General
- Target czshyZxC
- Size 2KB
- Sample260730-m2yheagc44
- SHA256 d92e2cf90f14f95f530b5f321b79d2eb0c264fc467ba8c666b5ef3e52a6afc0e
- MD5 5c33d55fba249984bd8ec0009e8f1ab8
- SHA1 7a648f9c34b76c74ed1d678f2a17edb0b6d7d0dd
- SHA512 c148c4463ce0723127b5c85fca9d81f921086a2f35e50606937ed799fada2b549f8fe5e6b885cffc89e6b02f26e34d899c1e977f487e7db548af8324977e4dff
- TLSH T1CB416323E90481168261E144F4E9B75D8023978FDF635C416BB4A5EB92D7FE1C2363E9
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
czshyZxC.html
Resource
win10v2004-20260513-en
22 signatures
600 seconds
Behavioral task
behavioral2
Sample
czshyZxC.html
Resource
win11ltsc2024-20260709-en
10 signatures
600 seconds
Malware Config
Targets
-
- Target czshyZxC
- Size 2KB
- SHA256 d92e2cf90f14f95f530b5f321b79d2eb0c264fc467ba8c666b5ef3e52a6afc0e
- MD5 5c33d55fba249984bd8ec0009e8f1ab8
- SHA1 7a648f9c34b76c74ed1d678f2a17edb0b6d7d0dd
- SHA512 c148c4463ce0723127b5c85fca9d81f921086a2f35e50606937ed799fada2b549f8fe5e6b885cffc89e6b02f26e34d899c1e977f487e7db548af8324977e4dff
- TLSH T1CB416323E90481168261E144F4E9B75D8023978FDF635C416BB4A5EB92D7FE1C2363E9
- MD5 SHA1 SHA512 TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2