General
- Target $R3ZLWM3.exe
- Size 6.1MB
- Sample260721-c2b93aes5w
- SHA256 0eb76a0d9eb6cbf5384a01607197cf09cfbf827ca2dd33f4e660b5ba5f9e3fa8
- MD5 30a55c056630a8b42129cba9483e9718
- SHA1 8c9c4d88803202da14d599563ad6273daeb80f04
- SHA512 da9e598a514b4c7906a312773b047f3253360d2e050de924977f126a369776e883af8c12bbbcafdcabd44eebf49ba09a634efa84ef0fb99921f11d03f6b1fe2f
- SSDEEP 98304:nybznEPQtrzpBsfZ53Pr5uYnStrLeP1bDYfcPjip9DE:n+0iQPFua2fKDxg9
- TLSH T138566A03F35281DDC46AC075834AA232FA717C8947347AEF5BE44B212E69BD0AB3D759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
$R3ZLWM3.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
$R3ZLWM3.exe
Resource
win11ltsc2024-20260709-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target $R3ZLWM3.exe
- Size 6.1MB
- SHA256 0eb76a0d9eb6cbf5384a01607197cf09cfbf827ca2dd33f4e660b5ba5f9e3fa8
- MD5 30a55c056630a8b42129cba9483e9718
- SHA1 8c9c4d88803202da14d599563ad6273daeb80f04
- SHA512 da9e598a514b4c7906a312773b047f3253360d2e050de924977f126a369776e883af8c12bbbcafdcabd44eebf49ba09a634efa84ef0fb99921f11d03f6b1fe2f
- SSDEEP 98304:nybznEPQtrzpBsfZ53Pr5uYnStrLeP1bDYfcPjip9DE:n+0iQPFua2fKDxg9
- TLSH T138566A03F35281DDC46AC075834AA232FA717C8947347AEF5BE44B212E69BD0AB3D759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.