General
- Target SimbMin.exe
- Size 6.3MB
- Sample260711-pgvl5aas9p
- SHA256 4ac5358ad9c9243166a41b6838be998846fbe069a78f106a5c78b6d95f0c3863
- MD5 f025c81e784698e3bb1c16943f804866
- SHA1 2c47c010f6600376bc257e1b437ca24d875f6207
- SHA512 ba6357ff23bcf0e3762129d15821d7d5a8437f7ba40cd4a6ce3feaf12139ef7442d1a663deedb8ebc57c26ccbbb5dc35073a2c692307115986f87ed69df17457
- SSDEEP 49152:6QBXuJBjWodF+6sy4Jgx9QdtyX9UIR7l7YwSmDftJtji72B5IKWxLh5cEzE7IB5B:62uJBi2gJSCdtyB7RYG5IKUQsBE
- TLSH T113665922FE8B52F6E903083115ABB27F63345C064B25CBDBEB447A6AFC776D11836245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SimbMin.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
SimbMin.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target SimbMin.exe
- Size 6.3MB
- SHA256 4ac5358ad9c9243166a41b6838be998846fbe069a78f106a5c78b6d95f0c3863
- MD5 f025c81e784698e3bb1c16943f804866
- SHA1 2c47c010f6600376bc257e1b437ca24d875f6207
- SHA512 ba6357ff23bcf0e3762129d15821d7d5a8437f7ba40cd4a6ce3feaf12139ef7442d1a663deedb8ebc57c26ccbbb5dc35073a2c692307115986f87ed69df17457
- SSDEEP 49152:6QBXuJBjWodF+6sy4Jgx9QdtyX9UIR7l7YwSmDftJtji72B5IKWxLh5cEzE7IB5B:62uJBi2gJSCdtyB7RYG5IKUQsBE
- TLSH T113665922FE8B52F6E903083115ABB27F63345C064B25CBDBEB447A6AFC776D11836245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1