General
- Target ProbeLoader.protected.exe
- Size 21.4MB
- Sample260803-sfnnzabc96
- SHA256 d5420ce63c291c01d202255873fb87d96e7dfe24f5a8d26bc4e846ab68aed83c
- MD5 24b17927ba9900fd248167c8550f292f
- SHA1 36491928b85471c713309f1ffbb6fd571cf222ac
- SHA512 85a06d9e2cb9da92a4f21a13c173b4db7f0f0da028113077dfd1551958fe12a5005385ae8ee1b121f6cdefc6d3360ea9b5aeccd58499ff4d5d67ab294cace2e0
- SSDEEP 393216:affwAxeOCp7kwN9XTVWXNl8ATxJeXnEq9KbBWft7HUI2fzBID1QNQOaGjo4DZosQ:aff/eOHWhI8ANJeXEq9KYfpZ2f1oQNQX
- TLSH T1FB373302F69047D7E3691F34C2224D1D39A63E9992F6AE3F33AE21052F4775ACF65A10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ProbeLoader.protected.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ProbeLoader.protected.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target ProbeLoader.protected.exe
- Size 21.4MB
- SHA256 d5420ce63c291c01d202255873fb87d96e7dfe24f5a8d26bc4e846ab68aed83c
- MD5 24b17927ba9900fd248167c8550f292f
- SHA1 36491928b85471c713309f1ffbb6fd571cf222ac
- SHA512 85a06d9e2cb9da92a4f21a13c173b4db7f0f0da028113077dfd1551958fe12a5005385ae8ee1b121f6cdefc6d3360ea9b5aeccd58499ff4d5d67ab294cace2e0
- SSDEEP 393216:affwAxeOCp7kwN9XTVWXNl8ATxJeXnEq9KbBWft7HUI2fzBID1QNQOaGjo4DZosQ:aff/eOHWhI8ANJeXEq9KYfpZ2f1oQNQX
- TLSH T1FB373302F69047D7E3691F34C2224D1D39A63E9992F6AE3F33AE21052F4775ACF65A10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VMWare services registry key.
-
Looks for Xen service registry key.
-
Suspicious use of NtSetInformationThreadHideFromDebugger