Exelon.zip
- SHA256 dd74f26833b22f851242a501aea623d5f92bca2b20b4bb091a3be568bc33ccc0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AnyDesk (EXELON) 1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
AnyDesk (EXELON) 1.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
AnyDesk (EXELON) 2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
AnyDesk (EXELON) 2.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral5
Sample
AnyDesk (EXELON) 3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral6
Sample
AnyDesk (EXELON) 3.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target Exelon.zip
- Size 3.3MB
- Sample260626-whe2dsdy6l
- SHA256 dd74f26833b22f851242a501aea623d5f92bca2b20b4bb091a3be568bc33ccc0
- MD5 235a8ba5282bcc3ea32bd69fcfaa63f8
- SHA1 014d38df3c850711565f47b2e122ba272fc09b00
- SHA512 224235cb98268dc26ec9c4b8a17ec46ae7672c17b379439b0421720828c366afd620eec5b6e8d9d979b66be15aaae1ca1fe121ffc0e63dcfbcddf817f13a5979
- SSDEEP 98304:CLc6fuv5mnflzSlmJa6To+te3LLBzoWM1OB9Wnts8t0hzo7wTM2fqU:CaMflzSfCgL2QBqr0a7vA7
- TLSH T1F2F533F5241CE3D050E5FED9C49A18C21234B2A3D324EF972E51B87AB67D5B12217EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack003/AnyDesk (EXELON) 1.exe unpack003/AnyDesk (EXELON) 2.exe unpack003/AnyDesk (EXELON) 3.exe
File Explorer
-
Exelon.zip.zip 3.3MB
-
Exelon - Copia.zip.zip 3.3MB
-
Exelon - Copia - Copia.zip.zip 3.3MB
-
AnyDesk (EXELON) 1.exe.exe 1.3MB
-
AnyDesk (EXELON) 2.exe.exe 1.3MB
-
AnyDesk (EXELON) 3.exe.exe 1.3MB
Exelon - Copia.zip
- SHA256 47c3832f19a65a9a0e0020c26d79a16a97a8388ac13cf389a8db2021145c7792
- MD5 a2b0f3372aa7c96bb1f4e5e842c52cf2
- SHA1 d6e4885936016d5e6d36b4a9a71282f4e27b9302
- SHA512 2f73718b0055527a11880faf359cd7f8180bb7f6b48a5f5ed4ff6f10dbdd111ff96e9d6c8c4178b5951037c002bb187ff7748f141b548fb7f8642e28de13f27c
- SSDEEP 98304:4TcEbUZN8TVf1KLm1YATCY5e9BHbroQU9C/LWnB6gbAxzoTOFa88qI:4cmRf1Kr0UHIe/slAKTP5j
- TLSH T17BF533F5241CE3D050E5FED9C49A18C21234B2A3D324EF572E51B87AB67D5B12227EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Exelon - Copia - Copia.zip
- SHA256 091aadf77eb5726d30f98f415595c1445e3e12a2d9aa4825ebb0965593ceac3f
- MD5 bc387393f5a9f16361e03e7190e2fd77
- SHA1 9351f9e3916bd20606bc4c4e032251bdaf3868c6
- SHA512 8bb37ffc8a1cd7fac9bca5ca07f5356756475d28c2caedd4cbcc6028482f814abdc94dc5b18bb0c5e5916ecf85a2996d90d6c6755c29f196448193410aff0c69
- SSDEEP 98304:c3cSf8rfOZP35OmvU6Tauve3DnLno6rKALMzjWnTeezefdo7610v:ccWl35QMKn86rYzmNea7Tv
- TLSH T132F533F4321CE3D450F1FADCC99A19C121787362C261FF861B927866E6BE9712527CA3
- MD5 SHA1 SHA512 SSDEEP TLSH
AnyDesk (EXELON) 1.exe
- SHA256 e9ebcc9d6b62ceb889dac85e330a497d898e7e3ebe59b19d2ed3f75bc9c4ff1f
- MD5 5ed48f8446aadd8ac30cf3199e79fc52
- SHA1 b9e80d72d5962cc2be59568aeffcc906247bd818
- SHA512 b8fc8933115af40d0f3bb7ecfb2e2199c051443e96fed707617736064145471d796e7a2754233a2534fd7d5ed83ab5f278f4202b1c4af2dc752e8f364a1b022d
- SSDEEP 24576:KyW1Ibz0BjHJjlgbwwC/8j0y2kdf8FN7BZxgBarOEpOnjgnyWEzR1:KycYz+Jjlywwu4/d8ZlO
- TLSH T12D55E0493BACDE5BC24C0BBCD9AD47A053F0D8685A63D703610891B57F633B8AF46297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
Virtual Size
860KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.fag0
Size
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.fag1
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
AnyDesk (EXELON) 2.exe
- SHA256 ca4918747cf647870399f082849146c4de0ebb1d88c50ff0831a580dc1f7b99e
- MD5 2b81d20519f206b3a2c63d9dcd7bb724
- SHA1 14fefc5362ef3be3d2f59b834d5ad5a33118056c
- SHA512 d5bb55ee64dc0ec0e2faafb063df9b88d2a436926c34360ee66c2d8dfdd03c175f4e2e9afe9d1cff845e873ead0e1fbab94ac5295ea488634274b55766f4190d
- SSDEEP 24576:fQemedsZ5uJ4FbMMkxP9Dr/dW1GOAxqIiltDPTjsg6Il9NpO3KoDC+GkcoXtJuUe:oXeSje4NMM4xrleWqIizP3sMl9NUaoDv
- TLSH T13155F15ABBD8CF97C14C877DDAA50BB173B0ED397A6BE70B102455A82D4336CAF4104A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
Virtual Size
860KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.fag0
Size
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.fag1
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
AnyDesk (EXELON) 3.exe
- SHA256 464f5f7c802939d7b5753cfcf51180e1ce6678bbe96a1ccd2717e49cc48e2854
- MD5 72e89e69385280ebebe27bab29a7758d
- SHA1 fef4a8f1033fa2dcaa2e6f67c75b927bfa6eda2c
- SHA512 c787d4f95f7fd0d94dbb85c9d3f114ad084359c49e5a8f7eb069e0f33e2d0d1c3e63862320e431aaeb1780ae7c33bcfb4ce1cfe6547f2bf723a3039d976b94a3
- SSDEEP 24576:bhgc72LsfMMWnPwwNETev1jpvrYLJqh+EvS3GSQvQAl8fr:bhgN8/WnPwwNEevue7vSnQv3
- TLSH T13355E00A33C8EEA3C0490F7EDEA64FB423B4E1656B63E717215D667A6F133689F44142
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
Virtual Size
860KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.fag0
Size
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.fag1
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