ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/07/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Browser/TorBrowser/Tor/tor.exe
Size 9.7MB
Sample260706-1eptmshs4r
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

suricata

Malware Config

Signatures

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
4	5320	tor.exe
4	5320	tor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Tor\tor.exe"
1⤵
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus
Size 3.4MB
SHA256 f13c2c60482222f9b6699cb1e4608b57e57ff4da206c129f1631ae7b6039ee41
MD5 1b53682041f5fd495f9801eb83386f61
SHA1 9c8e9ad7b9d0c1f016cca6c617720536592c5948
SHA512 7de828b758a8b3a45b9430e19018585c0599e84b0b27d7a1a7c23b214eb559e3a579d8252f20c855dfed575ec84dd435deb165d6560500ab086f7146ad86862d
SSDEEP 24576:k7XIFFEr1qOXD9YgzJMDyHzIDjE+4Rz/r9OfmH:c91qOxzmdwhgmH
TLSH
T145F553EA97124EEED32A09DBE510FB7BF33F1725C2486B94296F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 11.8MB
SHA256 78b61e50dfc52610fce2d290bcb47cd8ac1b1da45d146930a0cf3443804c38d3
MD5 1358a426a182d2942d2d434dbec4de87
SHA1 683b6d5c09d1c3a15025fa68239d15342023589d
SHA512 65d64077fa67409aeaad04e251fe375e3c32bfc3199d706d65f4480bfee7a1786ce8a026b3ea85e7cca6244b345a14307c5c5538bc8b73478117619b005e41bc
SSDEEP 24576:4vxV0V80VsQVS/VNcVoVhVUiV4Ba0VSVFnhY9TQVNVC2VdVKC5SVMVyVI2v52oVd:4vhQroNT/jUwle
TLSH
T1F3C6AEDA49AB04C14E05E7C9DC2607C3DF148A3E4B6001A176AAF5677F332AFC15EA79
MD5 SHA1 SHA512 SSDEEP TLSH