General
- Target VeloStrap.exe
- Size 43.6MB
- Sample260703-aae6jadt5q
- SHA256 fc793703ccdfd23ea59baa27af71b1da51f5cdde24d17e910efc8bd2fae23141
- MD5 ec21bce7fa7ceb1ac5235cbf57c86a9f
- SHA1 50c0e35bc72609d8ca35c51cada25aa76bdf78d4
- SHA512 82c7f2fa5b0402a1bc87d2ec367ec79188941bf80a6a40cb1543b75898eacc7937a16113e231cd16d0d987b0f914eb4d384f3d5a0e522adbf91b77945993f7e3
- SSDEEP 786432:gCYqiOMW9AeiurXsr6hRVYWjepUrBtLlu2mddTqnnM9lPTtZq5Ea+Lwt7edD/Q:VrEsr8rQ/Y4trhadunnM9l7Dq5ExwN8k
- TLSH T179A733D4D6600563EC5F613C96E6CB67A3F1B5722773868D07A053A04FBB2C48E3A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
VeloStrap.exe
Resource
win10v2004-20260513-en
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
VeloStrap.exe
Resource
win11ltsc2024-20260630-en
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
VeloStrap.pyc
Resource
win10v2004-20260513-en
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
VeloStrap.pyc
Resource
win11ltsc2024-20260629-en
3 signatures
900 seconds
Malware Config
Targets
-
- Target VeloStrap.exe
- Size 43.6MB
- SHA256 fc793703ccdfd23ea59baa27af71b1da51f5cdde24d17e910efc8bd2fae23141
- MD5 ec21bce7fa7ceb1ac5235cbf57c86a9f
- SHA1 50c0e35bc72609d8ca35c51cada25aa76bdf78d4
- SHA512 82c7f2fa5b0402a1bc87d2ec367ec79188941bf80a6a40cb1543b75898eacc7937a16113e231cd16d0d987b0f914eb4d384f3d5a0e522adbf91b77945993f7e3
- SSDEEP 786432:gCYqiOMW9AeiurXsr6hRVYWjepUrBtLlu2mddTqnnM9lPTtZq5Ea+Lwt7edD/Q:VrEsr8rQ/Y4trhadunnM9l7Dq5ExwN8k
- TLSH T179A733D4D6600563EC5F613C96E6CB67A3F1B5722773868D07A053A04FBB2C48E3A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target VeloStrap.pyc
- Size 276KB
- SHA256 5725c6db6bcd814977df1fd6007bdc00c3ed24cba8800eacc19da191f67804a8
- MD5 866350d5fd084e00be1bb35b002c08b9
- SHA1 ea005151f77b5a26de4df28dc957bed0ec15cfb0
- SHA512 613e288d3a2fbcf2dd2d51e2b8558c59c365e544c94d40820746e336ad5ca5a3e078a783ac8504f139c7e12c2adfa3e80eb10cdb94cd03696e07235e4664183f
- SSDEEP 3072:01tUCuhHoRfb53fqp7qgH/zQFWZG2hhKjiUhfLAzYpvJj:0DyaRDVqlqgHksZG2hh7UNAzYpRj
- TLSH T1AB5418B9A970A92BECD8B57D31D7A8C2E33181427310CB17E1355D7E7CDA3898A6530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10