General
- Target unlockall.exe
- Size 9.2MB
- Sample260708-pee4naft2y
- SHA256 0b909c97aba0af87516cf00b6c1f801f3086f1e306e39cee002c789b214e4e98
- MD5 1c14bf639f139cfca507a25c733bd275
- SHA1 3666db337909ef59747855820d04a79c122bddc9
- SHA512 ff9bb52dba94e9b9d4769370395e5b779d8599e5c1e37edbcd3fe9c4edc5bcc79887861f4f20a289d22c839825d94fe6a152c7dc58e28c8dc52a517cded2d48a
- SSDEEP 98304:TM3LuygWEZAug/efGr4bJpmkKdqYCdFUzviVGE24RDejIXOT4LKdYCbc3Y+2CkP:TMiJZYfk2nULBCbPFXP
- TLSH T10DA61827ED6610DCC5EBC170825EAE73B931BA140137FEFA5A50DE701F21E521A6BB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unlockall.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
unlockall.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target unlockall.exe
- Size 9.2MB
- SHA256 0b909c97aba0af87516cf00b6c1f801f3086f1e306e39cee002c789b214e4e98
- MD5 1c14bf639f139cfca507a25c733bd275
- SHA1 3666db337909ef59747855820d04a79c122bddc9
- SHA512 ff9bb52dba94e9b9d4769370395e5b779d8599e5c1e37edbcd3fe9c4edc5bcc79887861f4f20a289d22c839825d94fe6a152c7dc58e28c8dc52a517cded2d48a
- SSDEEP 98304:TM3LuygWEZAug/efGr4bJpmkKdqYCdFUzviVGE24RDejIXOT4LKdYCbc3Y+2CkP:TMiJZYfk2nULBCbPFXP
- TLSH T10DA61827ED6610DCC5EBC170825EAE73B931BA140137FEFA5A50DE701F21E521A6BB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1