2a8905359666b55d12e5de9b68d8a3fba2a80b4809cb9738be51902b3d9fbebf

Sharing

Copy URL Twitter E-mail

General

Target
IndividualreportIndividualCorporateFinancialRecords_FullExecutiveSummary_2026.exe
Size 18.3MB
Sample260702-pym9dagy2q
SHA256 2a8905359666b55d12e5de9b68d8a3fba2a80b4809cb9738be51902b3d9fbebf
MD5 11c574eef359fa94fcc3f90a15e154ba
SHA1 685008c15a17a370b74978a3afabcb751a2e75ea
SHA512 f91d592b2717f93c01d24b4bf61e84d4df1d24352e62a6f5e76831889862d6162be8f3842bc212ba6d5993ca22d6467edc8abb7745701d414a35b658ff5286cd
SSDEEP 393216:RnrIzsnTEGISE7Ah1p29qIT0ejrX+QdLJB7FjS6w5UZuZlqc9wyd6kMkaKx:R8YnFCMj29l0ejrX+gt9rZOdLSklx
TLSH
T100173346ED7BACF0F783453C8AC21B41B6495D95CC4BD095914A223A36F68AB8E3D7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  IndividualreportIndividualCorporateFinancialRecords_FullExecutiveSummary_2026.exe
- Size 18.3MB
- SHA256 2a8905359666b55d12e5de9b68d8a3fba2a80b4809cb9738be51902b3d9fbebf
- MD5 11c574eef359fa94fcc3f90a15e154ba
- SHA1 685008c15a17a370b74978a3afabcb751a2e75ea
- SHA512 f91d592b2717f93c01d24b4bf61e84d4df1d24352e62a6f5e76831889862d6162be8f3842bc212ba6d5993ca22d6467edc8abb7745701d414a35b658ff5286cd
- SSDEEP 393216:RnrIzsnTEGISE7Ah1p29qIT0ejrX+QdLJB7FjS6w5UZuZlqc9wyd6kMkaKx:R8YnFCMj29l0ejrX+gt9rZOdLSklx
- TLSH
  T100173346ED7BACF0F783453C8AC21B41B6495D95CC4BD095914A223A36F68AB8E3D7CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

