e49d5d0770bb17220cf11db2365a2307ad1d82eeab1f3ced1d6c0d0853b8a599

Sharing

Copy URL Twitter E-mail

General

Target
hfsexplorer-2026.4.9-setup.exe
Size 1.9MB
Sample260629-xm4e8aes7n
SHA256 e49d5d0770bb17220cf11db2365a2307ad1d82eeab1f3ced1d6c0d0853b8a599
MD5 5a93ed7be443f5d2cc1276e7895f8011
SHA1 55d14278f72c4c94e1c275624bfc799eaab73924
SHA512 0e31d6cbdb6364c3e74347dec05e208e6372022c107d6a59ae01152ec3752b7a3e12393723fe698ad477761632ada4f03101a1703bef9a0268a76809dd43e700
SSDEEP 49152:v2ei7KXIz8VLmx2c7fKKYzUAlHijDxcUXJ3wgTIOaOnaH5Fmbufx9:vrDXIEidAojy83wgSEQ58qn
TLSH
T10995333435148B1FD47C21300C1E6356AA56AD3AE78526F283B5BCAC5CB7985CF6EE38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery linux

Malware Config

Targets

- Target
  hfsexplorer-2026.4.9-setup.exe
- Size 1.9MB
- SHA256 e49d5d0770bb17220cf11db2365a2307ad1d82eeab1f3ced1d6c0d0853b8a599
- MD5 5a93ed7be443f5d2cc1276e7895f8011
- SHA1 55d14278f72c4c94e1c275624bfc799eaab73924
- SHA512 0e31d6cbdb6364c3e74347dec05e208e6372022c107d6a59ae01152ec3752b7a3e12393723fe698ad477761632ada4f03101a1703bef9a0268a76809dd43e700
- SSDEEP 49152:v2ei7KXIz8VLmx2c7fKKYzUAlHijDxcUXJ3wgTIOaOnaH5Fmbufx9:vrDXIEidAojy83wgSEQ58qn
- TLSH
  T10995333435148B1FD47C21300C1E6356AA56AD3AE78526F283B5BCAC5CB7985CF6EE38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bin/dumpfsdata.bat
- Size 270B
- SHA256 ff3cf8d7135640af412d85e1e0aa36476b006a8af13de49ce9e5a1ddcb3839e7
- MD5 88da4a496a8deb538e08738a035236dd
- SHA1 32679533c55e8cbaf1ec1007bb50906c533caf1d
- SHA512 c5338212ca270848d27f2ffdb2f8ea090099271e2003b6cdc5abec165b6ccab52650c5cf6f61ae059d2819ae05507cd9e8adb7400fb28cb1c066bbf790637ffe
- TLSH
  T129D02BEFC0A6262033D304B1EE0C9A6B6A1BC82D429570F2704080731808B2E53DC0BB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/hfsexplorer
- Size 672B
- SHA256 bc485190927a0e0c2667e9107cfc9ecd9034f8d99c71592022b5406e5278366e
- MD5 a99c885b618e0ae6b48d462e2dc88bc2
- SHA1 bf47fa0d26a1229356bbad234d573a79c36d3c42
- SHA512 c9e1b84e78a28bf37c7f00fcaae0c2af2d843c7c1889faae4b27d9b2aa7e3f397214616c1e97aaa6088bc5ce31deb17aec2fa111dd4841170ab000f3132e8a3b
- TLSH
  T1D8012354115485E603AFCF653B0BDCC9A805220B50505D29F56DCB157FF93358482AC3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  bin/hfsexplorer.bat
- Size 270B
- SHA256 7f4d2996e3e2e8dfc8385edc376b68ff854fe686f72e6091dc51b65040c0a462
- MD5 b5195389d9f3eff2aa0170fd047f8251
- SHA1 45b2ff5f501c84f06ba9c25598139dafb6ac00cc
- SHA512 1e5071beeb54d7422f3f5d313c1efc1fa655952bf839a9ec4376e65e481311edf2afeddeb3ec276df2174bbd85b5db0e2cec43455d6b2efad331a3e98d397169
- TLSH
  T1D0D02BEEC096373032E304B1DE0D4F5BA22B8429128474E2205080655805F1E53EC4FB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/hfsexplorer.exe
- Size 675KB
- SHA256 d17f6d997993f33c92333f9fbb4d64506dd49ed9c03812ab418dabea6948dabd
