9302d845f4edec9741ae324988c94b5c15762134738040ccd0bb77bbb7de1295 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

kibershiel...up.exe

windows10-2004-x64

8

kibershiel...up.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...es.ps1

windows10-2004-x64

3

$PLUGINSDI...es.ps1

windows11-ltsc_2024-x64

3

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

AppIcon.ico

windows10-2004-x64

3

AppIcon.ico

windows11-ltsc_2024-x64

3

LICENSE-KI...-X.txt

windows10-2004-x64

1

LICENSE-KI...-X.txt

windows11-ltsc_2024-x64

1

libcronet.dll

windows10-2004-x64

1

КИБЕР... X.exe

windows10-2004-x64

1

КИБЕР... X.exe

windows11-ltsc_2024-x64

1

КИБЕР...re.exe

windows10-2004-x64

1

КИБЕР...re.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

Target
kibershield-x-windows-amd64-setup.exe
Size 32.4MB
Sample260801-jtxpcsfg85
SHA256 9302d845f4edec9741ae324988c94b5c15762134738040ccd0bb77bbb7de1295
MD5 b7bb48a90265d5e0aa211831405223f1
SHA1 7d1a7a4e8288456585914923434e3530399e9da4
SHA512 65371d3ed5fbe1419e2c61dfca1ff15ea783241de946474d04d67b939a8f4014da62e998ce989792a3456ab0b48c3627620f50dc95fd4007b88f1aa7dd9e7be3
SSDEEP 786432:aa5MbYqzxpx3DEB4dlTRhQYNBddPx/+J4OWtQ+vLe:aPbYqBzdlTDQYJd9i
TLSH
T1C9773380D53E8EF1C0E2F7B926EC55920CE4391308F19C7B7D2AD4B2A9E39568E3E551
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

kibershield-x-windows-amd64-setup.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

18 signatures

300 seconds

defense_evasion discovery execution persistence

Behavioral task

behavioral2

Sample

kibershield-x-windows-amd64-setup.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

300 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/System.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

300 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

300 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/kill_kibershield_processes.ps1

