General
- Target Krotos Weaponiser Fully Loaded WiN Plugin Crack.zip
- Size 5.4MB
- Sample260625-wwrx4sd17w
- SHA256 9061c3fd387916067c2e1df0b684ba2d5c4c77572d1bfc4a3cdf4e7b4d337432
- MD5 c28674e2e9b8f3fbdaf391ea2d348fb7
- SHA1 1ceef6ae355f45a35bbfd17241c125ddacef29ec
- SHA512 8ea241256b13a00a09b6fb8427678aa1ad8ad2d39e8e0059ed11509f358a5787ec98150fc111d2cd049f4e8290994348bb815bc94f6b0349fdc55b7e698a03ad
- SSDEEP 98304:45O23bX493Z8UQwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxN:cXIBSUQw/tyd3w++lz0byN
- TLSH T1C346023BF28B647DE06A56357AB29110953B7E616A124C4797ECF48CCF221B01E3E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Krotos Weaponiser Fully Loaded WiN Plugin Crack.zip
Resource
win11-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
.exe
Resource
win11-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target Krotos Weaponiser Fully Loaded WiN Plugin Crack.zip
- Size 5.4MB
- SHA256 9061c3fd387916067c2e1df0b684ba2d5c4c77572d1bfc4a3cdf4e7b4d337432
- MD5 c28674e2e9b8f3fbdaf391ea2d348fb7
- SHA1 1ceef6ae355f45a35bbfd17241c125ddacef29ec
- SHA512 8ea241256b13a00a09b6fb8427678aa1ad8ad2d39e8e0059ed11509f358a5787ec98150fc111d2cd049f4e8290994348bb815bc94f6b0349fdc55b7e698a03ad
- SSDEEP 98304:45O23bX493Z8UQwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxN:cXIBSUQw/tyd3w++lz0byN
- TLSH T1C346023BF28B647DE06A56357AB29110953B7E616A124C4797ECF48CCF221B01E3E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target .Store
- Size 3.4MB
- SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
- MD5 15596b41dba42cdcce4f677fbbc86b6e
- SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
- SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
- SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
- TLSH T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Krotos Weaponiser Fully Loaded WiN Plugin Crack.exe
- Size 2.0MB
- SHA256 de86f6ed66c4614cd7986d986e6552d20b7b41c6b329b34585ab14bedd1e839e
- MD5 041041fa5b56fdef04ffb3dbdd16c0d0
- SHA1 b7bc42d2845d06c3b8d4528c9b46c0f0f58d2cbd
- SHA512 5b18d2d3e97b2ca7fe2bc31bd66ea2a8ea8ff7de920afc9278592afb679faebd4dfbbf67763901bf1bfdef9ae57509105d6a0c9e90fd1b91a5b0f3a4b94032ee
- SSDEEP 24576:TXVrSLScusMmOvjjhzvLSIDajxp9u8x/37Mfs/cwHbz4pj8C1j2mk3Ua5fiJ9UWt:4uI2h3u1Hu8x/3ok9bz4pICVmkZ866mj
- TLSH T19EA5C03FF28B653EE06A16367A72A110983B7A6165124C1696FCF88CCF355701E3E787
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1