General
- Target ArmouryCrateInstaller.exe
- Size 4.0MB
- Sample260709-2pgrfsav6r
- SHA256 8139b87231d99cac36bfed7a4974c8086a9c32dd5fe15f4775f476f54f586b4c
- MD5 beb653d2cd771788b34a1ab37f854ade
- SHA1 aa95a26f03676084d70c491d91b70130253b9ecf
- SHA512 8e281ebeebb295990e46580d78409d7677bfd38c6403a9602d9002d996d85a1a389d4685f85e898cb6438e42388c0826ae6843d4e4782919bd5bc5683477aabc
- SSDEEP 49152:e/UsRFgMLuzT+0U2HNkX9sXBfB3jtwYph0Vk9xF+jQOviDb9RM2HjgVV1BCjBsWJ:uUsRFgMeFuXefBTqYH0VTebNHjgPWC+
- TLSH T1C816BF4173E509B5E9AB423988219919F7B2B8121771DBDF17C9C26A2F733908E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
ArmouryCrateInstaller.exe
Resource
win11ltsc2024-20260709-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target ArmouryCrateInstaller.exe
- Size 4.0MB
- SHA256 8139b87231d99cac36bfed7a4974c8086a9c32dd5fe15f4775f476f54f586b4c
- MD5 beb653d2cd771788b34a1ab37f854ade
- SHA1 aa95a26f03676084d70c491d91b70130253b9ecf
- SHA512 8e281ebeebb295990e46580d78409d7677bfd38c6403a9602d9002d996d85a1a389d4685f85e898cb6438e42388c0826ae6843d4e4782919bd5bc5683477aabc
- SSDEEP 49152:e/UsRFgMLuzT+0U2HNkX9sXBfB3jtwYph0Vk9xF+jQOviDb9RM2HjgVV1BCjBsWJ:uUsRFgMeFuXefBTqYH0VTebNHjgPWC+
- TLSH T1C816BF4173E509B5E9AB423988219919F7B2B8121771DBDF17C9C26A2F733908E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Probable phishing domain