10045eeb3242c894e414fb4e3bb84bd421ef75edca53f8defc49c140c57c8d8b

General

Target
2026-07-26_c05854e8eabda99e7c182f007155492c_conti
Size 305KB
Sample260726-2msqyasdld
SHA256 10045eeb3242c894e414fb4e3bb84bd421ef75edca53f8defc49c140c57c8d8b
MD5 c05854e8eabda99e7c182f007155492c
SHA1 3259962d0e15f498237938a5b4c5dc1dffd744b4
SHA512 619c2173c3258020a185dba39cee644b302ea7cf94bd17c3242ca945727e5ade173180d721a0d2e742294b87d84795fcf017a2dc4f1d85892b68989318068a28
SSDEEP 6144:c/Kov3pMXeEaiheqwafiQfK8kxa0qastow23JviMOpJOvE7VXdK:c/8za4fwmiz//9kX2c7ZM
TLSH
T1BA64230606B0C690CF281C3F74369FD592351CA797E91B32D2A1BBF42EB61A61969FC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion upx

Malware Config

Targets

- Target
  2026-07-26_c05854e8eabda99e7c182f007155492c_conti
- Size 305KB
- SHA256 10045eeb3242c894e414fb4e3bb84bd421ef75edca53f8defc49c140c57c8d8b
- MD5 c05854e8eabda99e7c182f007155492c
- SHA1 3259962d0e15f498237938a5b4c5dc1dffd744b4
- SHA512 619c2173c3258020a185dba39cee644b302ea7cf94bd17c3242ca945727e5ade173180d721a0d2e742294b87d84795fcf017a2dc4f1d85892b68989318068a28
- SSDEEP 6144:c/Kov3pMXeEaiheqwafiQfK8kxa0qastow23JviMOpJOvE7VXdK:c/8za4fwmiz//9kX2c7ZM
- TLSH
  T1BA64230606B0C690CF281C3F74369FD592351CA797E91B32D2A1BBF42EB61A61969FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion upx
- Detects command variations typically used by ransomware
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Detects executables containing commands for clearing Windows Event Logs
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- UPX dump on OEP (original entry point)
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

5

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

5

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects command variations typically used by ransomware

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

Detects executables containing commands for clearing Windows Event Logs

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

UPX dump on OEP (original entry point)

Looks for VMWare Tools registry key

Looks for VMWare services registry key.

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2