General
- Target New folder.zip
- Size 31.4MB
- Sample260702-ydqcnsdv2s
- SHA256 e715bfeb2556d053f4acb36c6bd12d86321f44b5c58894ff0b48fcab9add1598
- MD5 77b12191c08564871894f8acf1ee52b3
- SHA1 8218368a21fe0acbe56e8896b2a98b9c55e1b177
- SHA512 5877d750874c79bad8206f4d9ff31eb0f4560e32c9e9fe7c7ef679e7eaf3623e48c5c0afc28bb60688a799e228b7de1d80bb2ca53f349fba3e9553c728bce4c1
- SSDEEP 786432:lqYvgPSAGLcvjlZK4WDsJSGU26US/AtzvjnEb5puNn:USgNJKPDv3lX/AhsGNn
- TLSH T1AA7733C5897B1F9A608CEB1B3574BD6902C3826EC94B7429E4B437C650DF9E7C80E86D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New folder/cimgui.dll
Resource
win10v2004-20260513-en
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
New folder/cimgui.dll
Resource
win11ltsc2024-20260629-en
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
New folder/norecoil.exe
Resource
win10v2004-20260513-en
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
New folder/norecoil.exe
Resource
win11ltsc2024-20260629-en
1 signatures
900 seconds
Malware Config
Targets
-
- Target New folder/cimgui.dll
- Size 1.4MB
- SHA256 60ec992bcebd354d59f235ed97cdc3b0eea62c2def53c4a71f22937e500fa80b
- MD5 7225d6dafc75934427c75401a2093b1c
- SHA1 2f8dff8ed737b9277ca77f4f155d89b5eb034428
- SHA512 74454f45172df9ad303b86d12e1e2e4c61f0af22e61c78fc552965b28e0ee3a9924ff5525aa1b54cb675644c3ed5fd9a1a78705650233370290245230a0a7f81
- SSDEEP 24576:dxpSt6hFfYauZMAijqVBeF0oC8Rv2YISRCmudelw5K39YPMNi+nZoLKWdZCL:HFQau7AMBeF0xxBSruUr39YPMc+nGKRL
- TLSH T1AF659E8AA3F500A8E0BBA174D566A71FE6B1786017308ADF03D4019D5FB77E052BBB53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target New folder/norecoil.exe
- Size 71.1MB
- SHA256 f42a887bc3019089fd50ba53891db6ca010abe85f507ec85de77fe20dd662ac6
- MD5 813567908103b1625f40d201db21b480
- SHA1 9f54caf0315263b21ccdd310cd073f0ef069f4d6
- SHA512 8fff30677d85762d55517dc90152e77605e069378e41a9c48749af3b68b197b6ca18aa2d1d17f489dac13338bc4be677e71a90aace8f57c21a4865099a4cc9fb
- SSDEEP 393216:nMPpVDRZwYMIEai8lJ8RXp62LOBnLIpLmBPkhxC8jDDxtL/S60Gk+yWEzjJG/SBF:obAJqdEvC8Tz/rNSBwRvJ4Rp4+asz0I
- TLSH T1FCF7BF15B3E80B16D67FC27DC663C112E6B1B8431362D6CF1454EA992F63BC1AB37262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10