General
- Target python-manager-26.2.msix
- Size 44.3MB
- Sample260628-c2jzxaez5j
- SHA256 66f0370d3f47068916dbd35b2afdc7cf72cba57500e070844a6ca2aa43ec5d70
Malware Config
Targets
-
- Target python-manager-26.2.msix
- Size 44.3MB
- SHA256 66f0370d3f47068916dbd35b2afdc7cf72cba57500e070844a6ca2aa43ec5d70
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target python.exe
- Size 103KB
- SHA256 3adbbf2af609e206e3ca18cd55fc7c4b52f5c8bb8218dd99fd5a9e50d7a193cd
Score1/10 -
- Target python3.dll
- Size 72KB
- SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
Score1/10 -
- Target python314.dll
- Size 6.5MB
- SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
Score1/10 -
- Target tcl/dde1.4/tcldde14.dll
- Size 36KB
- SHA256 95454d21be84b4bef1f90b7aff56484b0111b30384d7c6d1a05463871c8036d3
Score1/10 -
- Target tcl/nmake/rules.vc
- Size 61KB
- SHA256 5ca108465a7c0a6632f117d96bf59cf60aa53b2e5766b3a65e6f8c8946c7f280
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target tcl/nmake/x86_64-w64-mingw32-nmakehlp.exe
- Size 25KB
- SHA256 5f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1
Score1/10 -
- Target tcl/reg1.3/tclreg13.dll
- Size 33KB
- SHA256 0250f59bf28cb7b65ed46a3befab5cff58785628502c5bd982e4c890580b85ad
Score1/10 -
- Target tcl/tcl8.6/auto.tcl
- Size 21KB
- SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
Score1/10 -
- Target tcl/tcl8.6/init.tcl
- Size 25KB
- SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target py-manager.exe
- Size 306KB
- SHA256 0c2e4cbc410c1b98d95cae5065765b839aca9207bcd4992237c6a7b813b8fe7d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target py.exe
- Size 306KB
- SHA256 faa7c321fe7f00c067ce1764def1bac9234b91fc2d42e8f9a92d2a468f780006
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target pymanager.exe
- Size 306KB
- SHA256 9ee8c5b95fbddbe0484a07a25b812c5abbf9fa9855aa6a81491b8a99f84331f6
Score1/10 -
- Target pyshellext.exe
- Size 1002KB
- SHA256 a6d65661d3442c9bfa0bd50f7464f5fc95e6dfbc6dfdf1cb72865c758936515c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target python.exe
- Size 306KB
- SHA256 da15ee6d0afe4c46d0699fe62c268000bac29083ef7ef65c225022667806ac1c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target python3.exe
- Size 306KB
- SHA256 a97426290b72db3ff7bc0ac501f3b16b9d37aab77582241556353feb3fa621cf
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.