Overview

overview

8

Static

static

3

4ce994747e...ef.exe

windows10-2004-x64

8

4ce994747e...ef.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    4ce994747eb5fb4113f23d42f22a089e099c6690980dac9c92d26a28762e25ef.exe
  • Size 15.7MB
  • Sample260729-py79jsgn4t
  • SHA256 4ce994747eb5fb4113f23d42f22a089e099c6690980dac9c92d26a28762e25ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
command_and_controldiscoveryexecutioninstaller

Malware Config

Targets

    • Target
      4ce994747eb5fb4113f23d42f22a089e099c6690980dac9c92d26a28762e25ef.exe
    • Size 15.7MB
    • SHA256 4ce994747eb5fb4113f23d42f22a089e099c6690980dac9c92d26a28762e25ef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutioninstallercommand_and_control

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Outbound SSH connection to public host

      SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

      command_and_control
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks