focuscli[.]exe | Triage™

Resubmissions

09/07/2026, 16:49

260709-vbvylady6j8

09/07/2026, 16:46

260709-t929wsex6v5

09/07/2026, 16:25

260709-txan4sdv3r5

Sharing

Copy URL Twitter E-mail

General

Target
focuscli.exe
Size 419KB
Sample260709-vbvylady6j
SHA256 9fc37f6eabb0fd0e9dcc1f2cac0a19f9c53498374088e7ade4a9dfcc3989ef0b
MD5 743403af9053d53065eec0a4ccb8c3c9
SHA1 02dae7a212f624aed42ea76eeb77e875a50463b1
SHA512 cba4097ceb39b941f59659c0f576e512975019695a7b9a95d61a364b0c4b02be36ab10529af19046ff85e8030c20314d58c01fb7c695e807f52f20f8bb1520b2
SSDEEP 6144:y/q9hwf/jIhHitRUsw4YA0o7ItfV6IQRTigzl7ftpSm:yq9hHHhsZktQR5i0T/
TLSH
T1A3947E66D6A404FCE0ABD2788D575906E676780A03B1DBCF03E495722F272E09E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
focuscli.exe

File Explorer

focuscli.exe

.exe 419KB

focuscli.exe

IMPHASH afbe878a90c5057a65922b83b07383a8
SHA256 9fc37f6eabb0fd0e9dcc1f2cac0a19f9c53498374088e7ade4a9dfcc3989ef0b
MD5 743403af9053d53065eec0a4ccb8c3c9
SHA1 02dae7a212f624aed42ea76eeb77e875a50463b1
SHA512 cba4097ceb39b941f59659c0f576e512975019695a7b9a95d61a364b0c4b02be36ab10529af19046ff85e8030c20314d58c01fb7c695e807f52f20f8bb1520b2
SSDEEP 6144:y/q9hwf/jIhHitRUsw4YA0o7ItfV6IQRTigzl7ftpSm:yq9hHHhsZktQR5i0T/
TLSH
T1A3947E66D6A404FCE0ABD2788D575906E676780A03B1DBCF03E495722F272E09E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

137184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\something\Desktop\focus recode\CLI\x64\Release\focuscli.pdb

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptHashData BCryptCreateHash BCryptDestroyHash BCryptGenRandom

advapi32

LsaFreeMemory LsaOpenPolicy LsaQueryInformationPolicy RegGetValueA LsaClose ConvertSidToStringSidA

crypt32

CryptProtectData CryptUnprotectData

kernel32

GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FreeEnvironmentStringsW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile FindNextFileW GetSystemTimeAsFileTime MultiByteToWideChar GetLastError GetModuleHandleW WideCharToMultiByte FormatMessageA SetDefaultDllDirectories SetConsoleOutputCP GetEnvironmentVariableA LocalFree CreateDirectoryA GetComputerNameA ReadFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId RtlUnwind InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode DeleteFileW GetFileSizeEx SetFilePointerEx GetTimeZoneInformation CloseHandle

Name

.text

Size

311KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

focuscli.exe

winhttp

bcrypt

advapi32

crypt32

kernel32

generic