Overview
overview
3Static
static
1OfficeUpda...hu.exe
windows10-2004-x64
1OfficeUpda...hu.exe
windows11-ltsc_2024-x64
1OfficeUpda...es.dll
windows10-2004-x64
1OfficeUpda...es.dll
windows11-ltsc_2024-x64
1OfficeUpda...-8.dll
windows10-2004-x64
1OfficeUpda...-8.dll
windows11-ltsc_2024-x64
1OfficeUpda...11.dll
windows10-2004-x64
1OfficeUpda...11.dll
windows11-ltsc_2024-x64
1_collections_abc.pyc
windows10-2004-x64
3_collections_abc.pyc
windows11-ltsc_2024-x64
3abc.pyc
windows10-2004-x64
3abc.pyc
windows11-ltsc_2024-x64
3codecs.pyc
windows10-2004-x64
3codecs.pyc
windows11-ltsc_2024-x64
3ctypes/__init__.pyc
windows10-2004-x64
3ctypes/__init__.pyc
windows11-ltsc_2024-x64
3ctypes/_endian.pyc
windows10-2004-x64
3ctypes/_endian.pyc
windows11-ltsc_2024-x64
3ctypes/wintypes.pyc
windows10-2004-x64
3ctypes/wintypes.pyc
windows11-ltsc_2024-x64
3encodings/...__.pyc
windows10-2004-x64
3encodings/...__.pyc
windows11-ltsc_2024-x64
3encodings/aliases.pyc
windows10-2004-x64
3encodings/aliases.pyc
windows11-ltsc_2024-x64
3encodings/ascii.pyc
windows10-2004-x64
3encodings/ascii.pyc
windows11-ltsc_2024-x64
3encodings/cp1252.pyc
windows10-2004-x64
3encodings/cp1252.pyc
windows11-ltsc_2024-x64
3encodings/cp437.pyc
windows10-2004-x64
3encodings/cp437.pyc
windows11-ltsc_2024-x64
3encodings/fonts.pyc
windows10-2004-x64
3encodings/fonts.pyc
windows11-ltsc_2024-x64
3General
- Target OfficeUpdate.zip
- Size 2.6MB
- Sample260723-tkglwsz1ax
- SHA256 2c0c9723e4810c8a6fcb0a7fdbc9c431745d74d551756c5462fee40400bd02be
- MD5 c692a87d8e425ca40578f3f53cfa2e1c
- SHA1 9eb6ac6c7ba79fce6032fe5ac3ecdf6582230ecb
- SHA512 d4f15b5b0fa4fad0a903c27b42ec09b3032fedfef599fa5a35db3a916f9e3cdb5a40510af0c0e287a3a0bdb99476ef2779cfabd867600f7b121ecb8b82f5a3f5
- SSDEEP 49152:aD2QIM9uIVSosvyNA0lXHGnu0Qohs0sFyoU8WQLzsmhO9f5H4CFdalD6jO:c2aXGSXbohNoM0YmhOt5H1dKD1
- TLSH T11AC533DDE5E9E2CCC6D35037A66084C580C50D16A7FBF4F1A14A2B9AA4F3BDA09B4CD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
OfficeUpdate/Feishu.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
OfficeUpdate/Feishu.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
OfficeUpdate/_ctypes.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
OfficeUpdate/_ctypes.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
OfficeUpdate/libffi-8.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
OfficeUpdate/libffi-8.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
OfficeUpdate/python311.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
OfficeUpdate/python311.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
_collections_abc.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
_collections_abc.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
abc.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
abc.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
codecs.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
codecs.pyc
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral15
Sample
ctypes/__init__.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
