General
- Target CaiThuVien.exe
- Size 598KB
- Sample260803-hty2radf88
- SHA256 3fe8dc93c4e5958c4bb9d1088df70ed346d479ddb0710245a0c4ab7dcd92787b
- MD5 7d6437f888d1d80f7f62010993476223
- SHA1 6ff703cb617c627befee292ff3e7662ad7eb0106
- SHA512 6daf06938c997cd9555e9b63c042801b7833f79472db90240cfd13feec4b11968cc97910f17d49e4097fe9c3232a840e1ee4844b97bd471f0b1c4369a74b34bf
- SSDEEP 12288:YOvpL2QQe4+hAdmixKmzUVMPRTqWKWwxvsSJWWXxlEU4bUW:RpL2khGFpqDH/E
- TLSH T125D48D653644099BC1214FBC84E4F77992392FD03F1596A3C5E02FB77E3AACAED21612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CaiThuVien.exe
Resource
win10v2004-20260513-en
10 signatures
60 seconds
Behavioral task
behavioral2
Sample
CaiThuVien.exe
Resource
win11ltsc2024-20260709-en
6 signatures
60 seconds
Malware Config
Targets
-
- Target CaiThuVien.exe
- Size 598KB
- SHA256 3fe8dc93c4e5958c4bb9d1088df70ed346d479ddb0710245a0c4ab7dcd92787b
- MD5 7d6437f888d1d80f7f62010993476223
- SHA1 6ff703cb617c627befee292ff3e7662ad7eb0106
- SHA512 6daf06938c997cd9555e9b63c042801b7833f79472db90240cfd13feec4b11968cc97910f17d49e4097fe9c3232a840e1ee4844b97bd471f0b1c4369a74b34bf
- SSDEEP 12288:YOvpL2QQe4+hAdmixKmzUVMPRTqWKWwxvsSJWWXxlEU4bUW:RpL2khGFpqDH/E
- TLSH T125D48D653644099BC1214FBC84E4F77992392FD03F1596A3C5E02FB77E3AACAED21612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.