General
- Target 2026-08-07_0de0f7f43d26097084e3c578ccb7af3a_conti
- Size 190KB
- Sample260807-gv7jvaec84
- SHA256 5d47d04faf51df41225c49c7568c4128195b18f2a9cd0f6715fcb95f919a1611
- MD5 0de0f7f43d26097084e3c578ccb7af3a
- SHA1 0ad02e6b32e918994c6cb4e068dd1f5334acb263
- SHA512 3926cfbec9507f055e1af110013e9785a09ae8a16228a03bc8342d954f9967366c490eb3f54f98872194d31b9047cfa8b380b6335da3ef8bdae1c396989b9c6b
- SSDEEP 3072:hzvJPLBf0mVBJYIzDgm8442+GWJlpxMhgfODyQ:h1LWmVBJrDgm8446WJehgfODV
- TLSH T174144A13F2965CE9C86BC1719797C336DA71B4690134F62F6BA8CA253F22E50B72C385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
2026-08-07_0de0f7f43d26097084e3c578ccb7af3a_conti.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_0de0f7f43d26097084e3c578ccb7af3a_conti.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_0de0f7f43d26097084e3c578ccb7af3a_conti
- Size 190KB
- SHA256 5d47d04faf51df41225c49c7568c4128195b18f2a9cd0f6715fcb95f919a1611
- MD5 0de0f7f43d26097084e3c578ccb7af3a
- SHA1 0ad02e6b32e918994c6cb4e068dd1f5334acb263
- SHA512 3926cfbec9507f055e1af110013e9785a09ae8a16228a03bc8342d954f9967366c490eb3f54f98872194d31b9047cfa8b380b6335da3ef8bdae1c396989b9c6b
- SSDEEP 3072:hzvJPLBf0mVBJYIzDgm8442+GWJlpxMhgfODyQ:h1LWmVBJrDgm8446WJehgfODV
- TLSH T174144A13F2965CE9C86BC1719797C336DA71B4690134F62F6BA8CA253F22E50B72C385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables embedding command execution via IExecuteCommand COM object
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe
-
Suspicious use of NtSetInformationThreadHideFromDebugger