General
- Target Antidetect_5_Patreon_February_2026.exe
- Size 319.8MB
- Sample260802-gc2kwavhrb
- SHA256 6f209e7d0d4cd101815aa5cb558235162b4bb57e1a64555ae04208237a0a8f2e
- MD5 87b0b9c9f3916e9d9de4e1930d25be72
- SHA1 86f3a0a975584b5e0ebe687d24a2cc440871c7f9
- SHA512 3b3d974c74bff9fccacf461eb86979d2bbc355ef5fd2beffe6e28f52ea10c2dd201409dca868ad142a91d22ffc2c0b8d662efbe7df31a4f382d3679823512336
- SSDEEP 6291456:w40BpxMWRpt1/S8eGDaYqCf/GFZzRmwi1nspDA4bMT8qbX7WxrrD5:wpN7BS8ecaXwimfSkGxD5
- TLSH T1DAF8331278142575E6C9A03B5C4BBB61CA9A7C00131344F76BF8CAAC6E732E193F97D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Antidetect_5_Patreon_February_2026.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Antidetect_5_Patreon_February_2026.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target Antidetect_5_Patreon_February_2026.exe
- Size 319.8MB
- SHA256 6f209e7d0d4cd101815aa5cb558235162b4bb57e1a64555ae04208237a0a8f2e
- MD5 87b0b9c9f3916e9d9de4e1930d25be72
- SHA1 86f3a0a975584b5e0ebe687d24a2cc440871c7f9
- SHA512 3b3d974c74bff9fccacf461eb86979d2bbc355ef5fd2beffe6e28f52ea10c2dd201409dca868ad142a91d22ffc2c0b8d662efbe7df31a4f382d3679823512336
- SSDEEP 6291456:w40BpxMWRpt1/S8eGDaYqCf/GFZzRmwi1nspDA4bMT8qbX7WxrrD5:wpN7BS8ecaXwimfSkGxD5
- TLSH T1DAF8331278142575E6C9A03B5C4BBB61CA9A7C00131344F76BF8CAAC6E732E193F97D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1