ctypes/__init__.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
ctypes/_endian.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
ctypes/_endian.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
ctypes/wintypes.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
ctypes/wintypes.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
encodings/__init__.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
encodings/__init__.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
encodings/aliases.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
encodings/aliases.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
encodings/ascii.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
encodings/ascii.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
encodings/cp1252.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
encodings/cp1252.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
encodings/cp437.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
encodings/cp437.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
encodings/fonts.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
encodings/fonts.pyc
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target OfficeUpdate/Feishu.exe
- Size 99KB
- SHA256 d5355e1de2a5195dccb1ba524b146aa7705be71af18d876819756838251b37b3
- MD5 b7fb4dd9bcdf787d4c1995037257984b
- SHA1 22a4184aebe40f1a0316b715e1f69d296b9bf75c
- SHA512 9e4c207bca9f62a841f23f02ca3ce97251bfd5a2098fc0a7652184d0436a41d645588da32b9ba51cb847e18d2b10aee7b7e7b70b1ec591eff9278cab7389873f
- SSDEEP 1536:hq4lfZahIxHHWMpdPa5wiE21M8kJIGFvb1CwD/x5sw7Syxxs:hq4lf8SwMpdCq/IM8uIGf5/x5sw2
- TLSH T151A3F552E62DBCCDE51CC4354A75D4F25E24FC317680A15EA3F6BF0629312A3F90A93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target OfficeUpdate/_ctypes.pyd
- Size 121KB
- SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
- MD5 565d011ce1cee4d48e722c7421300090
- SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
- SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
- SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
- TLSH T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target OfficeUpdate/libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target OfficeUpdate/python311.dll
- Size 5.5MB
- SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
- MD5 387bb2c1e40bde1517f06b46313766be
- SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
- SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
- SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
- TLSH T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target _collections_abc.pyc
- Size 44KB
- SHA256 7cc5cdcdb93fbd4f335c7fdfcc4f3df7609f5edb1571464f8858b31f8b6ecfec
- MD5 81a911fe7a7de14cdc6d91e00af69ea6
- SHA1 a404164d194f3709b967ac687a7bb7d33da82dbf
- SHA512 64b507e03616bf21daff8d9a5eaa08b50bc13d5a84c6a61083dc5b63ba1782a2f3e788888feb7b845d3909f951f4250dfc8abc6e0d828326cd096a0330f0821a
- SSDEEP 768:HTqWCyQqlg0TVXrrJbgz1u/W1VwzAOzUR5eRKivBjjh:HTqWCyQqlgsXJbgzQWQuR5GZ
- TLSH T1A7136385B592D47AF850F3F9942744297B26C9F2F300CB632A67806FEC176A06D65CEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target abc.pyc
- Size 5KB
- SHA256 b1f91b4cdf66944bb4dfd6d395f84077334fb6cad1d21af89df9f8dcadf6f03e
- MD5 287d00c872b563122ccf58861794e1a2
- SHA1 76425c53abc409c44d98abe4f0259e3c97a4d2d7
- SHA512 ddb17960f9aa63d18b647589cac8985e8c97eb5e0727bc6f2b3ab04bc610dcaf347e4caaeca198ccc3a0afca377559c15d980c0aba386cbf4be6ec4bacdaaf11
- SSDEEP 96:+8toLPhniUqGB2ft9Dg5I7C85/pXcgaIFfB3+eKJSzrxhwZ4H:+8mViU9UtWqv4HWfAelzrh
- TLSH T1C6C185407182ECA6F969F3BF041711DE73568BB2F70487531D2A92694E19BCC0DB29CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target codecs.pyc
- Size 29KB
- SHA256 97da269a513ec2efb031a9b536a9a461a70ca3ebef5fe75940ee5c5e14caf237
- MD5 21f124b37cb9305d5359817f14c5725d
- SHA1 c201e31b5af6e373eb16f83ef62d93a686ce25ef
- SHA512 626759bf3ffb093c0d6e419d78849206e18f3985473a84784ebd55ee332230a4226bac2a5641528d33e7915dfb615d64eeebb01567041030fb049eb8ed60916e
- SSDEEP 384:fC/xOSDHa4KVwNu1G3/UhuQrCUyFs7CbEJ93ZM88y9IRcPT1gnIaO9n4yFc3kzyu:8xrIuPUhdpZCY33uKccb1gwxmBsGkNF
- TLSH T1B9D296C17ED2E867FC60F3BA84470A59B3788AF7F211C723255B812A8D8B7905E255DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target ctypes/__init__.pyc
- Size 23KB
- SHA256 bee67a78ab2731354d9a1d703184e2cf133ce307d22a5a160c0036ca2530923c
- MD5 e355f1a6505c35c50645ac877d9dfaf3
- SHA1 54150700a7acb98e106b9a991cd18c091d5cd34d
- SHA512 4e4aaa37443c509980b51be29b712459dea6080bf86a592ad0403711c9ec5d83b6c0b48f2de0f130022f03dc3f0ef4a264b8f13585b827fcf1efc9a275b59b2e
- SSDEEP 384:KPVdj/tCsS82XRKSAl8mYJ69igS3VgQ3Q2blkuTNBanIHeX8FGMR05Iu8pw:KPvj/t7SAgJ69i5KQ3Q2bqqBanIHQ8Fu
- TLSH T16AB2B5817782D53AF9A4F7B2C01A150E37618DF2B391DB775725806DEC22AE8EC249CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target ctypes/_endian.pyc
- Size 3KB
- SHA256 e358fdbf79be594c26fe55bdecb3bf8e0f1bd90527c0a057e9776952852aebbb
- MD5 c4b167c0aca6c0f4548ad87d452497fb
- SHA1 7c666d3fcbb292edf6f1d15a8826c0a33b7412dd
- SHA512 b6d250d9e98bce8da83fb1c920ad6209d5edb94632f6bee085fc3e726606c4c3a2b4bb39595d2f3f0ed89738e25224cc8f5129b49347e744b0408927bfa3660d
- TLSH T13F715585EB43A33EFEA1F378805A0D093676C9E0B1519A93063AC06D5CA56A02D937EC
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target ctypes/wintypes.pyc
- Size 8KB
- SHA256 142f9269ca3c0b5e149501d7a92038fc846eca0076e3932640afc1d0bef19710
- MD5 56fcad0d56b2c5948712c8b8ceb8fd9b
- SHA1 a069f264addce42006d9ce63c00a65a2fc21c559
- SHA512 8ad33e0f09a664851e149c1a13c4778fa9fe035a0ffcf605143ff2aadf094a422685fbd409ce9a4dea49489b2b00fe2eb86a067676ce6fffbfdbdfe50c90b20e
- SSDEEP 96:FTJVum0LA5swADYdTlO3K2qNmqVPfeyGPkPrKadgdnuFZvnlXOldCvvHBfH:FTJVum2wADYLDrjPfeMbPpnglAvvhfH
- TLSH T1D20296D4DC4188BDFEC5F3B9D42D0B442FA7DBA57151D73A9F22402A9D2A9F4281C0AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target encodings/__init__.pyc
- Size 6KB
- SHA256 18d59939cfbab607aa40fcbc850c6ca0c2df4a27c718ed1ad968e92e58e92ced
- MD5 9de80c99f1fded6fd66d490ea58c8f6d
- SHA1 b7fd2d215f197d5709c50708106b64f747dfceae
- SHA512 95963498e6692c3005888c22923adce19baf26d992337ef9329cdc7e0ec05de72819cd792ca04b900c39177874a25139ce106b0a2527006592d0982fca5c7021
- SSDEEP 192:QYLpFkYpDX49quL0NYjxJQ6X0ZVXsDczpbkoPwG1:FNndXMFLSzXsDQ6E1
- TLSH T1A9D1D686F3A0E577F8112BB0A48B594EE32894FB23149AD73B6D82489F95220BD515FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target encodings/aliases.pyc
- Size 11KB
- SHA256 5475a5e947797f3e24e04b18063c4cdf973236ab5d20c92bb60f923850d760e9
- MD5 f464d1c456cd149fa5959f7929d73dd4
- SHA1 5ea38b92b701d785e2c5b3a813c826301b0c6215
- SHA512 e9b00c70620777da8dd95a4afcb7293c98ea332c024dc6a129299bb9cfeacaf3b436d0ab80e341c16b53baa24c385cc6cb95519364c1546848c3a900bc76051f
- SSDEEP 192:YhUT0ITnxIKA14Xqb36RhOgaxL8PZm+/Qnu1iGW1D3Ef7NYcWWaqTI01ADPwlm2I:6zimo6uHc+fkUfxYtwI9DwZIb0xo
- TLSH T1EB4241CDB3D465E73A4773A318612186411E129D8FC863D43EDCA0D7D9A89D9DFCAC28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target encodings/ascii.pyc
- Size 2KB
- SHA256 e86bfc86778d8f8eccf57d86fcf06b089256d56a384f94060bbf6b5f6acc4a7b
- MD5 129536b2f3b6778e4f59ee7a7e855fd0
- SHA1 f9b81121cc4fd8749dced5ca36a169066f529ea6
- SHA512 93843ae2ada151dadf44c225854095de0295b379047c7d41609f100160b5cdfe84791df3d9dae5fbc13ebf63a40741f687a0edd3a0b6cd7c8add1f95d08e8677
- TLSH T10051EFC4D8C1B1B6FC08FBF9463F46281B9A46B9610853172E77D066DD6AA883C52CDC
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target encodings/cp1252.pyc
- Size 3KB
- SHA256 6445d50d76e21c14f1eb4f46e1df48e3f008230180657379110bf3a7d6638850
- MD5 d952cf06291822113ecbe1c119725fe9
- SHA1 ac4b2716fa8311a972839df6d24257e32f96e26c
- SHA512 25c8838746665eca1401d9f7a49042d5ef7ad11ae2ba2ee6e7013b5175afb87082d18a5735a2918e0bc766e9bb2de5d10401c31b6eac07739653a226724caec1
- TLSH T154610183FDC1A446F959F7FC5015A54C0B9D59BCF008870BBADAC2A6CC566543C6D98C
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target encodings/cp437.pyc
- Size 13KB
- SHA256 c0540f9732f6475993a118355871845d4755b9bc16257aa6abb0aeedfc2c4670
- MD5 a098eef24757af52e792c4660550e067
- SHA1 56af27593009dfec3019c611ad862246c8a41a90
- SHA512 d13cedc8c0101812c54599bf65b6fb6e0b8a863c59b8c79e16144d1105e8b7590c72240556cb6f116807031a60dacc99418753fd6dc7bc8f41c6a78273227f73
- SSDEEP 192:F4a+pAwzpbg1VUZEczj+JFnHookioJ3lmzhxnKl7rF8zqYndAtnEwfJHxpto4zmH:F4DAwtQVmBQokEcxnEeJdAGm8CC
- TLSH T1845223D1261B34F3D594B3B711350A4A532455284FE8C6D91AA6CEF2D7EC6B87FD08C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target encodings/fonts.pyc
- Size 8KB
- SHA256 a6caaa19f9544100124c3fdd518a0258a1965022f3936289404438c69e722f9d
- MD5 faf5ed95104f4dc4fbae35dc1601ddae
- SHA1 90d09a7dab0aafd871e9e0a107961f0706dbf80b
- SHA512 c3eef0a3939357488a04b7fb91e8513bb38c9ceeb31933324d7daa538a44f679b3bd828e0b04a36265b37360c5b3c80052e16a3a0c9420bcb334736ffd4b29a4
- SSDEEP 192:srmUy7qpoheJyJoy8ZIJmrFdckIQWgBMrMk+LHaCh:sFy7NeYyyp4hdckIQWN+Lv
- TLSH T12902DB81BA97C677FC95737194121287F361CDF1BA54C7271A2FE092AE466141D028FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10