General
- Target Spoofer.exe
- Size 12.1MB
- Sample260619-t5tryshx7p
- SHA256 f2c8ae5bd9c07fc3f66cb76b66ae7a2519fd4a300ce6baed2f3e4d23fdc049a8
- MD5 3a9cc7793a5d8cf554b16904c1dc209e
- SHA1 8d92698920a922a1345a16f893c6dead9bc98594
- SHA512 5f2062a09bda978042d059dff1ecfd69aa786cb97258a50f92ccbcf0ed023cbfc5f9cca72dddf8ca6dd77dcc003a64533e90438241ab1a0a92b5348fbf3be9a8
- SSDEEP 393216:GrehL69HwLXEAphVtnIUQSg+Q+t6PvF7dvplG:L+9HwLRphDto+Q+tqvF7w
- TLSH T1C1D633A9768019FAF8F7943C6D60C5B0E2B179502F92D2EF07F41E162D3BAA44D38791
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win11-20260513-en
16 signatures
900 seconds
Behavioral task
behavioral2
Sample
Spoofer.ps1
Resource
win11-20260513-en
3 signatures
900 seconds
Malware Config
Targets
-
- Target Spoofer.exe
- Size 12.1MB
- SHA256 f2c8ae5bd9c07fc3f66cb76b66ae7a2519fd4a300ce6baed2f3e4d23fdc049a8
- MD5 3a9cc7793a5d8cf554b16904c1dc209e
- SHA1 8d92698920a922a1345a16f893c6dead9bc98594
- SHA512 5f2062a09bda978042d059dff1ecfd69aa786cb97258a50f92ccbcf0ed023cbfc5f9cca72dddf8ca6dd77dcc003a64533e90438241ab1a0a92b5348fbf3be9a8
- SSDEEP 393216:GrehL69HwLXEAphVtnIUQSg+Q+t6PvF7dvplG:L+9HwLRphDto+Q+tqvF7w
- TLSH T1C1D633A9768019FAF8F7943C6D60C5B0E2B179502F92D2EF07F41E162D3BAA44D38791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Clears Windows event logs
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist
-
- Target Spoofer.pyc
- Size 113KB
- SHA256 f209784950909dc4939d24fa93940f416762b7f15b6ffe70d4edcb9dfd30da1a
- MD5 ba46391b874cddeefb9b4b6b3b7e7aaa
- SHA1 0d38010dea064919f4388bbe5acaa6462f637c9b
- SHA512 8974a73edc34358758df9e6ef1dae0d2385f4e5a75d36893a27bed587f1c231e6c287bd36d89d13e5d0fc128182201b0424c14171cad2a67469cf4676e6b7a8f
- SSDEEP 1536:HA5eQFYxpQWkjVGYILMo/4xxQCF4DsUhYM:g5v0k5GYILT/4xfF4DshM
- TLSH T1C0B307799A70B237E9CEB17C32D39899673282857705DA13E01CAC7C3EC67185A6670E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10