General
- Target https://release-assets.githubusercontent.com/github-production-release-asset/957384794/6367e688-4f5a-4b12-b55f-e52180caab51?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-07-13T13%3A11%3A19Z&rscd=attachment%3B+filename%3DTheExecutor.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-07-13T12%3A10%3A27Z&ske=2026-07-13T13%3A11%3A19Z&sks=b&skv=2018-11-09&sig=4mp6qgXB%2B7S4WgAqj3MNqqkxq7EIRE6E10njJ1GKQHQ%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4Mzk0NTkxOCwibmJmIjoxNzgzOTQ1NjE4LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.AICskZeRKBEs-rv-0VQxXBRF6BTSsK9VD4O7fjLbXlc&response-content-disposition=attachment%3B%20filename%3DTheExecutor.zip&response-content-type=application%2Foctet-stream
- Sample260713-pp6z5abs2z
Score
8/10
Malware Config
Targets
-
- Target https://release-assets.githubusercontent.com/github-production-release-asset/957384794/6367e688-4f5a-4b12-b55f-e52180caab51?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-07-13T13%3A11%3A19Z&rscd=attachment%3B+filename%3DTheExecutor.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-07-13T12%3A10%3A27Z&ske=2026-07-13T13%3A11%3A19Z&sks=b&skv=2018-11-09&sig=4mp6qgXB%2B7S4WgAqj3MNqqkxq7EIRE6E10njJ1GKQHQ%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4Mzk0NTkxOCwibmJmIjoxNzgzOTQ1NjE4LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.AICskZeRKBEs-rv-0VQxXBRF6BTSsK9VD4O7fjLbXlc&response-content-disposition=attachment%3B%20filename%3DTheExecutor.zip&response-content-type=application%2Foctet-stream
Score8/10-
Downloads MZ/PE file
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.