b195d942890e926b5525d9f419523834a18016fa5db7d3c1af3858ac68309028 | Triage™

Login
Reports

Overview

overview

8

Static

static

8

453SSA-D0CUMENT.exe

windows10-2004-x64

8

453SSA-D0CUMENT.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
453SSA-D0CUMENT.exe
Size 15.9MB
Sample260701-anhtksa15p
SHA256 b195d942890e926b5525d9f419523834a18016fa5db7d3c1af3858ac68309028
MD5 cff62800e5d57b6dd07e86582c0b8e07
SHA1 66ba06d3c225d1479ca4cb7dc331cb8a28d86179
SHA512 422596ba579aaf2e2be9b4828dcf06d03d539e7224377a7aeed86722e2bab30ced2705a3a509e09506e7b14d0d510459fcb602e36ae24659dd29e7cdab3ac5bb
SSDEEP 393216:wJrPSIwPrxgU5+0QXcZBae/2TonNiY/x10CFDN3cccQrgeQToFFWJi:groPVk0GMb/Ji4x1NDa88Ji
TLSH
T1CFF6332BF65A04FAD877D538C99542A3FB71B156032962D707A48C361F7A3E5223B30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery persistence privilege_escalation rat revoked_codesign

Static task

static1

3 signatures

revoked_codesign backdoor rat

Behavioral task

behavioral1

Sample

453SSA-D0CUMENT.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

10 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Behavioral task

behavioral2

Sample

453SSA-D0CUMENT.exe

Resource

win11ltsc2024-20260629-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Malware Config

Targets

- Target
  453SSA-D0CUMENT.exe
- Size 15.9MB
- SHA256 b195d942890e926b5525d9f419523834a18016fa5db7d3c1af3858ac68309028
- MD5 cff62800e5d57b6dd07e86582c0b8e07
- SHA1 66ba06d3c225d1479ca4cb7dc331cb8a28d86179
- SHA512 422596ba579aaf2e2be9b4828dcf06d03d539e7224377a7aeed86722e2bab30ced2705a3a509e09506e7b14d0d510459fcb602e36ae24659dd29e7cdab3ac5bb
- SSDEEP 393216:wJrPSIwPrxgU5+0QXcZBae/2TonNiY/x10CFDN3cccQrgeQToFFWJi:groPVk0GMb/Ji4x1NDa88Ji
- TLSH
  T1CFF6332BF65A04FAD877D538C99542A3FB71B156032962D707A48C361F7A3E5223B30B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Network Share Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

revoked_codesignbackdoorrat

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation

© 2018-2026

Terms | Privacy