General
- Target haha.exe
- Size 84KB
- Sample260804-acfvvahg27
- SHA256 b16facd370db47111fec0a874fe0cce99cfd0b648fc71df0276703f5d15b8cf9
- MD5 f553167960a862ec2c2c00d133d106fb
- SHA1 9678c30b599dbd0c0d008a0052c3be1437a5551a
- SHA512 4ab8988b5626355e75a2df1cdfd2d1a2f3ad75782590140c80f43800b5346f1422d3723d67d8609f15e36e092f73331688673adc7e3e380824c5f3628754360f
- SSDEEP 1536:ZjLpUX8kWPvlXt0nwXAWI5actpHtGBjmUx9teMEpD:Z1RgylI5aapNimGbA
- TLSH T141832D16EE6951BAD269C5B9CA934C05DB737C4687A2B7CF13900DE60E326D09F3E603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
haha.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
haha.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target haha.exe
- Size 84KB
- SHA256 b16facd370db47111fec0a874fe0cce99cfd0b648fc71df0276703f5d15b8cf9
- MD5 f553167960a862ec2c2c00d133d106fb
- SHA1 9678c30b599dbd0c0d008a0052c3be1437a5551a
- SHA512 4ab8988b5626355e75a2df1cdfd2d1a2f3ad75782590140c80f43800b5346f1422d3723d67d8609f15e36e092f73331688673adc7e3e380824c5f3628754360f
- SSDEEP 1536:ZjLpUX8kWPvlXt0nwXAWI5actpHtGBjmUx9teMEpD:Z1RgylI5aapNimGbA
- TLSH T141832D16EE6951BAD269C5B9CA934C05DB737C4687A2B7CF13900DE60E326D09F3E603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Renames multiple (289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.