General
- Target protoc-27.3-win64.zip
- Size 3.1MB
- Sample260705-gyc5ead18p
- SHA256 bdccd341a0c25ff4f65d8530f170c78ce5681e42920aa5d892f27ac06cc3bba0
- MD5 df427e604e349a6ae231ebd2f1674914
- SHA1 d431df9e8035096081c17ec33bc507481bee7634
- SHA512 1552c8784ee196e5f3a829067fac245f41e4b8f2180e52c8b2121eb21276141cf816f9defbc669e031841478ca6987dc969a07ea5a5acecd87bf95f604306ac2
- SSDEEP 49152:BH5pqo76dI+QmRO7TgfxcS2HNMqil6Ti5Jl/clfOZmJYryme8Hn4hy/DD3s:RqMOQm0WxmtMqil6mlcO8JRuHt/Djs
- TLSH T135E53350680E4A1CDE066F6D9DD2524E5AB96D820BB878FED10F947831AB3D64F423CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
bin/protoc.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
bin/protoc.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
include/google/protobuf/descriptor.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
include/google/protobuf/descriptor.bat
Resource
win11ltsc2024-20260629-en
Malware Config
Targets
-
- Target bin/protoc.exe
- Size 11.5MB
- SHA256 b45619cd94c2e5971b4842bd52e21c069fb8c4112d4936614539495399c9d6a3
- MD5 50e7711fa121ffb611c97788541bd24e
- SHA1 7828087706be46d14742e3dffe80711c92c80f26
- SHA512 3beab72ec223bc084f5eb7d37c3693c72744f0d71123bfcb3397c97b928fb69c5810e4e032919671884fbb4d9553ea8dbac7306503a05013c38cf969b6e619e7
- SSDEEP 98304:tnDqa21D8KIdMXKt+GU+SyM8TorJq3SwFVxxHE5pmfTHxH/xzK/DFu6iTMwerfFM:dKKGg
- TLSH T186C63B0395974CB8C8D6E3B86597233AF7B4BC16CD3A6D27B548CF121B52680DA2FB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target include/google/protobuf/descriptor.proto
- Size 51KB
- SHA256 50be5275512b5c9976e49ba183f0a88b49237d2b0cef959cebdf0b5e96e95174
- MD5 cad149cccf054b3ef11cba293e3f5536
- SHA1 7cd073b75632c44a78ff26a4ebf23c11c3f57fa3
- SHA512 59f21899469163fe5fe183a07c1206a4f1f0fa1a1f94ea5cfdfcd0ca2ebe6580907e18f7662123eec25b25fbc754cb0e73857341b38a73b8115c9aab69443bad
- SSDEEP 768:mBTbj1WU9GrWSLQ1WI3YeWGHMOhBKSb/q0tDZa0GQ8oaZg9SVn4xDGB7O7f318iQ:mBL1IWSwNMGKSBv9n/+hb7EbWgbqx
- TLSH T1753375173AC963360D8750E2F74DF08167348219A779E451B0CF829D3B86A28E7BB9D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.