Overview
overview
7Static
static
5SAK_32bit/SAK.exe
windows10-2004-x64
3SAK_32bit/SAK.exe
windows11-ltsc_2024-x64
3SAK_32bit/...ci.exe
windows10-2004-x64
1SAK_32bit/...ci.exe
windows11-ltsc_2024-x64
1SAK_32bit/...at.exe
windows10-2004-x64
3SAK_32bit/...at.exe
windows11-ltsc_2024-x64
3SAK_32bit/...ck.exe
windows10-2004-x64
1SAK_32bit/...ck.exe
windows11-ltsc_2024-x64
1SAK_32bit/...ol.exe
windows10-2004-x64
1SAK_32bit/...ol.exe
windows11-ltsc_2024-x64
1SAK_32bit/...et.exe
windows10-2004-x64
1SAK_32bit/...et.exe
windows11-ltsc_2024-x64
1SAK_32bit/...cp.exe
windows10-2004-x64
3SAK_32bit/...cp.exe
windows11-ltsc_2024-x64
3SAK_32bit/...ck.exe
windows10-2004-x64
1SAK_32bit/...ck.exe
windows11-ltsc_2024-x64
1SAK_32bit/...el.exe
windows10-2004-x64
7SAK_32bit/...el.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 17:07
Behavioral task
behavioral1
Sample
SAK_32bit/SAK.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
SAK_32bit/SAK.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
SAK_32bit/bin/4nxci.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
SAK_32bit/bin/4nxci.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
SAK_32bit/bin/guiformat.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
SAK_32bit/bin/guiformat.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
SAK_32bit/bin/hacbrewpack.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
SAK_32bit/bin/hacbrewpack.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
SAK_32bit/bin/hactool.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
SAK_32bit/bin/hactool.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
SAK_32bit/bin/hactoolnet.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
SAK_32bit/bin/hactoolnet.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
SAK_32bit/bin/hptnacp.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
SAK_32bit/bin/hptnacp.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
SAK_32bit/bin/renxpack.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
SAK_32bit/bin/renxpack.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
SAK_32bit/bin/squirrel.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
SAK_32bit/bin/squirrel.exe
Resource
win11ltsc2024-20260709-en
General
- Target SAK_32bit/SAK.exe
- Size 1.6MB
- Sample260801-vm34caea24
- SHA256 9f6b8b9b26cb5c6f1d44f8c771f64ee16fa0800331c8ccbc31ebad2e452a834a
- MD5 fba0709e39294680ccecfead574f3a59
- SHA1 a9153aebdc0924f182cf0cf688d90de96f0eed16
- SHA512 e7b0d84f39c6012612abb08adbb60a0cdb53e1288312c5278399d0660771b816e088d7e7636d25f128ed1910bca2e7ec64097c60449b1b429d728f33679920bf
- SSDEEP 24576:SAHnh+eWsN3skA4RV1Hom2KXMmHar/fP1piadgSepsCIBumhbozTX2JNe5:Vh+ZkldoPK8YaTfP1pige65Nhbk
- TLSH T1F775CF0273D5C036FFAA92735B6AF23556BD7D240123852F23D83E7BBE701A1162D662
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAK.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3724 SAK.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3724 SAK.exe 3724 SAK.exe 3724 SAK.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3724 SAK.exe 3724 SAK.exe 3724 SAK.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5LSpAsldx3vqM7gqBuCJ0.jpg
- Size 43KB
- SHA256 dffd9e97ad9735eae5cf9c8dabac55b51a8f8a37c938a3a94593cf4ecd511cb7
- MD5 502f59e0056d988a4d1dbe9c6fb9cfae
- SHA1 0f55209fc9c355e5236d190959ab981becd09486
- SHA512 41b185476c60ff4975e0de18eefe01a54983315d6ba0ddf5904adf70198a98a9b86e006e9c6af481c2892bd8fefd17605ecb2e4d303a1571dd6eaa68945d93ba
- SSDEEP 768:007AtrGZolCF6XFuj9KhusKYCji9iPx+nS6NSJMCG4+lGNJfXQXj32VphUfrAt7y:00QrGOlLYjX5dtAnS6zz4eOXcIlG
- TLSH T1D713F2A76B6DD758F200DBB080AB7728BA82382873E4FD6964EB4700F6F18F56541275
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5LSpHildx3vqM4olgquCJ0.jpg
- Size 302KB
- SHA256 98686616b12150151fa4b7077438359ca646f7ac673c808c30e4695e8a947c26
- MD5 774d56ffcf9f572bdc6ba964ce64e7cb
- SHA1 80160736e1b98f21e361eed07403f912214e8d25
- SHA512 dad85a276527857da56478d3af4f0583f13946b80281a89a1ddcfdeacb56867668cd4cbf929fa3b3a37071c1242903cee191ebbf89f84836664c0c03b1ab3620
- SSDEEP 6144:GCyUPClryXCVZxB2JOarG2IS+sxe2fFaBGPK/HYpl5hU+z6Q:GXmkyXwZxB2gaSlS+AYgKPK5n6Q
- TLSH T1E364238487493A1DC380A09CF03109995A693E2757F9E58AD07E68F39B14EB3DE73772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5LSpXhdx3vqM4aMquCJ0.jpg
- Size 10KB
- SHA256 78e0a8bb4bd18f5274d12ec52bb874a8d7ba3e908f4e7a3898f2fa2739c6bff5
- MD5 7fff939bdd046176273c7a8e5c01f97f
- SHA1 c72837b0cf9c001b0fc5f0653f8df4e36c605884
- SHA512 1c7270b86a11f2a2373dda5bcbce4975e5372d1eb3f0c52100000f32d1702ce585261fef77374afd4604ee30208b310f8190e4e12909fb4d6d6cc2a8cb1ad53c
- SSDEEP 192:wytciFfsdRWp8cgRCkqDrW4p1A21GiAbI2RPTvPNXLNe:weciFfsbRCkAW4p1W1k2RPjze
- TLSH T10A32AF44A7668562F3AD06F501903775732A8AB127CC4EBA3A06CFBFD145CF17C4A64A
- MD5 SHA1 SHA512 SSDEEP TLSH