General
- Target proxy
- Size 4.0MB
- Sample260608-pgj6dsds2k
- SHA256 cd9640018fa4397115c19bba60aab5afdfddd3b6c080b93dd7d7211759caa4f2
- MD5 b18d01bddb14035225dcd1abc7d37f8b
- SHA1 8530cf5c52047ed5c88c7ed512d229b608d9a8a4
- SHA512 2e76298ead6463a398564fe73abeaa56d5dc2ec74e1a5936708db193193d378ca0395c5753313d7decd3c9e121a7d1d0b608e67c7cfbffa7150a38f1927e6de0
- SSDEEP 98304:q5b+qHYjPknkDYRTACw/uG9vdnv6DYYs22qQX:cv4j08/v9JvYs2I
- TLSH T1361633C08D791DA9F22242BAF5845244F0FA1BC6E454167EC337D63564B8BC3A9A0DDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
proxy.lnk
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
proxy.lnk
Resource
win11-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
putty.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target proxy.lnk
- Size 1KB
- SHA256 9bbe1c1d58c05e9ae0d91c06b1d47c994e90866a12e584fb3004f6223885b30b
- MD5 8edd81a60831c55a659d6e17638f2dee
- SHA1 692f3a99db7bafff2bb5a07f6f8a8553153ca441
- SHA512 d2b2dafa998d6f6b99d51b8c730ea58a46c348f1f91ac444ddba66b297f4c316a3b577bf84c16c08f6b67686dbdaa8f1c6932b1ace238d7deac15e3b4f6362d9
- TLSH T12D315B121ED907B0E327873152F7D6427A37FE62B629C91D90854B8C1493817906EF8F
- MD5 SHA1 SHA512 TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
- Target putty.exe
- Size 4.3MB
- SHA256 fffa291363c6f4dd7695d56559bff754512cbdd4cc15a55bc4f34cb6006df9e3
- MD5 683103409851fff2be650955eaa6908d
- SHA1 a3ab0f343f61c9f537a21e97d6a19c2af5a18601
- SHA512 40a6d295fb02154a59183b4cd3a11f236cda8fe51faa1b04d08938753226c8e9f0273ddf54919457d6db83d3d20a9f909795983fc9a93710c92615187034f6ff
- SSDEEP 98304:LcujX9CMHSkgEFyJSfKUX1sjHvHKfc+hhps8uYq:H9dauX6HfUhh+8e
- TLSH T187262362A1E0443AE0BB0671980F4722EBF7995541288C3F9BE054CD3C75BD7A7297EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE