abf716a44a361ba94eef5515a4f3bf0095c9fbead155478e2ec2aed8ce4dc896 | Triage™

Login
Reports

Overview

overview

7

Static

static

1

CorvusPlugin-1.0.zip

windows10-2004-x64

1

CorvusPlugin-1.0.zip

windows11-ltsc_2024-x64

1

CorvusPlug...ibutes

windows10-2004-x64

3

CorvusPlug...ibutes

windows11-ltsc_2024-x64

3

CorvusPlug...ignore

windows10-2004-x64

3

CorvusPlug...ignore

windows11-ltsc_2024-x64

3

CorvusPlug...ICENSE

windows10-2004-x64

3

CorvusPlug...ICENSE

windows11-ltsc_2024-x64

3

CorvusPlug...DME.md

windows10-2004-x64

3

CorvusPlug...DME.md

windows11-ltsc_2024-x64

3

CorvusPlug...er.css

windows10-2004-x64

7

CorvusPlug...er.css

windows11-ltsc_2024-x64

3

CorvusPlug...r.html

windows10-2004-x64

3

CorvusPlug...r.html

windows11-ltsc_2024-x64

3

CorvusPlug...ner.js

windows10-2004-x64

3

CorvusPlug...ner.js

windows11-ltsc_2024-x64

3

CorvusPlug...ld.bat

windows10-2004-x64

3

CorvusPlug...ld.bat

windows11-ltsc_2024-x64

3

CorvusPlug...le.cpp

windows10-2004-x64

3

CorvusPlug...le.cpp

windows11-ltsc_2024-x64

3

CorvusPlug...file.h

windows10-2004-x64

3

CorvusPlug...file.h

windows11-ltsc_2024-x64

3

CorvusPlug...rs.cpp

windows10-2004-x64

3

CorvusPlug...rs.cpp

windows11-ltsc_2024-x64

3

CorvusPlug...pers.h

windows10-2004-x64

3

CorvusPlug...pers.h

windows11-ltsc_2024-x64

3

CorvusPlug...er.cpp

windows10-2004-x64

3

CorvusPlug...er.cpp

windows11-ltsc_2024-x64

3

CorvusPlug...lper.h

windows10-2004-x64

3

CorvusPlug...lper.h

windows11-ltsc_2024-x64

3

CorvusPlug...in.cpp

windows10-2004-x64

3

CorvusPlug...in.cpp

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
CorvusPlugin-1.0.zip
Size 16KB
Sample260727-tz654axama
SHA256 abf716a44a361ba94eef5515a4f3bf0095c9fbead155478e2ec2aed8ce4dc896
MD5 5736dab08d53082b299cf03cce710a4e
SHA1 76cf5ff00830343e6a0c8c26881b6ce845f154a3
SHA512 a7acb4aee171f7f40760ef8af55cdd4ebf696934b43175632cc6c596d14576d909763277fae68d8903b14381d458d4409c26bdac304da5e70f2289a709c55e0a
SSDEEP 384:2agAJVhV1EbVL9Anyy6ClfVHqN48R3KI4jtFLv+MTbBaubdjA5MhzJ1yQz:OAJTVmfAy3kKN48R3KnjnKMTbBaubdjH
TLSH
T11F726C34B3463A95C0DB05F66E9E4AD77606C36AC001E69312BC14A25CBBF056F35AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Static task

static1

Behavioral task

behavioral1

Sample

CorvusPlugin-1.0.zip

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral2

Sample

CorvusPlugin-1.0.zip

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

300 seconds

Behavioral task

behavioral3

Sample

CorvusPlugin-1.0/.gitattributes

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral4

Sample

CorvusPlugin-1.0/.gitattributes

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral5

Sample

CorvusPlugin-1.0/.gitignore

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral6

Sample

CorvusPlugin-1.0/.gitignore

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral7

Sample

CorvusPlugin-1.0/LICENSE

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral8

Sample

CorvusPlugin-1.0/LICENSE

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

1 signatures

300 seconds

Behavioral task

behavioral9

Sample

CorvusPlugin-1.0/README.md

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral10

Sample

CorvusPlugin-1.0/README.md

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral11

Sample

CorvusPlugin-1.0/corvusminer.css

Resource

win10v2004-20260513-en

windows10-2004-x64

5 signatures

300 seconds

Behavioral task

behavioral12

Sample

CorvusPlugin-1.0/corvusminer.css

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral13

Sample

CorvusPlugin-1.0/corvusminer.html

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

300 seconds

Behavioral task

behavioral14

Sample

CorvusPlugin-1.0/corvusminer.html

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

10 signatures

300 seconds

Behavioral task

behavioral15

Sample

CorvusPlugin-1.0/corvusminer.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral16

Sample

CorvusPlugin-1.0/corvusminer.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

300 seconds

Behavioral task

behavioral17

Sample

CorvusPlugin-1.0/native/build.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral18

Sample

CorvusPlugin-1.0/native/build.bat

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

300 seconds

Behavioral task

behavioral19

Sample

CorvusPlugin-1.0/native/delete_pending_file.cpp

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral20

Sample

CorvusPlugin-1.0/native/delete_pending_file.cpp

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral21

Sample

CorvusPlugin-1.0/native/delete_pending_file.h

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral22

Sample

CorvusPlugin-1.0/native/delete_pending_file.h

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral23

Sample

CorvusPlugin-1.0/native/injection_helpers.cpp

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral24

Sample

CorvusPlugin-1.0/native/injection_helpers.cpp

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral25

Sample

CorvusPlugin-1.0/native/injection_helpers.h

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral26

Sample

CorvusPlugin-1.0/native/injection_helpers.h

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral27

Sample

CorvusPlugin-1.0/native/pe_hdrs_helper.cpp

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral28

Sample

CorvusPlugin-1.0/native/pe_hdrs_helper.cpp

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral29

Sample

CorvusPlugin-1.0/native/pe_hdrs_helper.h

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral30

Sample

CorvusPlugin-1.0/native/pe_hdrs_helper.h

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Behavioral task

behavioral31

Sample

CorvusPlugin-1.0/native/plugin.cpp

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

300 seconds

Behavioral task

behavioral32

Sample

CorvusPlugin-1.0/native/plugin.cpp

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

300 seconds

Malware Config

Targets

- Target
  CorvusPlugin-1.0.zip
- Size 16KB
- SHA256 abf716a44a361ba94eef5515a4f3bf0095c9fbead155478e2ec2aed8ce4dc896
- MD5 5736dab08d53082b299cf03cce710a4e
- SHA1 76cf5ff00830343e6a0c8c26881b6ce845f154a3
- SHA512 a7acb4aee171f7f40760ef8af55cdd4ebf696934b43175632cc6c596d14576d909763277fae68d8903b14381d458d4409c26bdac304da5e70f2289a709c55e0a
- SSDEEP 384:2agAJVhV1EbVL9Anyy6ClfVHqN48R3KI4jtFLv+MTbBaubdjA5MhzJ1yQz:OAJTVmfAy3kKN48R3KnjnKMTbBaubdjH
- TLSH
  T11F726C34B3463A95C0DB05F66E9E4AD77606C36AC001E69312BC14A25CBBF056F35AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CorvusPlugin-1.0/.gitattributes
- Size 66B
- SHA256 1a1dbe176bc233b499d35a57db7513f2941c99ab9759f177830c9149be99005b
- MD5 05bdb783ee6514c8c072e47680af8ff7
- SHA1 ba3dfe345280bdcc5e817bb02cf49b8b8d8e1c4c
- SHA512 9e820d6126d62c0b89e380c69685f6668b2f131283f57e524f59492fa6df22844dda1b90d244d4a1f8aea78a84e65d47b1a878168c4e41001459a947ef275ffe
- TLSH
  T1EFA022028C0233CCA0C8B3022088E0800338838E2000800A00880C0822C3022C0A2F30
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  CorvusPlugin-1.0/.gitignore
- Size 270B
- SHA256 3ba2020da55f76620d61950cb88f0d6cc0d5852eae7b2c03f8487a64c87da959
- MD5 2b61ce16bc0d8f33d40ce4c8bc5e90cf
- SHA1 99d352abda5528933a0b16e017c9ef1c2a275951
- SHA512 6f7fc584940ce8763dc9cea9b2b9d0a46ad52d1998469a6e0c96362ed5084740ab36245bd67663be4bef898aee352fc3eb48c47842a67e50f2344e650fea536b
- TLSH
  T110D02BFC06ED6C82782018D617CC798689C6CD545A026782558D518B547F4EC0084732
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  CorvusPlugin-1.0/LICENSE
- Size 1KB
- SHA256 564a23b6e497a838162b648778c3d0b5da4468e34d125d6ab75f5800c0322ee6
- MD5 0df58ed1ec0fdfa871bb6d502e847689
- SHA1 53bd365be0e31ef6a8615d5fa344ab9dc7e4c734
- SHA512 2163048f32008a488f45b253a087d90046cc9121d51aa0b15143132ced1988e5ec131237168abaa633333229463c9476d07b80a71ee812fee27f97228c27bb1a
- TLSH
  T18D11421EB2510B67189B13605578A8D5F22BB25A7A6F2A84246DF345232A06CD5FB840
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  CorvusPlugin-1.0/README.md
- Size 51B
- SHA256 686cdf6ad3a324f76c63c98345204f901d356d73c1a8534908a0f3a66d7dabe8
- MD5 86a5b910a4189739008e488190cae5f7
- SHA1 5ba6a7bab46f08dd3191ef6d4a30148e1c8cadc3
- SHA512 b16e61bcffc8dad9a8337d831759f4525c90422f533559404633a5cefab6c552c7e5dc51d8b7b37e8943c20eb89ffefe8538b7a06defdd5cee562faea60071af
- TLSH
  T1E390020031508016947320825D192A96374E8B221008C0631C3C6004C814A303604A9B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  CorvusPlugin-1.0/corvusminer.css
- Size 1KB
- SHA256 bb7fa74663021a22495745b131bd47b82d630d1e5109cc31f968c0ef0ec20e8b
- MD5 cf4e3f4e40a0488b737951e21c08bb06
- SHA1 a2b4f61108f60d2ea5ba982d5e3ac3b0720380b7
- SHA512 82444024688ff4ce6807ab8529e9903379a11eb7dfc2b028b6077c1b0e4bc33a45298f278240297e7c3894dff4bb6f8a6bed25c7f0c9ea460f1fd1601ac53bc4
- TLSH
  T1B82176D3BFA94518F44E99B469529FA3734D6453800DC9BD2FB8207CAD881BC5972E0C
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  CorvusPlugin-1.0/corvusminer.html
- Size 1KB
- SHA256 e9202ec0cecf24640639adf9475a0bbd65169ac08f626c1ef925a9653892e11f
- MD5 e36144c8548dfa8571c46f784226fc16
- SHA1 b8de470e4ceefd690939934ab14064763a7b47a4
- SHA512 e411191f0487482a877c7600251103a87b20effe346ed4703c59a925860f5929ea29b1b9ab0169e8f8f0c7d3fe4618a1b9b03e3f7bc5b34554b0fe67f03c3fec
- TLSH
  T1BE41AE74A4F816B38153A0B529D06B047DC18243D307950C71FCAA848FE6C828B6B57F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  CorvusPlugin-1.0/corvusminer.js
- Size 1KB
- SHA256 cf87cf7dc5114528bf6e6a5dc7767a2015b0e005f826e8e0de7faf591da7991e
- MD5 745b89d84ad66d5c616913fbe84b1108
- SHA1 707bb3ceb3003c45b80b74b9310ef761669ee260
- SHA512 9a366c9c3cd72bb41375a97e1f0db82c5938c188684f4365300defe620cb15d3a671e72c2ad158ff7328730bd75b71d9019a0c526409a6114eb186759562927d
- TLSH
  T1A441113620AF54710EFB36D6B146910A34B681033D47DC605ABC46189FEFD8A46BFA66
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  CorvusPlugin-1.0/native/build.bat
- Size 1006B
- SHA256 54fe79b821a53b49c2b1dfccacb4b1cb9a4a67b7bdac6e60e0fa0bbda7906507
- MD5 c8eb9202b5ae2310efeb54621d76ba16
- SHA1 081a538b62d75ec1fa5d18b6355e121f726e655f
- SHA512 56028902ad489e380858515fc0d206b25342d3ad590034a651b8af0bc33fadd0d5c82826a6f6de231e39345393e9e4c2a7686dbbe8fb26959e3539c90f0c3d2b
- TLSH
  T17711FC11354E6422C4E8CC211F7411D0AA0F4067833074DA747991056FB17A94AEF9E0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  CorvusPlugin-1.0/native/delete_pending_file.cpp
- Size 5KB
- SHA256 137fb646c0524bd93b09fe3fd5d3ee4997263ee65f01dc4ca12f5299cf7bd60c
- MD5 4fd8eaa39a7894d9d8e77dc98ddaa56a
- SHA1 0b9d72f20180ac5602d8cb52e3154e894c654c90
- SHA512 cfcbc9f50f72de89bd97ca494d52bdae014dbc96b71be837e37d199037315357d78bfce0bf45e5d62161b16b0f0df7fa50f3a474391b9b722c598f75b0cf3b1f
