General
- Target VMware-Workstation-Full-26H1-25388281.x86_64.bundle
- Size 325.0MB
- Sample260701-xta29aex8w
- SHA256 3f6d2501e654dbc7701a8290ff6ffcfba6c5444cd5f35f4933cd08c9499f6d84
- MD5 b6bc666962ff9d1b056a7ea686c9dd5c
- SHA1 2945b324113c71fff0e3d229894b8579c471cd1a
- SHA512 8845ec0098c21a2530e8bb6ce0820f53d68bf32e990e1801d0ddea8be401c0691c680541c469b84482ac5a8d082aa61b8429dfa5e23966cf3f5b1f2f5ded5396
- SSDEEP 6291456:qKfvrUU4OtULIBOy2mxhfBIGpN+FJ1c+OKjjQbFvvoZfCwPw0oOFglx/6LY6f8+E:T3oU3IVy2WRBIGX2MYsvsFPo+i/6LY6C
- TLSH T1C5F83345F0A096F1E803C8308F49DAD16F192518F03247EA76BDAED647CB6BA07F7952
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
VMware-Workstation-Full-26H1-25388281.x86_64.bundle
Resource
ubuntu2204-amd64-20260513-en
16 signatures
900 seconds
Malware Config
Targets
-
- Target VMware-Workstation-Full-26H1-25388281.x86_64.bundle
- Size 325.0MB
- SHA256 3f6d2501e654dbc7701a8290ff6ffcfba6c5444cd5f35f4933cd08c9499f6d84
- MD5 b6bc666962ff9d1b056a7ea686c9dd5c
- SHA1 2945b324113c71fff0e3d229894b8579c471cd1a
- SHA512 8845ec0098c21a2530e8bb6ce0820f53d68bf32e990e1801d0ddea8be401c0691c680541c469b84482ac5a8d082aa61b8429dfa5e23966cf3f5b1f2f5ded5396
- SSDEEP 6291456:qKfvrUU4OtULIBOy2mxhfBIGpN+FJ1c+OKjjQbFvvoZfCwPw0oOFglx/6LY6f8+E:T3oU3IVy2WRBIGX2MYsvsFPo+i/6LY6C
- TLSH T1C5F83345F0A096F1E803C8308F49DAD16F192518F03247EA76BDAED647CB6BA07F7952
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads list of loaded kernel modules
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Defense Evasion
Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
1