bdb8a2b5ffc4025cd16b91854a1b78cc714e1750e1b51bf024d7ee44ec2d0a25

Resubmissions

20/07/2026, 13:50

260720-q5kx9ses3s

20/07/2026, 13:49

260720-q4t5jsb15p9

Analysis

user interaction
yes
max time kernel
14s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FadeSEC.exe
Size 350KB
Sample260720-q4t5jsb15p
SHA256 bdb8a2b5ffc4025cd16b91854a1b78cc714e1750e1b51bf024d7ee44ec2d0a25
MD5 fadf6eec4a2abd999605282526a5cee1
SHA1 3040c951fc4ef8ff2ec7c0704b3ad8d8f6a64fc0
SHA512 b71f86bd73a7c86b5df68aa730aa0364d991b3a001f6f36fdcb06e3fd3264a987fcb3c0bb2a5ec11ca35f7f972055ac15f5319fb684ce0cbfdfe02cee8096804
SSDEEP 6144:eqVaJI7RZKnhz6hwF3ZhBasFr72CbmVw/mYnk7S:vR8sSXhxFr7Lm2/mYn
TLSH
T184748D16F7A514F9E1A7C178CD524906DBB27C4A07A1ABCF23A04A961F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Renames multiple (528) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Music\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Searches\desktop.ini	FadeSEC.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\AccountPictures\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Documents\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Documents\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Downloads\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Links\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Libraries\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Videos\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Downloads\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Music\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Contacts\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Favorites\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Pictures\desktop.ini	FadeSEC.exe
File created	C:\Users\Admin\Videos\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Desktop\desktop.ini	FadeSEC.exe
File created	C:\Users\Public\Pictures\desktop.ini	FadeSEC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	FadeSEC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4900	FadeSEC.exe
4900	FadeSEC.exe

C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe
"C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads