General
- Target Wave.zip
- Size 26.9MB
- Sample260808-1yta6sfe93
- SHA256 ac57f609e56f7344803951e35e37df8ecffba52291e9593bb1616be57cc092e5
- MD5 3e70a7370246fe8b6b7b87f2ec18ec2d
- SHA1 2a540cefeb2f5dbdd5cb0ffb4def6693e54ca7d1
- SHA512 6feb895d1ccbe0c4253a84c5f7b21c2a34570db9b5afb781289179f125dae5adb7cd3628eaf5fdab32f0878c6f163dcd2b2ac4e405929a5172a543fe8e42d5cf
- SSDEEP 786432:2FgTGnvytOgEvxaQUkQRtRmNhtt+dfWoddT0wVpEaF:PG6taFcHshtt+/dAwn5
- TLSH T1365733C5EAFF5639373E3356F8CC84086A9CB81CD36DDA29E13A48DA67953E39315048
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Wave.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Wave.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
WaveUIAuth.dll
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
WaveUIAuth.dll
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
WebView2Loader.dll
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target Wave.exe
- Size 9.6MB
- SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
- MD5 1852c2d25f644263c7beb6fd8183e3bd
- SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
- SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
- SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
- TLSH T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target WaveUIAuth.dll
- Size 20.6MB
- SHA256 2f0941e4c4714d207f866861555e1606fd54e12b865b9f4d3d50ceb9f78fd403
- MD5 91ec65fcb1665c1f55198a868bb8224f
- SHA1 c244ec97d014809e568ef3611fb1bd625b52a35f
- SHA512 e1f49032fb739b7dec9f2cb17c32828c0e9117b64a44d39d9d25c82fa838a48f3dca98a153917729130ac9dc9dbdbcdee538cc0a6ed40e06d3a46f8abcb99104
- SSDEEP 393216:DBt6fSdHPPmgT9x/5qecpP3QU2cV6OkI/x0wlIWy3ZAHPoK3e3UAFW:T+2PFx/8NPsQ3x7+fIYrF
- TLSH T1B42723E524D411FCD896C630E25E2BEDF1D578494DB9A82E7FC608012F31E9BC9A2937
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10