Overview
overview
8Static
static
3AcidHackV6...ck.exe
windows11-ltsc_2024-x64
8AcidHackV6...ck.exe
windows11-21h2-x64
8AcidHackV6/config.py
windows11-ltsc_2024-x64
3AcidHackV6/config.py
windows11-21h2-x64
3AcidHackV6...ts.txt
windows11-ltsc_2024-x64
1AcidHackV6...ts.txt
windows11-21h2-x64
3AcidHackV6/start.bat
windows11-ltsc_2024-x64
3AcidHackV6/start.bat
windows11-21h2-x64
3Analysis
- max time kernel
899s - max time network
468s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-de - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
AcidHackV6/AcidHack.exe
Resource
win11ltsc2024-20260709-de
Behavioral task
behavioral2
Sample
AcidHackV6/AcidHack.exe
Resource
win11-20260513-de
Behavioral task
behavioral3
Sample
AcidHackV6/config.py
Resource
win11ltsc2024-20260709-de
Behavioral task
behavioral4
Sample
AcidHackV6/config.py
Resource
win11-20260513-de
Behavioral task
behavioral5
Sample
AcidHackV6/requirements.txt
Resource
win11ltsc2024-20260709-de
Behavioral task
behavioral6
Sample
AcidHackV6/requirements.txt
Resource
win11-20260513-de
Behavioral task
behavioral7
Sample
AcidHackV6/start.bat
Resource
win11ltsc2024-20260709-de
Behavioral task
behavioral8
Sample
AcidHackV6/start.bat
Resource
win11-20260513-de
General
- Target AcidHackV6/requirements.txt
- Size 37B
- Sample260729-29a5eahm91
- SHA256 1e81d1d2a81b2ecd7d2c011e97b9f5b9f2dee7beb4cfd45f6bfbf51c1308f391
- MD5 8733e5966e668c5052589a85ed2343bc
- SHA1 7db2d39e644e32b717c495c10f5c96da6bfa7ecb
- SHA512 f0e05e77e758a16c8ff39ba478a414a05c6014fc6de7f3e41ecfaa58a8ef507b22ebfd64939c58ff72f98b8a88b30196257bf186e1c555c57e0d891e8377b69a
- MD5 SHA1 SHA512
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3260 NOTEPAD.EXE
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\AcidHackV6\requirements.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5312
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5660