Overview
overview
8Static
static
1sample.tar
windows10-2004-x64
1sample.tar
windows11-ltsc_2024-x64
1Linux_for_...ash.sh
ubuntu-18.04-amd64
3Linux_for_...ash.sh
debian-9-armhf
3Linux_for_...ash.sh
debian-9-mips
Linux_for_...ash.sh
debian-9-mipsel
Linux_for_...onf.js
windows10-2004-x64
3Linux_for_...onf.js
windows11-ltsc_2024-x64
8Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
sample.tar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
sample.tar
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
Linux_for_Tegra/flash.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral4
Sample
Linux_for_Tegra/flash.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral5
Sample
Linux_for_Tegra/flash.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral6
Sample
Linux_for_Tegra/flash.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral7
Sample
Linux_for_Tegra/p3701.conf.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Linux_for_Tegra/p3701.conf.js
Resource
win11ltsc2024-20260629-en
General
- Target sample.tar
- Size 170KB
- Sample260702-anhhtagx3l
- SHA256 07f86e85bc07ed8fce4e2ce2912011a49909517ed4277ba8125896fc1132fe9f
- MD5 32ed754a54d4a568f732ec79b0127536
- SHA1 8d09f63b6ab3b19e05ce82c138a4c7264a9bd5ca
- SHA512 34368fb2905fa9ef22d3a59318b65e2d076653342f670b4de4b60c0241b305e2bc1b20d910cf14ae37b2c1954fd6fca23a7a9161b32cc57f4abdf559e8c73a45
- SSDEEP 3072:VB51EkqTRzwqnTa9sV/cg//RfAuLnrmv06V81kfhB4aj2+:lSTRzwqTa9sVO4a
- TLSH T15B041A0ABF0C1BE5D241C1F89F1951CA6F2D8297CE6A2C96B0EC745D237A6F8C5F8851
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 800 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 800 7zFM.exe Token: 35 800 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 800 7zFM.exe