General
- Target Fleasion-v2.2.1.exe
- Size 130.8MB
- Sample260711-eynvssbv4l
- SHA256 a4188784db4d0003ee9d68c854a6fbbdf522e8d99465432c4262640cc3b2f2e6
- MD5 6ffee8febb323cfca907d19da3064861
- SHA1 c8bb11544f14121c5d8ad63f6d002f28d2a8fca4
- SHA512 0aebaa54670b92c7db99e95e29bea7ee9901e2b440fb72b63c870b0d3bcc3bcde1b8ef69f13d68d2ca5e6927513b8dfff5dfeb066414b131b1c37a53593731a5
- SSDEEP 3145728:B31sOWwVNtNCnqpIGQ8XBBIhds8XPXmX4ob3:V1FYYXBB+dXXmX4oT
- TLSH T1D268333A7970D327E497B47FF092F9A27274BC80CF1E86BC64F875A225F614188AE511
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Fleasion-v2.2.1.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Fleasion-v2.2.1.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
launcher.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
launcher.pyc
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
rthook_harden_dll_search.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
rthook_harden_dll_search.pyc
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target Fleasion-v2.2.1.exe
- Size 130.8MB
- SHA256 a4188784db4d0003ee9d68c854a6fbbdf522e8d99465432c4262640cc3b2f2e6
- MD5 6ffee8febb323cfca907d19da3064861
- SHA1 c8bb11544f14121c5d8ad63f6d002f28d2a8fca4
- SHA512 0aebaa54670b92c7db99e95e29bea7ee9901e2b440fb72b63c870b0d3bcc3bcde1b8ef69f13d68d2ca5e6927513b8dfff5dfeb066414b131b1c37a53593731a5
- SSDEEP 3145728:B31sOWwVNtNCnqpIGQ8XBBIhds8XPXmX4ob3:V1FYYXBB+dXXmX4oT
- TLSH T1D268333A7970D327E497B47FF092F9A27274BC80CF1E86BC64F875A225F614188AE511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Drops file in Drivers directory
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target launcher.pyc
- Size 502B
- SHA256 8eca9b2187520a7831b8eedbc39bea219972a28e94839e861f346272d379888a
- MD5 729d43114b6a07a7edbfeb6c49029c9a
- SHA1 1441640bd300a4919c16c6ec1c69df1e0f1aa89f
- SHA512 f554d7c607b0c0f47d982d7a8f87ef09ee8d3167efafd9aad703ed9f338e65d847a987de77b29a2a4e65b8ddf2b419da016d39f06082fead32788398c999eee0
- TLSH T19EF06890D9A0AD62D6AE563420F3D6A81B32D58BF2D1C0979780192E7DCD3712580E5A
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target rthook_harden_dll_search.pyc
- Size 3KB
- SHA256 4c2ace2a247f0a5eaef89bbade5cb7f0c4926fb21bfcd950beccfb39a1a1fd8c
- MD5 a47794c77bd8ef3c50dfe7dfbb45433a
- SHA1 4ea9b330ffbcc3528848403e6c95d9014d5b50e8
- SHA512 6d25a03c4b40e7f992ea99da48bcfa61c72dbb799957ebf6d05e544dfe842939babca9c09dc16884086d51ae5c0f11db5c5e92734d0ffb7f81bf2b61cf041128
- TLSH T1B881C76413C19633FAEE993475C3A29EAB73A0E665A92327F338C96D2C5D9008FD4409
- MD5 SHA1 SHA512 TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1