Resource

win10v2004-20260513-en

windows10-2004-x64

5 signatures

300 seconds

defense_evasion execution

Behavioral task

behavioral8

Sample

$PLUGINSDIR/kill_kibershield_processes.ps1

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

5 signatures

300 seconds

defense_evasion execution

Behavioral task

behavioral9

Sample

$PLUGINSDIR/modern-wizard.bmp

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/modern-wizard.bmp

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

300 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

300 seconds

Behavioral task

behavioral13

Sample

$PLUGINSDIR/nsExec.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral14

Sample

$PLUGINSDIR/nsExec.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

300 seconds

Behavioral task

behavioral15

Sample

AppIcon.ico

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

300 seconds

Behavioral task

behavioral16

Sample

AppIcon.ico

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

300 seconds

Behavioral task

behavioral17

Sample

LICENSE-KIBERSHIELD-X.txt

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral18

Sample

LICENSE-KIBERSHIELD-X.txt

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

300 seconds

Behavioral task

behavioral19

Sample

libcronet.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral20

Sample

КИБЕРЩИТ ／／ X.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

300 seconds

Behavioral task

behavioral21

Sample

КИБЕРЩИТ ／／ X.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

8 signatures

300 seconds

Behavioral task

behavioral22

Sample

КИБЕРЩИТ ／／ XCore.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral23

Sample

КИБЕРЩИТ ／／ XCore.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

300 seconds

Malware Config

Targets

- Target
  kibershield-x-windows-amd64-setup.exe
- Size 32.4MB
- SHA256 9302d845f4edec9741ae324988c94b5c15762134738040ccd0bb77bbb7de1295
- MD5 b7bb48a90265d5e0aa211831405223f1
- SHA1 7d1a7a4e8288456585914923434e3530399e9da4
- SHA512 65371d3ed5fbe1419e2c61dfca1ff15ea783241de946474d04d67b939a8f4014da62e998ce989792a3456ab0b48c3627620f50dc95fd4007b88f1aa7dd9e7be3
- SSDEEP 786432:aa5MbYqzxpx3DEB4dlTRhQYNBddPx/+J4OWtQ+vLe:aPbYqBzdlTDQYJd9i
- TLSH
  T1C9773380D53E8EF1C0E2F7B926EC55920CE4391308F19C7B7D2AD4B2A9E39568E3E551
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/kill_kibershield_processes.ps1
- Size 416B
- SHA256 a4c1e4e39bdb7abe95e1b6c9066eaa3b1bc15801952759b1975ab96a95d54464
- MD5 0396bf3c6c3d39efb045c4627f5fd8d4
- SHA1 39c7ee9a6eb4a1e076c0d64dde10cce4d7906b99
- SHA512 6d02108514eef1026a60015c9855fc56f01c38e5241fcdb524e25296977036fb268585e74db99ea711c21a30817df9475962074a06ffa8e555ed2b68ccb382c0
- TLSH
  T1CAE0E5067A3990A080B72E63E689623AED8B81370106254DBD5EA18EAF3015E8048A9A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  AppIcon.ico
- Size 95KB
- SHA256 853a8c591c35a1c4cb0169f84c4ae495f45ca96e30ca3036154b9f8fc976a6aa
- MD5 e49894a2ae83b87299a6becf8eb65a72
- SHA1 babc8721a5a6766dd039c2d59870c9f1c4fd303a
- SHA512 fa0fc80797baddf7e213834aa10afe4e8812e9a45d23f772d540f8286f960baea45e9789b743e30946d4fb8be30160c274fdd220f1a5a5eb758d4882ce84c901
- SSDEEP 1536:FlZ+MzHQWd+W1soj4wSB9IBd7kM51rsrnAOZlN0Fjh9a2m+3avR:l+C+W1soj4Tadgq49ZlN0FTdm+C
- TLSH
  T1AF9302D5A3BC5DD96222EBB256874F6FC3A4141A0E548209F67F3CE40EB0F8944E725B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  LICENSE-KIBERSHIELD-X.txt
- Size 1KB
- SHA256 faf995b9cf84ba357cfe6399d9c74022734cf59d7b418b4980daf33f1e98680f
- MD5 9745b9a6aab3265abe57a2a7429ad89c
- SHA1 5d10d71f0475d5ba5a6619b3c3e381d4032be554
- SHA512 72459690f7cde983a5570e3944b616909f8fc1f576fc0b63ab8b1e6231884e97512a2af5bea7d0d8b77c5e365a8850aa71e22e5937fc86355de5922032412752
- TLSH
  T15B21DB1F3306879305959356555CF8D5F227B04A7FAB1640305FF3115331018CDFB868
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  libcronet.dll
- Size 9.0MB
- SHA256 c7434cfa93c3041321dd19111c4de6c52b8a9531a65661ba45425d3c51ec69e2
- MD5 72ae38a69dc9ced1a13f1ed58d943585
- SHA1 e977eb3d0b79992c27fbee9151da7407b38e978a
- SHA512 f87d6335035d1452c9bd5ab1a07cdfa7380623b1451084358a923602eeb4315249d8588442115a4877c8754c1fb8e4709e19fc148e6f3676796b75abc9a9dbe3
- SSDEEP 98304:hlOTNPRHJWVfW2m3tdB+JblCblDwybHULDWayIto1YyeLuNZShGp1b9:eThAfWPB+JblCblDwybHmoFeqLb
- TLSH
  T19D965B43F29651EDC019D079971B9232BA71BC494B3579EF0B90BB612E72BE0A73DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  КИБЕРЩИТ ／／ X.exe
- Size 54.1MB
- SHA256 24ea418d267eee86fae550ecf49eda6a4d9a30335d79b6b8d4e3dc689c27fc11
- MD5 985d2d612ea9c3233c5225a1febb5896
- SHA1 7c827931afbfed82485a8dc59e8c4ff3e211d03a
- SHA512 3028be342b33e676e2730cab9f21d91034f864d54e7f1403e7f845fec31aca8e4af005d284cb04528602d76fde2a2ae38d465efbd44844cc9906a10aed7c6388
- SSDEEP 393216:uupf70fkjDQfS1/8bec6DMSs9ul/7ghKWsdBSKFdu9CwJsv6t1VPV9Kx8ycs:Rd70qUbX3ul/7SaB6VPnyh
- TLSH
  T11AC78C0772F90185E5BBC1798BA78627EBB2784543309BDF059492AD1E33EF44E3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral20 behavioral21
- Target
  КИБЕРЩИТ ／／ XCore.exe
- Size 62.3MB
- SHA256 4fda9d4f7447ef54900b128226e8548d19ea041650555af4697a50390a5e7e75
- MD5 0955c7a9b3fca6021d4c7b5f9d8d68c0
- SHA1 0300b1f7b0bc0f7ae172ad1bb2ddcff6ddf0b6f4
- SHA512 45b32faf086201305e5097b2b453a4ce61c3508f9a48def57d3a52fc2f720a81daa7442148316d0367b05ec65836cc72460f80c4394bd3ca507c193a7c2d56e4
- SSDEEP 393216:Pxe3Wy0DVMeE9ZMWiJPbAoX093Y1gY8gEygpbUWtM9rg+0d9D3bao:Pxe3UH1VFi9+gYXNNWZvd
- TLSH
  T175E72843F86A0CE9C5ADC430D5A295237B717C594B2027E72B60FA147F7ABD0A6FA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistence

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

defense_evasionexecution

behavioral8

defense_evasionexecution

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

© 2018-2026

Terms | Privacy