- MD5 1c431d2ddb93d3efa8c31cea6ea69401
- SHA1 4df117c8249a2ce377bc22f8ae1f56d891949202
- SHA512 21d0168a5851631682f1fe55027c5056b8cf4f6b818f6ade4e62a562dbee46b625934fe314774f7aedba6667e91241f4bd212b6400c48acba6408c85a43da115
- SSDEEP 6144:sYLvkClfRboS8lM/Ndo9SLVckGzBpcCwMCYS9RWUYDOtaEUNJFK/DmG/K67863Tn:sYjkCBV4FaF6S/yD2pUv8bL
- TLSH
  T187E46C50BF8669B3EC01427449A6D7BD1374BC909A22F73791F0FE1F3673A920D9261A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  bin/hfsexplorer_vista.vbs
- Size 496B
- SHA256 2599bc161954294e41e00b714ee0d3e199cb559c13b8962e46a1e5c90e3fd023
- MD5 853975571ca02610167c2de5e9fb64a1
- SHA1 666091ec1825b27a819b3bfaa3e5dde5d831851b
- SHA512 727a44028ee82c5cadf7f751101014467dfec2feb2ca666a39522a46b43ade3e1d17eadb453f017fd215b816861bce09788d455111bb08b612a08cd32cc0b32f
- TLSH
  T182F09E924BC5C90917BF41C1E5E7CC91536957785B70AC566CCE984493032AC16375E0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  bin/hfsx
- Size 286B
- SHA256 c0b521472a84b6b6dd29ea45682e7b3780bb0d45497c1675044cd37e02d63c68
- MD5 39dfcb755ae6082b86269b7ae4cee7f8
- SHA1 09bb097fbc306f7f70fec03ff14c09570eb1505f
- SHA512 ee4a1f84e1cb9cc55e57f627025f7c5723fc7e63e0ad94e640d9e44ea70252528917adb19f4df3e661abe2b0d6138b119bb2462539252c6b327033b004236b8f
- TLSH
  T1A5D02B20605481E5167BCEB3BA09CC68F809722F5614693DF09AC5152FE8795E1E16C7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  bin/hfsx.bat
- Size 100B
- SHA256 be10629635db60280364014451615d5b3979d121eed72bb68b9dae86e0cc72da
- MD5 7e4405f833126fa95118f3b5d1e88cc8
- SHA1 04b141e0d7a1ea108067aeb7f567dafffac18627
- SHA512 893e239f0f04dae6dc2586283c826a7359ecdea252ef90fd64a9efb0a03daded25ef1e34e6f67a7f5dd45ecf47fa59f26a0873522f93df03c808245d291fd02e
- TLSH
  T1F3B012DCC078427473F74172E31C8E17801A9169C4C41035F40156220049F4037D41E9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bin/resview
- Size 295B
- SHA256 d13145b3ecefe4588bd5398742cf0c046cb0bced435b7ac5d61e20f3371c7e0b
- MD5 f92e74bbf6309724621d05b72e6238bf
- SHA1 39a5af7f3c3215d5365add27d479589dd292c6a5
- SHA512 11572a7468b397cf7bdfce26549f00edf3c977d3cb7ecb968c4d41ec9d667034c0363df21831859635110733d289a5313357b21a715b948714a8f1f5ed34ca40
- TLSH
  T133E0E710601441F5157BCE73B904CC647C49311F4124783DF059C0042FF4B55E0D15C7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  bin/resview.bat
- Size 243B
- SHA256 7c39efd14c3674cf60f897bc8e8925a4edc7e6d89bc0a4f80a59a34f06f21072
- MD5 0d6c68e932252f56b123d74312e72efb
- SHA1 ec34ae49ce13bb38e42b762b0d8584468c8444ce
- SHA512 c6b4d3270270307b753f770cee5fa19cf21176f60ad90f1091bd98957998f0fdda1a6c78d4d294f33c611688d8a94e93f483fe8cdad3c5c3055d2e5b6699136a
- TLSH
  T17ED0A75BC0F62B7033F30495DD1D5A69A59B987E92E5B4F2704080A61484F1E87EC4BB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32