd82
- SSDEEP 12288:Kk7vJjwAMB4Fe2LLirB6pb6jCtcZXpljkdZT3XxoNi+7SPT/EAmd:B7v9KB4FjCrObFtcZXpljwTXWH8rp4
- TLSH T11D05F1161DC72699CBAE4F78C1B214B833F0D90B41A6E7AA2EED01F5ADA7745CD12813
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1