Overview
overview
3Static
static
1FLUXSMS/__...13.pyc
windows10-2004-x64
3FLUXSMS/__...13.pyc
windows11-ltsc_2024-x64
3FLUXSMS/__...14.pyc
windows10-2004-x64
3FLUXSMS/__...14.pyc
windows11-ltsc_2024-x64
3FLUXSMS/fluxSMS.py
windows10-2004-x64
3FLUXSMS/fluxSMS.py
windows11-ltsc_2024-x64
3FLUXSMS/sms_api.py
windows10-2004-x64
3FLUXSMS/sms_api.py
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/06/2026, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
FLUXSMS/__pycache__/sms_api.cpython-313.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
FLUXSMS/__pycache__/sms_api.cpython-313.pyc
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral3
Sample
FLUXSMS/__pycache__/sms_api.cpython-314.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
FLUXSMS/__pycache__/sms_api.cpython-314.pyc
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral5
Sample
FLUXSMS/fluxSMS.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
FLUXSMS/fluxSMS.py
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral7
Sample
FLUXSMS/sms_api.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
FLUXSMS/sms_api.py
Resource
win11ltsc2024-20260617-en
General
- Target FLUXSMS/__pycache__/sms_api.cpython-313.pyc
- Size 12KB
- Sample260627-ankyyagv2k
- SHA256 063151b78cef190013481b33df900e1b79609af1b2a5b346bec48403183c3a68
- MD5 b17df9b90ae926039c9175aae20bf15c
- SHA1 921e45ca37797e5740eeeedb29b9dcf3fc460101
- SHA512 15e9ebfe6a0843afa623b03bdac9487ab8bd214774222db75d374e4dfb5578fa92f93ed34f6fef278a28d89be06aaaf183bfac3aeb24e65693522165ab464c0a
- SSDEEP 192:R5eTm8TuuYncKcO1cNYwRwdbARwxxQ9UJZKEZn4Z2S96/HI/zMC+1HFaZk2stDmq:R5etDJOVZlXZ/XV7PyPuH
- TLSH T10742FA975C05E26EFF80F17C54FE1308763A36EAB515C6627B0C82A219DB747E254F08
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 972 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FLUXSMS\__pycache__\sms_api.cpython-313.pyc1⤵
- Modifies registry class
PID:1440
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:972