Overview
overview
8Static
static
3RealSetup_...75.exe
windows11-ltsc_2024-x64
8RealSetup_...75.exe
windows10-2004-x64
7RealSetup_...75.exe
windows10-ltsc_2021-x64
7RealSetup_...75.exe
windows11-21h2-x64
7remote_admin.pyc
windows11-ltsc_2024-x64
3remote_admin.pyc
windows10-2004-x64
3remote_admin.pyc
windows10-ltsc_2021-x64
3remote_admin.pyc
windows11-21h2-x64
3General
- Target RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
- Size 79.4MB
- Sample260705-e7vdyahv8w
- SHA256 179f92f362a7a2115611cacf7d7ee1c5697d63f77e03b41fec5b66d4aadfd9ea
- MD5 df870f396cd4c3848af8feb238fd7880
- SHA1 cf2c548d281dbd6e84d323b762d672708038acdc
- SHA512 feb0968dbb4af19153a032794ca44eabc30e2a82cde45233cc3df48484b357823891e410599a0826dd781bab57310397b712c2bb3127b306324b763c8b0489d7
- SSDEEP 1572864:ODq/f4f/15d0YEUZl7XNyjhQR5QMJJ8R/x0/utd0xyPPhKOThxHsiZ4zDngywIQ:7gf/tEQlLgaR55oR/x0/kd0xEzFxHC3S
- TLSH T1980833C1BD463ABBD5F6053061649E27A5EA20CD5F63917B0BE0A1372F2BB801BB14F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral2
Sample
RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral4
Sample
RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
remote_admin.pyc
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral6
Sample
remote_admin.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
remote_admin.pyc
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral8
Sample
remote_admin.pyc
Resource
win11-20260513-en
Malware Config
Targets
-
- Target RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
- Size 79.4MB
- SHA256 179f92f362a7a2115611cacf7d7ee1c5697d63f77e03b41fec5b66d4aadfd9ea
- MD5 df870f396cd4c3848af8feb238fd7880
- SHA1 cf2c548d281dbd6e84d323b762d672708038acdc
- SHA512 feb0968dbb4af19153a032794ca44eabc30e2a82cde45233cc3df48484b357823891e410599a0826dd781bab57310397b712c2bb3127b306324b763c8b0489d7
- SSDEEP 1572864:ODq/f4f/15d0YEUZl7XNyjhQR5QMJJ8R/x0/utd0xyPPhKOThxHsiZ4zDngywIQ:7gf/tEQlLgaR55oR/x0/kd0xEzFxHC3S
- TLSH T1980833C1BD463ABBD5F6053061649E27A5EA20CD5F63917B0BE0A1372F2BB801BB14F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target remote_admin.pyc
- Size 97KB
- SHA256 086bd82cc409918af70a01d80b75081d4d61f90d8dfbb04707a47983714814dc
- MD5 6de16d8e49b16892c78d7f14ea9845bf
- SHA1 464365146a3570fae8fdcd8577d8f30804b0b8a4
- SHA512 64b2304734a29a1230068e948032fd457a33956d166b32166329d732e06950f00f5394ae8ca48ba087c94ede01cf1e739d74537f3204af9dd516968c8b7e60ce
- SSDEEP 3072:DZ3/ihCM8Sc1BOAVfhk3+bY4Da8G/nNdZwD+94G:DZqhT+1BXfhQ4uDNdZnn
- TLSH T1F8A312EDD5A4593EDF41273B15EAE55C09E04C22D2225C5F223AABF32A0F9E71CBA014
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10