Resubmissions
01/11/2026, 05:08
261101-fsw5naas5n18/10/2026, 12:45
261018-py79jszvf118/10/2026, 12:43
261018-px14vazvcx18/10/2026, 12:12
261018-pdnpeaag221003/10/2026, 23:38
261003-3mrz3szy2p01/10/2026, 11:47
261001-nx26ga1bra1027/09/2026, 23:02
260927-2z89fsyx9l1027/09/2026, 22:09
260927-128j9szxex1027/09/2026, 11:54
260927-n3acmsyvez1026/09/2026, 22:37
260926-2j7qpatv8r10Analysis
- max time kernel
898s - max time network
504s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 15:02
Static task
static1
88 signatures
revoked_codesignupxinstallerstealerbing_mod2m1wiperlimhostbulkavmprotectthemidamayo24rataptlazarusbackdoorransomware.trojanmetasploitlockbitsalatstealeryureijlockersheetratbabylonrathacktoolnighthawkblacklockbotnetzloaderxredspywarequasarumbralxclientamadeyinfostealerredlinewormcosmuwarmcookiekeyloggernanocoresupershellblankgrabbermimikatzrevengeratpersistenceneshtabertmispaduhermeticwiperdownloadernwormblacknevasgofingflyagentlynxloaderxtinyloadersectopratduplexspyratdtrackarcaneaura_stealerpennywiseremcosxworm
Behavioral task
behavioral1
Sample
Red-Flaged.7z
Resource
win11-20260513-en
3 signatures
900 seconds
General
- Target Red-Flaged.7z
- Size 328.4MB
- Sample260605-senbtabv6m
- SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
- MD5 0c22c97e5f0c0cd86a1daeff10d51581
- SHA1 9f760e31fc9f4763cc04716e669d6ddd547f9fd3
- SHA512 e31ee3466d4be1b660c73917fbc3ad288974316f4d8e92f8d2e8520c4c805ceb3b545bc1fda47a67563301aa4f2d12c8685818653e95d28fd5a8387154d9c833
- SSDEEP 6291456:m3tJGUA4R5hz4EQLvSkRNLF9lD7C2GabF9sV0c3V+5ZcqAgZDFvVCG9KrGpUQXKz:cIqmSkRL7D7CBabqhGsuF9C3rGUQXKz
- TLSH T1FCF833E898E71050F222D1A80DEAEA021F4D98D4B66DC4D32E652FFB5CEC2FF85B5055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4800 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4800 7zFM.exe Token: 35 4800 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4800 7zFM.exe