General
- Target 25538275458.zip
- Size 9.2MB
- Sample260724-sba73ssepe
- SHA256 30edfd19705e02d1e1c3156fe871180ce4d5c46270c78b3e63b8c0442494b35e
- MD5 c2e9873e4ba1d0568e6603993f4f6411
- SHA1 793a0aa97530082db2a3d7141fe886a9d289ab48
- SHA512 45c90cbcfa1f873f0e62d776875905d37cea2fe5031fb27521acef223c90b7fca8880ab839a5fdd555e97dca5f0a7b2306ad0fb66be18c1a787dd0c88a172ea7
- SSDEEP 196608:IJTHUZMQpcdL4TJxZGxRLrm7ijDGbWHV3fkbEwPkVfImxGz1jxbUlfY6:Oj8zcdLKJ3o/eMh1cXyImxGz19UtY6
- TLSH T1AAA633DA885363EBB7057FB574EDBE2A0B7426B6CA96C0C2109DA5D0C054CB4E0F7D26
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
wsvcz/WinRing0x64.sys
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
wsvcz/WinRing0x64.sys
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
wsvcz/u230126.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
wsvcz/u230126.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
wsvcz/u731368.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
wsvcz/u731368.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target wsvcz/WinRing0x64.sys
- Size 14KB
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target wsvcz/u230126.dat
- Size 12.1MB
- SHA256 e777774e4f3bb0c31ec56516e4be23502712d15701db83642ee799b658c11946
- MD5 cb15fa132270d54ebac05963df0ffc32
- SHA1 459e0342a42fa9df7f9012b3ab308bf4238dfe2d
- SHA512 c80ff20a50210a8cc0d00aae6d16799c23dae92b199f89c412bb118200b670ff36f43056d03184a93e77d6e63e97cad4980fb24f51af279e9df899e997f73502
- SSDEEP 196608:J2pwV+anjkENgX/9sLFll1+SSRsnsNH7LwEF:J2cHjhyX/9sLvN8Nbk
- TLSH T1B9D6334971B9D9E5D4A72AB2DCC1C2FC34AB7D19ED0144E3B9C5BF2F32B21942638891
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target wsvcz/u731368.exe
- Size 6.2MB
- SHA256 63aa8da1aedb07d075c13f700877a7525df5b4f434c5f24026a77365517cb225
- MD5 248eed41f083c5de46a15c2b9f30303e
- SHA1 107e18189871d7c9f36af04a5e65bc6a4e6d5da8
- SHA512 4faa293c8508c8d5aa1dc43aeb1d84f1dce946ff7ad2e0630320997e4247f34b3b8f7052e1a80fcf6f45848c1dcf8db277ae51d0d2c4b2a4600679acc5ed1c2a
- SSDEEP 98304:5nAa/8E9ti62iKjDzft5E1eamLuqEQitMQXfqNf45TYK02unAa4eLFaQYJSAj231:5jUMtit9NOMjTnA7saQM9Cwe
- TLSH T122569D26B7A400E8C87AC53CCA469513F7B2B81953B0A7DB27B4567A1F336D41E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10