General
- Target Уведомление от 03.07.2026.rar
- Size 3.1MB
- Sample260703-yeacvaby2n
- SHA256 ccfbbe5b03875658628f390d655fe1f469d0b1ae5e37288efe396fb1a3b32a5c
- MD5 9bb7cf8a93dd070a7fedb22822a2ed9b
- SHA1 cea3257b9a2ff234e16881f63cd2fadb199a67aa
- SHA512 14d02b1703072cdf74750d3a7cfc54cab69f7d0c46968ed142091e87e393bb09b78cb84ac87bac41dddc84c14ddcbc2dd187ab5f38c0ae902ea35f76a1dcec6b
- SSDEEP 98304:21rr0xO/jE9yV3sAtNRiEwwnb6XJOLpXK:CrQxO/j93t+An0JOLo
- TLSH T1FAE533E1BF2D07C09F55D43FC159DC8968443571AAAFEDA0A7CA130AD4E2F731A2B099
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
GUP.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
GUP.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
README.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
README.txt
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral5
Sample
libcurl.dll
Resource
win10v2004-20260513-en
Malware Config
Targets
-
- Target GUP.exe
- Size 789KB
- SHA256 b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351
- MD5 7744ed6fac4775706938298f9cb5ba0d
- SHA1 2f20777a19b81a4b37de89e4d5a9b8eda21b51a6
- SHA512 9a6d02f58367c3bb728e81566685b0292232e4cd3e5c6b4eed65928026115e7a1fe20e1248950431a5a9d0b5e477310d756f9a70b9337edebee9b2a9acae47fb
- SSDEEP 12288:r/uMr7FsWEt/e51oHpbIp+UfhbkK4crxzB4uhBTpbAhTPCUe2F:7uOzC9IVkK4CxVToTPB
- TLSH T18C058E2A676C01F8E1B7E27989954507F7B6B859137197CF43A0867A2F236E05F3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target README.txt
- Size 112B
- SHA256 15de4aab8d9ec1864d286f9007952d18919a4b1599d068ebedb3ede021d830bf
- MD5 779d0fad21b1316d1546477c8b6c631e
- SHA1 46d6d83025fab1e03b8ab266a32242e866405a60
- SHA512 9d5acb8c878b4822c88755503933ee31b5aafa8d706899c551a544465101dc407f45c96bd6fe52360073e8a207790130c898b5c91d8cba6d6636a803919ca679
- TLSH T166B0927F0455917AA90B02CB2521596A94B99625EB8D80518EE812DE17369A932291A0
- MD5 SHA1 SHA512 TLSH
Score1/10 -
- Target libcurl.dll
- Size 10.2MB
- SHA256 a980505285bc469dc4b19a9df9d48db17cd28f97c56b68ef11dadb8c5023040e
- MD5 f0eeedaa0577440569080f61b180f353
- SHA1 8c82acf8f1349b59166882452308e903205e6db2
- SHA512 f4a7ea241496650353830dc9a95d570b5251d139b286db0a9835cb59554528b259c90208640a1d3a6980d719f4dbacce0ae452e293101e92c38abe73e9f3c5d2
- SSDEEP 49152:FhsW01a/VHVYsNhKlrzPtGKO7CMwTO5cZuvsvoZhebKmpqszcbf5NYCIixa+3RGA:J7
- TLSH T17EB60773644D32CB58920453E112A0F38CBDE936A71A92E5D48F902D39EE0ED956FFB1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.