General
- Target svchost.exe
- Size 37.0MB
- Sample260722-bwazdahd88
- SHA256 923b6dc32bd448d49c612583729f83e645158b9c9142411ad21bbe593bba395f
- MD5 eb276d1cbec1e06192242ea0292e4015
- SHA1 a41736ce9e9434ce69ce78c0c24ba63f7c2747a8
- SHA512 f8862a89155517def907b1cd8cd3a6e6b35c8c6ba5e58e19ce1f734ae16bac5f91f79799399fb5dd61ddf7505c81f207b0bbc276bce3721f3b64ef7a0f78b1ad
- SSDEEP 786432:OvgPbW8ObpAfJukK+9q77k6pSHtLFYpiP/m4XLaxy4PJrUmLHy2l:O4PbWLaf8+h6pSNBYpGmALZiS2l
- TLSH T1E08733E8AF03057FF4951239A3D7E13A95B375EB4379C8EF46B406062A572CAE932710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
svchost.ps1
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
svchost.ps1
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target svchost.exe
- Size 37.0MB
- SHA256 923b6dc32bd448d49c612583729f83e645158b9c9142411ad21bbe593bba395f
- MD5 eb276d1cbec1e06192242ea0292e4015
- SHA1 a41736ce9e9434ce69ce78c0c24ba63f7c2747a8
- SHA512 f8862a89155517def907b1cd8cd3a6e6b35c8c6ba5e58e19ce1f734ae16bac5f91f79799399fb5dd61ddf7505c81f207b0bbc276bce3721f3b64ef7a0f78b1ad
- SSDEEP 786432:OvgPbW8ObpAfJukK+9q77k6pSHtLFYpiP/m4XLaxy4PJrUmLHy2l:O4PbWLaf8+h6pSNBYpGmALZiS2l
- TLSH T1E08733E8AF03057FF4951239A3D7E13A95B375EB4379C8EF46B406062A572CAE932710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target svchost.pyc
- Size 56KB
- SHA256 30d9e60d80f36106a3cd3302520767137ffa3e2f1f1849143f40c0a5ac72223f
- MD5 60ca51644a5c08b42278fc0da99e6d63
- SHA1 71d0cfcd59f2a5ee4cd261de644063dbefccb614
- SHA512 d1f95855b97f4c64864cce4f8fca029852dd23e91a974b19cf9b8877cadbe66aeac96df92a7ee72c7e79f8beae2e7a37533b44249f48b0602b1b2d5af5b492e1
- SSDEEP 1536:KoQFA6b+WZl3nNBqtB/w/Hf/tgMF/oGau:4Qe9wBY///Fodu
- TLSH T1DF43D7D2BB51D67AF855B7769C16320AB770C4F6B300CB17337A9126ADAA2103CD61EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10