0ced8b80333bfb3643ed3c2b6814d245eb2a9d0e97eaaeb54ff3f9faadbe05b4

Resubmissions

27/06/2026, 20:21

260627-y48a6sdt9v5

27/06/2026, 20:18

260627-y3p37sdw8k6

27/06/2026, 19:55

260627-ym8klsdv7r8

Sharing

Copy URL Twitter E-mail

General

Target
TheExecutor.zip
Size 1.2MB
Sample260627-ym8klsdv7r
SHA256 0ced8b80333bfb3643ed3c2b6814d245eb2a9d0e97eaaeb54ff3f9faadbe05b4
MD5 9c346872b0b29041c545f8d4c1b714ff
SHA1 baafbf7c233835700f722c4f69c60999673e72df
SHA512 7f6f94797dc6bc390ff64d2fabfa1274e586a5e6af237d2f096e778d19b3272297f1b9fc87653799f1a491dd7d3973adcec8057509072f920d16e5a70cffde68
SSDEEP 12288:ri3qe/iD56RmzoV537Ogr2VAHx7JijBZdPfP+Q4AFUBNgVr7FMQPlZf:0qfZoTS3VAHxKBZd3PT4AHfFMmlR
TLSH
T1B3457C4427FC8767E2FF1B75F474421687B6F406E96AE78E1A48A5FE18937808C10B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TheExecutor.zip
- Size 1.2MB
- SHA256 0ced8b80333bfb3643ed3c2b6814d245eb2a9d0e97eaaeb54ff3f9faadbe05b4
- MD5 9c346872b0b29041c545f8d4c1b714ff
- SHA1 baafbf7c233835700f722c4f69c60999673e72df
- SHA512 7f6f94797dc6bc390ff64d2fabfa1274e586a5e6af237d2f096e778d19b3272297f1b9fc87653799f1a491dd7d3973adcec8057509072f920d16e5a70cffde68
- SSDEEP 12288:ri3qe/iD56RmzoV537Ogr2VAHx7JijBZdPfP+Q4AFUBNgVr7FMQPlZf:0qfZoTS3VAHxKBZd3PT4AHfFMmlR
- TLSH
  T1B3457C4427FC8767E2FF1B75F474421687B6F406E96AE78E1A48A5FE18937808C10B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  ARMClient.Authentication.dll
- Size 66KB
- SHA256 9931b5d62e7fb38eeb8f86f6204b6055f7eeca08cba780698167c8846ca90647
- MD5 bc1b4885c1bcc757113a7e2c000f4821
- SHA1 e1153f6423567ca4a2b7d4947cbdb1aed5ca11d8
- SHA512 5fcdc9d31956437a4bdf459e337b76f93070bbf430121a651e52517e833d79f38ce3c3c124d099bda5e039252ccb32f40f64ae3517250a47f73134402e0433c8
- SSDEEP 1536:M9vycbM2Ur9ozNPl9kIzGcGJVOvALlqwhuPDmLNzR4INnS:Pcj7kIzGcO0DSRLNnS
- TLSH
  T196636C85A7FCCA23E6DF5ABCD1A4D1471B72E7966810F78E1C8CF4EA244338046416AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ARMClient.Library.dll
- Size 32KB
- SHA256 90d4ca5ab2baf128d46a3f5d5a71bea524c413f40bdbc4a03668436bcfcce5f3
- MD5 d6bb28c67f08bead73403ae90787b64d
- SHA1 449086e0b990918fc4f15c8ef9e8d48a6486b7d1
- SHA512 6b29dec43b7ccdea3c74afe7a40d6391e26702238f4a9ecfd0fb223d279021ebbe0801723006beadf340bcd50ea8752adb696622dad83e0b32a5e75c6663fb1b
- SSDEEP 768:OZmbSucRuI3sUeaHj2eQLUrDj08BkaXQyu6ewxaaicmhH9AIIKqU:vbj3yeaHjTQwHPkGQLNaa2IdkU
- TLSH
  T1FCE27CC48B6C9523C98B5EB896A8C1436E35D3DA5D21E65E08DCF8EA1CD33C9970473E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Autofac.dll
- Size 203KB
- SHA256 aeb4740b19a98193cb2a89774ac226acbbb41596e8dddd1e29fd26d36e03e57a
- MD5 10bc31ee765d430eb53d7fe972345f9d
- SHA1 1a8929ae4111c2d6611f68708f3d5ef860687590
- SHA512 d67076f0e0a79a7b3c05c9ab953b8817a91bcaa78d5e703e2bf6c6e65bf7d7589306d191307faa2941cc49e58b5534317d49aff75823e826b0c917fa5c1e397e
- SSDEEP 3072:oJtUPV2BadGe/W/dSmcLOZPWHQ17n56Wwmz9lWbv7C9DahVP:oeOe/ikSJv17n56Wwmzyz7C9DahV
- TLSH
  T164143A4523FC2737D1FF4B7EA47450418BB6F517E845E64E4F9810FA06A2F05AEA0AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Newtonsoft.Json.dll
- Size 531KB
- SHA256 7b1bbdd36dfccf96d8b941782bc79a43072130989331242548c3553d5c8578ea
- MD5 859adf11b4d2a656a8ee2d070b726743
- SHA1 d53682045cf3b3d674b0c957643bc2abc7fa42c4
- SHA512 6540acb9f3e8884af60394aad8e17964d4cf1469d7f0df589dee86a672f711588b70d3fd4033ecef5d954ef4cd7ba8581c2855d6311921da68a6a9b7c20e0eba
- SSDEEP 6144:YeC37wbJmJ5bd4m15M+S50cK7q2UGu7WEYEaWdDBLH5WHxJ16Wi/h4aBTBFFu4J+:s37Ogr2VAHx7JijBZdPfPi
- TLSH
  T19AC43A502BF89726E6FE2771F438061557F9F45AE67EEB4F5A4095AA1C837808C00BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  System.IO.Abstractions.dll
- Size 53KB
- SHA256 7da16ef846948a94f665b694b9b65e6882496dbb27ba57a17abfbb51f7cf07be
- MD5 f239405f612d8f172eaa8291be224ff1
- SHA1 3328282fd11c277af4e55747dcfda358243d9942
- SHA512 038d20ea3aa0419032b34c7dea4e4b613fe4f7bc75256820c94cbaf7bb8a5dc5f6bbcc08d21f3a6129cb5fb9773100d11bf7561dc11844a04dcaf3d6bb6ef0b4
- SSDEEP 768:Dui8/DurjNnJRqqjqqBqqjqq5c55c3dxgYk9A9yu6eTLSnEKmh0QSnE5:Dui8/DurFc55CjgrA9LNHCIHh
- TLSH
  T19B33F75C2FF4E157DC2E05B479A0C22A6B38D682C803E31A2BB5BDF56C733A5C61245E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  TheExecutor.exe
- Size 305KB
- SHA256 576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28
- MD5 6d9dcaa75e1846e79d6f0eeef87aae10
- SHA1 0d6231f8ed4445e7b1e716bb34b55e5e362a825d
- SHA512 eb8edd40ff7881b15c809febdcab209ebaed7a6ea1098425f035d2b0cdac3f4e0ce832ef35b5e3802e7cbb4c7df661c38f471145c584ec3ff167654ca6c4f88e
- SSDEEP 6144:jIQ4WYGDlFUBnNgVUq19v5pwOMw1cilZg:0Q4AFUBNgVr7FMQPlZg
- TLSH
  T14C644B86636CC7A1E16F1F76B86282EA8733F9069CA5D7DD194CE7EC18637818C10727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14