General
- Target dist.zip
- Size 38.4MB
- Sample260711-yv3dkact5w
- SHA256 2e4f055a194a893f99fe96cdd24388d161f0c26952479ba1f138d13dfa824f55
- MD5 cf1cb9454c077918e7049ff8b526172e
- SHA1 8dd4240d8b49dca118099a13ef38a0173a404149
- SHA512 6acff793b9a33674b467f72304f255ec78432301a0d8ae2d1b01b2b64a67793c7546aff87865b11973931967cb8b006f0b57eee78a1147449c6295399abc2647
- SSDEEP 786432:IWUxJCHaWJ+GVeXMzS7IcXiDammoDnhWfAK/tgj3xNt2B:IWUxJC6c1eXMzS7ziDa0iAK/tgj3xr2B
- TLSH T17397337DC971986944A3B8170BB81723F1A430782D56D7D1EE0CB6A23BEB0DF432B569
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
HotmailChecker.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
HotmailChecker.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
input/combolist.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
input/combolist.txt
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
input/proxies.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
input/proxies.txt
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target HotmailChecker.exe
- Size 38.6MB
- SHA256 bf4533f3aecc9a0b3a29e554fc8f5f4eb8c777cc538c1b8d8af6b0e690f7a5cd
- MD5 885070dd87fbaa898758a2b878e9ec42
- SHA1 e9c7f9ffd3b70f9336e72e863995994b3c76a6a8
- SHA512 66c225b44ffdb54cc58f82a640b509f221b154a0cee357625834cd3cf7f732a02c1025f8d272a05581b58d9b8177233c8ba1e6fd26d54b159772ee1a3d553d4a
- SSDEEP 786432:TQFDi70J90HrxDr1HoXmHZU1XhHy6JrLX+CTEj3s+eJUnOU:8FW704Hr11HoXmmXhlx9Ejc+eJUnOU
- TLSH T1799733388570682BECE6643B4D2A8633B3B174701766C68F9F4C53723FE759A593B290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
- Target input/combolist.txt
- Size 382KB
- SHA256 dbdebf7d69dc28dae41e6845edc291dab4347757aa47f8da7eb8bbefc2b15109
- MD5 0d2e01d931b4f33e1b15c6d63541b98b
- SHA1 2950b6dbc43c64cb2672d50d9634586867b0342e
- SHA512 a71cae8d3f62cc93bb8ea3b0ce1f0a19953b7a9b8afc366630d1f8b420cb0f6f23987a0d44bad255ce948355c0882d796dd03017753284fc5634492f9468ecff
- SSDEEP 6144:3BOoe7qvYTn2cPsVszWW9clw/fvOLraNuQpZHiu9mLyDljaPTLQHLKFDH:xccgzsQl+oGRnLEGPUOx
- TLSH T16984082B4FB83658306BC44A39ECD4059A8685022DFEFAFDD7B546A71E05DC87D081FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target input/proxies.txt
- Size 411B
- SHA256 7f0c19d8713ec9ef763dfcdc97950a87c13b62f4b12ed624ac777ae8c45fd04e
- MD5 7d02a1c857a44557249dbe3d74b545b0
- SHA1 30c7a0f03e0c4bfd9013c1b914a9cf4bc4222ed5
- SHA512 605dde3a96d96317fdde1aadc96d166d559e92645680941adafbcf7873a4d64a3a94148f4fac7ee94d4602405f355fa06db143995ed9113bb7275e1794e1c8ed
- TLSH T1DDE08335370D61CC18FF1DD7637E29050C069C0347A2D35FF08F000551E9C129C8E611
- MD5 SHA1 SHA512 TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.