- SSDEEP 96:t1TILeXYn+iEbpJieRtaFG0KbMfmS5Eve6GGi8jhID0GTwKn:Lkeo+iipMEtR0owmS5EveYeXwK
- TLSH
  T1DCC196C75C1A40D8996B4217CD73686B1A3E99132B56B400399E8638BF4E11CF3FBBC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  CorvusPlugin-1.0/native/delete_pending_file.h
- Size 137B
- SHA256 554595ccf34057a52cfc90ab712bb01d76ce6afda0fbb26a072483498f56b9e6
- MD5 034176543dc8fc220c72889804aecf3e
- SHA1 9c0fd3342d971f2c114057f1195c8bfb7b5b1270
- SHA512 9e5f44c59c29ebdad68ef4fc3cf72407d2a1c41631028730096cb01172c2d135146c0e52e0f398e5460261f92088d4b868baae470e5a42cc79f374bf7d12e39b
- TLSH
  T102C02B0C1E7C5114C37B02A6E71376A7080C307A0C11000873371225F907401B0DBCC2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  CorvusPlugin-1.0/native/injection_helpers.cpp
- Size 4KB
- SHA256 d6077c508fd54fb90f432279360c49f2c6a43a0e904e5b20ac30ecf690812890
- MD5 31dbee8d781686dda3eceb684ca4ce66
- SHA1 1365cb6ad4f34df299b036413af4cc5b0b6177e3
- SHA512 fede110829e11a6cf3428aa02c77ede85a8eb6fb78285c0368c01a7e57ca9239dad548bd289971785c74491f57932073bbe1e235520b3ab5b8d07f0b74d0e62e
- SSDEEP 48:VWwkhDRcdQQ7gpyo+rqM116BF+8qMI1mCGodii3tNR3Mk/kJ5bVFzo7M/34yet4h:VcFiJ7aMzM+N9GodQk/YhAtYSFw
- TLSH
  T18181A8941C57B416B1F34026B7936819E976808313AF9321B45C8354AFE62F8F8A7FC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  CorvusPlugin-1.0/native/injection_helpers.h
- Size 294B
- SHA256 785fcc0c5701f639dfef338a8785de1c03db859bc4db95b2b764b43404c32c10
- MD5 b5a4331cee757558170174dcda0aa93a
- SHA1 f1c1f664dc46e1eb3a8b24921e2965ce820ad1da
- SHA512 f8f2880ce5a73b06f5dcf7c1c1cb46dea18acd063144534428e6ff9f8ddc60fee35017da920347329b471db2f57f2d0748a209bc2be903be5c2bb29938032283
- TLSH
  T1F7E02B42F428AA44E1FA1246366B8447C676144375F63620B6F2826CBF131CDF037AC7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  CorvusPlugin-1.0/native/pe_hdrs_helper.cpp
- Size 1KB
- SHA256 82f8c2c5d563b2251d0eef2a4cc8f3e755739baf67fc05b42d8ed470b327424a
- MD5 11e4b4be1670fa228ebfcbb3a5cf4faf
- SHA1 e4f9be30c294ba3c0219ce06c78b6a6cf16d86ac
- SHA512 ed00afb16c0f236ea048ed7e1aab3400303d00dfd8916783d8373385a923688fe0f34cf0b8cf0903ab86c41d947d50b231517ba03b66bc498959915fb38fde61
- TLSH
  T15A3133874C9BF002AE33294DC397CC1AE1349907251ACA64F99C0532BFE8076DABA5C3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  CorvusPlugin-1.0/native/pe_hdrs_helper.h
- Size 180B
- SHA256 ccea5c688304b59a7befb541973561b155c8b963cceb86fb7af46db7f5c592a5
- MD5 7910358ef9e927eecd8a4cfb517832d8
- SHA1 5569b2d17346342266f2e3390d151f01f6cc455d
- SHA512 73f8e5ed84afdbda2d4d16755fa5d1c2f612db49193f4fdea78924e7867acc94ca21945778dd2da2a8e29633cdc80815df12f13f061d9278802eab71c156b22d
- TLSH
  T13AC08CC88C2C8657F0332BEB4643C92EE4120E42B0C2EB83A9B80171B0C24BBE031951
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  CorvusPlugin-1.0/native/plugin.cpp
- Size 27KB
- SHA256 7d2f0d3bf5333fb23d667a10b923e60badf62bc1d85593955184a3672a74af78
- MD5 fb9b77eed92f70c34968f6b25d385119
- SHA1 eb402a777adfc6f14cf4a4cedf48b585bd7c16fc
- SHA512 d257da72690faaadb78cb205f1c2fef6422aa9ee88905959fa33cc2e335df102e5d5eedf7ed042465daec64e98cc3b83cbdbbd052d57760149feb391ab26df33
- SSDEEP 768:caVHx/TKFOUsI8ux32+XnFz56/j0/codEmX4v8Y:c2HxrKFOUs4xlFz56cdW8Y
- TLSH
  T155C2C6101CEBB66144E3E437AF860403F612811367ABEEB0FC5ED684CF552AA56BC6F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy