124b2e100fca6382bcd1e43c5ea1a6b68903573a97fce406c3b44751369ba793 | Triage™

Login
Reports

Overview

overview

8

Static

static

1

Falcon_Off...ge.zip

windows10-ltsc_2021-x64

1

Falcon_Off...ge.zip

windows11-21h2-x64

1

FALCON_OFFLINE.bat

windows10-ltsc_2021-x64

8

FALCON_OFFLINE.bat

windows11-21h2-x64

8

FALCON_RESTORE.bat

windows10-ltsc_2021-x64

8

FALCON_RESTORE.bat

windows11-21h2-x64

8

OFFLINE_REPORT.txt

windows10-ltsc_2021-x64

1

OFFLINE_REPORT.txt

windows11-21h2-x64

3

falcon_ca.crt

windows10-ltsc_2021-x64

8

falcon_ca.crt

windows11-21h2-x64

8

falcon_ca.key

windows10-ltsc_2021-x64

3

falcon_ca.key

windows11-21h2-x64

3

falcon_hosts.ps1

windows10-ltsc_2021-x64

8

falcon_hosts.ps1

windows11-21h2-x64

8

falcon_off...ver.py

windows10-ltsc_2021-x64

3

falcon_off...ver.py

windows11-21h2-x64

3

falcon_server.crt

windows10-ltsc_2021-x64

8

falcon_server.crt

windows11-21h2-x64

8

falcon_server.key

windows10-ltsc_2021-x64

3

falcon_server.key

windows11-21h2-x64

3

gen_cert2.py

windows10-ltsc_2021-x64

3

gen_cert2.py

windows11-21h2-x64

3

offline_se...og.txt

windows10-ltsc_2021-x64

1

offline_se...og.txt

windows11-21h2-x64

3

shot_final.png

windows10-ltsc_2021-x64

1

shot_final.png

windows11-21h2-x64

spki_hash.py

windows10-ltsc_2021-x64

3

spki_hash.py

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
Falcon_Offline_Package.zip
Size 221KB
Sample260809-ltawpsyvet
SHA256 124b2e100fca6382bcd1e43c5ea1a6b68903573a97fce406c3b44751369ba793
MD5 13d18c77e06d5fd14b7f1d42ecf81915
SHA1 c7627c20e07d7a1be3df05a83317a2a1d32258a0
SHA512 69edd957d573337938ca3533fb2ab0d219a77b101492d3a38221e42b820c89b89d877d71fb07bf0c4a91eb99e6167c5f925c9697c7bcebe35f6e1bf0d320341b
SSDEEP 6144:M0fU7Q7tW5LDkbuQUJsa6HkM1woa0FdUTNuKSX+lnK4+UB8sxMv5:y84AlUs1woasSNyXgnMUBhxMv5
TLSH
T1E8242332A7660C81E74BF8B473EBD948B2D2D1708D329C794AA6974D341EF482723393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

Falcon_Offline_Package.zip

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Falcon_Offline_Package.zip

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

FALCON_OFFLINE.bat

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

10 signatures

150 seconds

defense_evasion discovery execution

Behavioral task

behavioral4

Sample

FALCON_OFFLINE.bat

Resource

win11-20260513-en

windows11-21h2-x64

10 signatures

150 seconds

defense_evasion discovery execution

Behavioral task

behavioral5

Sample

FALCON_RESTORE.bat

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

8 signatures

150 seconds

defense_evasion execution

Behavioral task

behavioral6

Sample

FALCON_RESTORE.bat

Resource

win11-20260513-en

windows11-21h2-x64

8 signatures

150 seconds

defense_evasion execution

Behavioral task

behavioral7

Sample

OFFLINE_REPORT.txt

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

OFFLINE_REPORT.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral9

Sample

falcon_ca.crt

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

3 signatures

150 seconds

defense_evasion spyware trojan

Behavioral task

behavioral10

Sample

falcon_ca.crt

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

defense_evasion spyware trojan

Behavioral task

behavioral11

Sample

falcon_ca.key

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

falcon_ca.key

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral13

Sample

falcon_hosts.ps1

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

6 signatures

150 seconds

Behavioral task

behavioral14

Sample

falcon_hosts.ps1

Resource

win11-20260513-en

windows11-21h2-x64

6 signatures

150 seconds

Behavioral task

behavioral15

Sample

falcon_offline_server.py

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

falcon_offline_server.py

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral17

Sample

falcon_server.crt

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

3 signatures

150 seconds

defense_evasion spyware trojan

Behavioral task

behavioral18

Sample

falcon_server.crt

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

defense_evasion spyware trojan

Behavioral task

behavioral19

Sample

falcon_server.key

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

falcon_server.key

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

gen_cert2.py

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

4 signatures

150 seconds

Behavioral task

behavioral22

Sample

gen_cert2.py

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral23

Sample

offline_server_log.txt

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

offline_server_log.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral25

Sample

shot_final.png

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

shot_final.png

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

spki_hash.py

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

4 signatures

150 seconds

Behavioral task

behavioral28

Sample

spki_hash.py

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  Falcon_Offline_Package.zip
- Size 221KB
- SHA256 124b2e100fca6382bcd1e43c5ea1a6b68903573a97fce406c3b44751369ba793
- MD5 13d18c77e06d5fd14b7f1d42ecf81915
- SHA1 c7627c20e07d7a1be3df05a83317a2a1d32258a0
- SHA512 69edd957d573337938ca3533fb2ab0d219a77b101492d3a38221e42b820c89b89d877d71fb07bf0c4a91eb99e6167c5f925c9697c7bcebe35f6e1bf0d320341b
- SSDEEP 6144:M0fU7Q7tW5LDkbuQUJsa6HkM1woa0FdUTNuKSX+lnK4+UB8sxMv5:y84AlUs1woasSNyXgnMUBhxMv5
- TLSH
  T1E8242332A7660C81E74BF8B473EBD948B2D2D1708D329C794AA6974D341EF482723393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FALCON_OFFLINE.bat
- Size 1KB
- SHA256 23fd526a0be0d8d41244b3e2f2470a87c3d2af4818956e6767745f9e358aad4d
- MD5 f5f0504eef7ebeed22d4f1820412a749
- SHA1 8abbba04e7367ffe0cb82032f7d48706ad954d63
- SHA512 8a9d68d49dbd22f3c1e5c7a5e0374e17e4c41a859a329d647330f0f0804e6e06b5745d44ddc62ff45b17a9e245445b935f2e74ebd39e9795bf0b96c50a776185
- TLSH
  T1EE41640B237C831F96E55783B9E211A3BB5902DF40091DCA12ADE32B240E38DA0FD0B9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution
- Drops file in Drivers directory
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4
- Target
  FALCON_RESTORE.bat
- Size 1020B
- SHA256 dc5a2e8fbc47a06670594254a3ea647446355a81598922c4315438588a80c932
- MD5 1437f18e8cf3827d211ef4b5cf8afa6c
- SHA1 e691ea075e0d50a9034833b728e5cfdecfe1536e
- SHA512 be898d12961d362e554ee8bca2c000123072bbf534f08e74592fcc0b82a82ea545a4a8a81a45199a34485e22f11dd7c5cc8bfde55f4f6e9dc3cc4d28a80fd316
- TLSH
  T12211E116232C923D19D656A6F9955063FEC900CA420A6EC271BFE1BE350938D56FC4ED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution
- Drops file in Drivers directory
behavioral5 behavioral6
- Target
  OFFLINE_REPORT.txt
- Size 4KB
- SHA256 7d6b1825f27ccd6953c529fbc32f0358c7f3fea1d0f4a5d24cd4a1fc4cba3275
- MD5 f30447919bf693b29891f3b6b6cdbe6c
- SHA1 9745cfee5751dc546013092a5d0dcd3679288f2d
- SHA512 2f1945294eba12040b4fecb9ac2f094c580a0c75e7947cc5f2a5ab50c948ea69b85f7cd51803e90f9f29dc1e5bbc3d177d02b36853190789638d4d020b94ad10
- SSDEEP 96:8Ue7Kbfuave0Ofz24LuKpe/eH12EyY7hbVb8cBPuO3lQ3911:8U12hrlapg2RY7hW/4G3p
- TLSH
  T10E91EFD21E1884320A55DE0ED0D27878E8B6FE27D74AFD34399F09611B9B723E18D276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware execution
behavioral7 behavioral8
- Target
  falcon_ca.crt
- Size 1KB
- SHA256 0bac7211cd774d0358b65e7052bc2edca63f919016320454e9fda44126b7045f
- MD5 f8df8966e095c82bc6e8772e33c5b5d7
- SHA1 7e0f7b5e14c3adb653c57b33de1c919db2e8e5cf
- SHA512 e0ad7dbb9e772b1d37f522b77f326cd51b84c5792f8abcbaf7edbffda82c225805c6ef9307a5d43c25a8ba642101a4ec1fb71ee454bf04bdbf8cbe2eb1738885
- TLSH
  T1391182A57F42950830739125C4BB11C25DBD4AF8AA43FA3B4FE85410E6C0C88AC393AE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral10 behavioral9
- Target
  falcon_ca.key
- Size 1KB
- SHA256 9287f6c93fe24bbaa28fdf34e6cccbc56f85378302f0082629a38c5441e2dfce
- MD5 d94d33955ade6f370904ab7ad797e315
- SHA1 071604c67cab3f0d1bd7b706045ae43a8baff435
- SHA512 1816993ac0c8e3a11ed3f33ed0993267b39680c0834be4e2fae15fac8a74650ed4f579843a176590869469054b9b911cda25a07f3dae0c24b27a67d60cfd695f
- TLSH
  T1C631D86DF8BC3512B67AB3EE0E09162DD6B00AB20B9090852F113913917F2B9A68C4D0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  falcon_hosts.ps1
- Size 1KB
- SHA256 136d4f80f187d79a5f219a4c03ea44cb4c37cd142d5dc78c1cbcb10fe59163e3
- MD5 ef73a17e574cf3b1f7be9e873fe1a210
- SHA1 43ddda1e174e436302982876cfd2e27ff221c2b8
- SHA512 79252da581d2fe1e3121c73d03d38bd3fe6770d0afce9d14aa3a1124bbeb0c356a74408a9dd6c695f08831ac5137d62289af15bd83c9fe476a3637717a4fd1c3
- TLSH
  T17B3122393ABC6CDB45F300AE50D7A153DE85E4D840159D8CE27C8708BF77A0D4233A99
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Drops file in Drivers directory
behavioral13 behavioral14
- Target
  falcon_offline_server.py
- Size 4KB
- SHA256 cce0bcf613b71f44b2ee670a2cf62dab6c96c38f57d88aa66b773dd4d0feda61
- MD5 647afad25c5b72e969d6cba9e2c685d5
- SHA1 2022044ed5ac0474db7311dbb116237272518f44
- SHA512 0255c9489bc19be366432d8545ea1fa34c3013e5987b8bb866f2a279a48c5e983dccbc29c235c58c5a77f74dce6292ec630bd789430bd98e996aa45df3802ef8
- SSDEEP 96:quppRBGMAaUu5KOYz/lDcXz0WjBS9+1zU+DvBpFlkJ:rppS5k5Kf/lIXz0WdS9+1z3vvFlkJ
- TLSH
  T1FAA16425C9A6686F8363C517D86AE462135E68530509683DF7FC832E1F8893CD0F5EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  falcon_server.crt
- Size 1KB
- SHA256 4275912e53f85cb158d57bc6ea3d6a66ee2fbbfc8b00b01afa150eb0981ad9d0
- MD5 b9abec771ea56ee2737749d526dabc66
- SHA1 cb14de47c35e9ef01653087eff1fc40642795b59
- SHA512 41293bff05649b07a78d8ffe03b1257b931e65fed482ceb7d5a960fc975ba536c555c7367ae1058d58dadc370bb9d732e52dd8dbaa1f7289db641c21522c735a
- TLSH
  T1EC21835B5E7468D8200BA26C4CDE80E974B9687A0D02D8FC0A97644BCEC7E0CE52929C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral17 behavioral18
- Target
  falcon_server.key
- Size 1KB
- SHA256 fdcd8f3f77e2b90c8ec50bff0b0994bc6d704940d191764faa8b6479527b4d6f
- MD5 725abed7024cf08a39d4e953c6ccde4c
- SHA1 27f090093418bca1486d25634390982cbdc324a0
- SHA512 94fc2d693fac87a57ef151e83af4044e06a973b54167d310022a22f670e6dba6eb39d4c9b8495499771c8cbfcbc1afc740df56ccf8de6c6f99a8a257b930f382
- TLSH
  T19E311A61F9011DA36DF3C1C85D1338AEA66A913143EE1573A46915BFEB9C251E5BC408
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  gen_cert2.py
- Size 3KB
- SHA256 0163e2261171fcdeef0c14d1ab1bd04fdac8973d5b82614d29da1795a179ea7a
- MD5 27ee3572617207688f06ec673ce1df75
- SHA1 126bf713a4b4f8b11f5645654a1c987378853691
- SHA512 b52f601e492da30c26df27f5c8a3e9dac40015d656bb187cfeee342f5c7629217e3f3b4098941018d22a97d73dede3b9fefe97278b4df8b2f3dce2849225cae1
- TLSH
  T15F81540AE74956090E13D5B2AD25C0114F77A00F9A0C7CA4BA4C63655FEBEFC57A21FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  offline_server_log.txt
- Size 14KB
- SHA256 7f33105ebd493cb151d45fa85dc61c1b2d50b71decd59b621e202229a6351962
- MD5 0dd9699148675bc8215826acb18fe52c
- SHA1 08e3d4f76a6f35a31b685f4a9abb267f760bd8c8
- SHA512 718439cf9c1ef0c22041a5ed94910e9c62ce98f429f67e8c6837b4380b3693edfeee0e82bdf2a61a5e44d4390e8d5cdd487e8c7ee920f6225add97ea1ca09617
- SSDEEP 192:gA9A9VafwGawFA9A9A9A9A9A7nTkDR1D4kNm7B2k7jG6vAgkG+PYk9B2Cpu8:gWwVa0+WWWWWwgzZY75u6iTV98Cp5
- TLSH
  T173627782C1FD79F358395A5850FEA9EDCB4BA69350251D1F3F736A08B324E184C3E962
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware execution
behavioral23 behavioral24
- Target
  shot_final.png
- Size 229KB
- SHA256 b1fe6a55eb42ddaaddfce56ba7826e32fbb17ef6bd0c49d4aa60e25671389c75
- MD5 eb311d8b723b9f022e3a5700b248b390
- SHA1 4f7b91bdfb1b8e58866dc1cde555f8f4639053d2
- SHA512 15570ecc9912f899e59d1bf3b270c1494235b3449d62f19d7b50dfc767b3c36d627f212cbf06ca65a7a90aa0810a6062ab1d87e3e6164685d20334cec714fc0e
- SSDEEP 6144:uNSYU7361Cs7RuZwwmcwPREBIiSEVwDL01b:uwtOCARuZwwmcwpERwDLC
- TLSH
  T1DE340207AD77D469FD0F103E85FE408E36E68E2094C0727BA177A51CCB19EA32659B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  spki_hash.py
- Size 2KB
- SHA256 b85a811fdf20a5328ce39cb797f985e79ea90577710eef885dcdc1b16309ff30
- MD5 bf6e1b4d69672dc4c780cb85b7cfab92
- SHA1 3665dd2fa03fcbcc45f4c74654c83b6106644a4e
- SHA512 f80dab0fb2aefe297506d7d5fac09de92c121f121023d7c547579acaf27e46757de41c32c41872a7c5ee0ddc18cdb7456de91b83de17d2b2ac8d061f9f1a2e5c
- TLSH
  T1E8415313AC327694A7A7779E85A6E820225B19074A453D35FE0C8AE4DF03438D325FDD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

defense_evasiondiscoveryexecution

behavioral4

defense_evasiondiscoveryexecution

behavioral5

defense_evasionexecution

behavioral6

defense_evasionexecution

behavioral7

behavioral8

executionransomware

behavioral9

defense_evasionspywaretrojan

behavioral10

defense_evasionspywaretrojan

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

defense_evasionspywaretrojan

behavioral18

defense_evasionspywaretrojan

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

executionransomware

behavioral25

behavioral26

behavioral27

behavioral28

© 2018-2026

Terms | Privacy