backdoor defense_evasion discovery persistence rat spyware trojan
- DattoRMM remote administration tool
  DattoRMM is a remote administration tool that can be used as a backdoor
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 31KB
- SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- MD5 83cd62eab980e3d64c131799608c8371
- SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
- TLSH
  T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/SimpleFC.dll
- Size 175KB
- SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
- MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
- SHA1 99778940e059238ca23a513e717d4db2cf34e606
- SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
- SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
- TLSH
  T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- TLSH
  T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsSCM.dll
- Size 5KB
- SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
- MD5 62efa7b730eb0523a026ea4325403b77
- SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
- SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
- SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
- TLSH
  T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsisXML.dll
- Size 11KB
- SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
- MD5 13deb9a0f4e4286df01abc85e1895e09
- SHA1 3174853b32407fd85220de844b390a18a8a76c97
- SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
- SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
- TLSH
  T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  AxInterop.MSTSCLib.dll
- Size 240KB
- SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
- MD5 0f581e56ed5ba500ce5d98d105b04a37
- SHA1 b6e2cade601bc6fd15e7f07ed41a4dfa4ee0a589
- SHA512 9034b8c289ce3ac9386d43473a019a9b45d9de82090e7da90c3cfbb00c8e9aa1509eba4787958495ebb928481f7b42edd184ec9e0c0009d4f2f2ec98bbd92fdd
- SSDEEP 1536:/ri+u+4qhkPZVb45mF2UQJlPg85ycFtIhH0rOP7gVzySImpYQ6BDdrMkwbTTj+6v:TuBqhkPZ61wOrOzgVbpx4aX+6C1Z5gd
- TLSH
  T15134CC06DFD54AB9D2CDA7FADC64114DC1B6D2C9604EFF0A6880A8E11E477B34C9B623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  AxInterop.ViewerX.dll
- Size 40KB
- SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
- MD5 edc5e696c4ad70f0be6301f703ab3672
- SHA1 9c699039715db6bf6746e438991988f9cfaf8ea2
- SHA512 58d9441d9648ece7f0284da75fb79777679e4f00610a71399ad2a22df8b418995f6a3fa06d69c17e62faeb3e7f061e3b3ec13ccf2ac00a809832594943c33760
- SSDEEP 384:2rezJLlifR3sVk72M6InhrJqOr9xun+mB1UDn0mVLAp8RQJ:wo3ifYBIpJqe7mUD02ApXJ
- TLSH
  T1B30394009AA48EB9E2E6C7B1F5F582514270F9C67742F75F194588D9C903B485EB32F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  CagService.exe
- Size 19KB
- SHA256 91774f1195ba7042293bba1152afc334052d6c235a90e715f8c5c5fc8f27b089
- MD5 a4c13e15530f174b3c8e39c5af657b0e
- SHA1 4fcefba8647993ddd09716815abc4a3a324d31b3
- SHA512 b4e47aca364b933bc8fdb6e76d9ab9e2610f581d3ab836bc6e4139b6ff8492a6a22123c7219ec4be33ed66bc710237dea943f641a7a10a3cc553f3d9a6618670
- SSDEEP 384:hYMQor4U+94X9nmhJUZkJXfxEQTJosEyZJsm20:KorYi8TZEEmsfZJsm3
- TLSH
  T1C092C601A3E84B66F6F76F715A7206050F72FE9AAC71D35C26A4005E19B3B80CD7177A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Common.dll
- Size 16KB
- SHA256 3dc2c4a07014baeaa3938d61d5b7348e3c14ece8c7477ac5d9451ea053f3e013
- MD5 82e2deaf08ac79513064bec132ddb6ba
- SHA1 862241cdfb7e2c78093677190f026eb187634e02
- SHA512 29c32aa5154c9d9794847334229cda77b4be7768908fa26bbc08f8dab2f99534a074e2de28f35f8054150a227509fc97f7c94daa563124ce405fabe7cdbd4d9c
- SSDEEP 384:g8RZI9AhN25kqsaORsdshFJXD32sA2m2J:dZI9AhIxEhFJz32sA2m
- TLSH
  T130721C288B78C33BC65A1B31F561CE6503F5574AB281CA9A8A14E85F3F033DA44059FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Core.XmlSerializers.dll
- Size 10.6MB
- SHA256 d0b4d1a4da66d5ffdad9b4d9c6da1730f2def8e4b6679948a453b7509cdbe049
- MD5 0563aa17d7ef52f0989949c682be068c
- SHA1 00da77490d16c6c439d3006714f798d2c73ce569
- SHA512 38491577e2478e1afc60326f2a2643d388e67d3afda3883d465bcc7cdd1dd90bb8a627e8f47dc7d5712523c0f12d843af7906ebf8cc61335433cc05938183f10
- SSDEEP 98304:W8YUxrNbfMS7HbysnHD/56X55xFU7oGkwMgTr1IqfxG6X72c3/ymXZe00hc:W8DxrFfX77yQjR63Pjwz2qf97G
- TLSH
  T1E9B632D076E91E0FF87F57AD3A7156EAAA32FC1B0686D2DD06D5039920B730058D36A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Core.dll
- Size 2.4MB
- SHA256 1cf1c5e771ab0efe9ac8c0dd4cee0a7969ceb5c5a6003d4d36a3180515217122
- MD5 5e418fa976cc0727eb8617c10cf22145
- SHA1 2988fce92488405557eb4f3285533afb609f3938
- SHA512 391596c8a1165d61dc030bcb212a2c05c6bdfbf472d60c1b1451b6882a5f78aa01d37ac3551f1ad0a9d2e211367cabca7b206bd491f3de52131707fb8e0c7be7
- SSDEEP 24576:3ZiWJkLFzq5wjSNC5e8X9UKZcxcYjJw6D5/jTtcVbANvCW4o9M5qtyxGX+JaZX4f:QXxZchhLTtcV+aK9
- TLSH
  T18FC5D91026B0D6E4C4290B34783B124AB3FFD64F9B79D36E56E0166D4FA6B078B13663
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  CsExec.Service.exe
- Size 17KB
- SHA256 4ab0954307a1f387bec0e921bff807db3526073323e77e3a2b78052225ae8624
- MD5 191faa00bd4f6086c8870a0445bf05de
- SHA1 c7d5c2a4677a6e8ac5d7e70b26ca829f21b761e8
- SHA512 4704498bfb7b5eed9fd2c5b21d157a33a515e51a087a16419cab2c3ec5ab442a9855a9c6360ff2645388a308bbcf4b2b04a874944654b61f3c0ee6e78926c3c0
- SSDEEP 384:QsZOOW1SXLqF9Am3p0vA3Cdh0VcSWLreLQ/lAKmd+p8pzm2N3K:qSXLqGmavA3C8nep8pzm
- TLSH
  T1B1824A06ABD0C6FEDDAA177D3CB303511B78F7492252D39E2C8D5C1E1E937440AE26A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

DattoRMM remote administration tool

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32