Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SlinkyFree/Loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
SlinkyFree/Loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
SlinkyFree/Rysa.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
SlinkyFree/Rysa.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
SlinkyFree/fix.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
SlinkyFree/fix.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target SlinkyFree/Loader.exe
- Size 61KB
- Sample260804-gd7hhsdg68
- SHA256 acd68bd28873175af0a0dd5e55590bcec9832bb7aa4c3902b8d20be25309819e
- MD5 300e66716f6a0f3b62bd295b316646e3
- SHA1 9ea8514aee5faae59aace11af56ef1ae9a1d33eb
- SHA512 97812492ec9b0daf932f0320b51495975c6c9ed373328ca00d75322dc9649d9ae77e84b166d366037ef518db29a16596920def46bd0542795fb57b3b8dcca9f7
- SSDEEP 768:Wz07utLyli/O5QbRUvTQl+UNAPx0Vmun2FcXkXlbamHvV4rpX0VU:Ww7utLXO5Xklgx4rn2FcXkXRam2/
- TLSH T1C953F826DA06F037EA490C71A4074BA24DA39C3687D5E8C3FBC14EEB15669D56F3A703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4636 Loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe 4636 Loader.exe