General
- Target PassatHook.exe
- Size 15.1MB
- Sample260807-tnwj8azalg
- SHA256 8dbb11ffacdb595badbfc3feb8cf92e2a892a8d4b4d32430025416143b5d03bd
- MD5 feb8afc269a0ea76e92f5a129bb4583f
- SHA1 c2a3040060c7a1223572812216cb169e33ca51f1
- SHA512 7cace8bca7c3de64dd6e0cd39315b0dc877668a52ad6bc3863d8792013b42fe723db70b3407aff5853ea9cb97ef0e05ba24e5555b874dd4c2dd749b6d55c3d74
- SSDEEP 393216:YhQwZLQwng0uLBZAij6BN71mSDI8eAxQs3:Y1Q6uLj5jaN71qJs
- TLSH T17CF623C27AC5E6A4D0D649201AC3739E609B67F980FECA8E3DC65C033AD0D795D1E5B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PassatHook.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PassatHook.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target PassatHook.exe
- Size 15.1MB
- SHA256 8dbb11ffacdb595badbfc3feb8cf92e2a892a8d4b4d32430025416143b5d03bd
- MD5 feb8afc269a0ea76e92f5a129bb4583f
- SHA1 c2a3040060c7a1223572812216cb169e33ca51f1
- SHA512 7cace8bca7c3de64dd6e0cd39315b0dc877668a52ad6bc3863d8792013b42fe723db70b3407aff5853ea9cb97ef0e05ba24e5555b874dd4c2dd749b6d55c3d74
- SSDEEP 393216:YhQwZLQwng0uLBZAij6BN71mSDI8eAxQs3:Y1Q6uLj5jaN71qJs
- TLSH T17CF623C27AC5E6A4D0D649201AC3739E609B67F980FECA8E3DC65C033AD0D795D1E5B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger