General
- Target VGC Emulator + Popup.exe
- Size 47.4MB
- Sample260722-nxys2szzhs
- SHA256 97b88b1996f4b31336f5f043a2254645df454a1359d465630e77dd8f315161d9
- MD5 1643dd6002d4b78844f0409664b7b8e9
- SHA1 8346aed54d24f96dab97dcf66ea86546eb993fd7
- SHA512 818a89f06a36e08f62a5424c9ded8d48631b780540eb5babad82770d72f51bcab02044cc8c55ffcc294a0c76cf37d089063d39b202029fd065057305189291a5
- SSDEEP 786432:s+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdBT7yr+Ly+igCedTYvV/M8+Ws:aXGMK4XR3bLSCU/+6yPl3BT3y+igCARn
- TLSH T1E9B73300EAE50DDFE1B5363854E0D25BD79866CBBB63C7E94010015388BBDD4277BABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
VGC Emulator + Popup.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
VGC Emulator + Popup.exe
Resource
win10ltsc2021-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
main.pyc
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10ltsc2021-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target VGC Emulator + Popup.exe
- Size 47.4MB
- SHA256 97b88b1996f4b31336f5f043a2254645df454a1359d465630e77dd8f315161d9
- MD5 1643dd6002d4b78844f0409664b7b8e9
- SHA1 8346aed54d24f96dab97dcf66ea86546eb993fd7
- SHA512 818a89f06a36e08f62a5424c9ded8d48631b780540eb5babad82770d72f51bcab02044cc8c55ffcc294a0c76cf37d089063d39b202029fd065057305189291a5
- SSDEEP 786432:s+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdBT7yr+Ly+igCedTYvV/M8+Ws:aXGMK4XR3bLSCU/+6yPl3BT3y+igCARn
- TLSH T1E9B73300EAE50DDFE1B5363854E0D25BD79866CBBB63C7E94010015388BBDD4277BABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target main.pyc
- Size 17KB
- SHA256 cdd261ae6633d789918e3bcba875106e9ab11c1a4cf428586e6bef7a5c40a115
- MD5 77149ecfb78929e632e9d787dcb4705d
- SHA1 12d9268c515f3b8363270c724f7d31991d4753e4
- SHA512 d697bdb53d31b70098b0f5a4cb16dbaf23b4702e830ceb6706e073fbc8f5f35274abfca30c088f906c6dd54dcb8aab69f75d81ca4d37de5252b14e4f59458823
- SSDEEP 384:cdSwJwMifkBrkvuzEFQBVjWYB8t2qfZHd:sSwJxifk3oiHWYGAmZ9
- TLSH T1AF82095A90408629FF60F2B4D0984094E37EAF97F510D723115E42769CDA2FFDEBAB48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10