General
- Target Teleshadow.3.1.rar
- Size 2.4MB
- Sample260807-xwbrkasbjb
- SHA256 2c8cd3b41f34b23cc0dd45550542f05082a1ec401962c76386eee6c2d1ae09a6
- MD5 c29b1a951eae54d36d0a110217713348
- SHA1 73e12a7e320148e2e999c2d0a9495b9216fca70c
- SHA512 2284c96df68793f848930b54172ced783537dbea59ae1f029bc8d7e3c82e4a187436661f776d5e2d1b1cbfbfc2ec476c7aeff26721491a48ca0b570866cc88de
- SSDEEP 49152:554qbBjTh4gjlFviB4YINXiua9zEjoOcQ8+6K7Dvp+rebhJMK4MRUPk:5+qdSgjrviBkNXieEv+NvU2h3/Uc
- TLSH T1A8C53364FFCF82E5D5C9CCBF9B718083378688CA53109453CB56269B8361A7ED8C696C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
Teleshadow 3.1/Stubx.exe
Resource
win10v2004-20260513-en
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
Teleshadow 3.1/Stubx.exe
Resource
win11ltsc2024-20260709-en
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
Teleshadow 3.1/Teleshadow 3.exe
Resource
win10v2004-20260513-en
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
Teleshadow 3.1/Teleshadow 3.exe
Resource
win11ltsc2024-20260709-en
14 signatures
300 seconds
Malware Config
Targets
-
- Target Teleshadow 3.1/Stubx
- Size 567KB
- SHA256 dbed7c89cc3b7c81872a7375871454e2ddd8d80a98162ed854100620b8786ef4
- MD5 f3091b9b1756b02df619782f36c0c9aa
- SHA1 57a180cca006150a823faae8d230825708c394c6
- SHA512 27c27889721874286fa94fc71cf8d17544c5e352f67e40bf31c22134ab88e1f510a7640a3c75c82638928c422e65af8f9be4cd9b756db59812ee21b31dafd846
- SSDEEP 12288:d8Gj11/IH1C2kp64AXhQJl2Nw+1iKG0g:d8GR1/gfkp64ARaT+4KG0g
- TLSH T141C4AF00BBD28171E9B61670157E972A693EBA140B3549DFA3D8085D3E237E25F31BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Teleshadow 3.1/Teleshadow 3.exe
- Size 4.5MB
- SHA256 c9b7567230206f52f560d5ccf21c9b2022ae65d0411b30b8e4374e64b34e7bd2
- MD5 ed813189205c0d0e961d3eb7ae208dde
- SHA1 75f737f1291552a5d44204d30809831e2c29e44f
- SHA512 e130ca10c887800bf25652f8eea98c77414d17d7cc0f692067e236d13cc3530c4efb51c3982fc91e998e177db60e766001c56252eea981045791d28cde1aeb7b
- SSDEEP 49152:4/s254Tb+KZXfSTZXY6tI1/a16Tl8sKs9F1zUADvLJeIG2ko/kBJHNti/N5U/kM3:4/s5S5UR8gzDD8IkVBJe1YZ
- TLSH T1B6261622E29FBB31C31F86FD5B015302F22CAE77B916F70AF5A951E40066BB5095718B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.