General
- Target PassatHook.exe
- Size 14.6MB
- Sample260810-blke3asvdt
- SHA256 8adf4113cd6b792fbca7c90996034a74ae5b3b58a73ec2668d254142ed2b8183
- MD5 26f3314526c9adf202ce2af048a90971
- SHA1 93ce5f53ed785667079153ec123fab39f00edc3b
- SHA512 3f78bbbd0b943ea8db708751aba4a84c5539ca60f340c2901096dbb31b36017a85fcb05259e4c23b74c834e5b652d95cfa1097549efad89130d809746b37ca16
- SSDEEP 196608:crKckxXn0OGJGP48cGLG9CJqf40UK2fyKB2ba6qOmSZoeF0a9mx8Wsjhvh00:VBjGJ648cGLG9UBf2balOmBePmWWm2
- TLSH T1BFF623C27ED9E6E8C0978D1015C2538DA1F7B3D982FE1B0E39CE9C032A51D159E5E2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PassatHook.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PassatHook.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target PassatHook.exe
- Size 14.6MB
- SHA256 8adf4113cd6b792fbca7c90996034a74ae5b3b58a73ec2668d254142ed2b8183
- MD5 26f3314526c9adf202ce2af048a90971
- SHA1 93ce5f53ed785667079153ec123fab39f00edc3b
- SHA512 3f78bbbd0b943ea8db708751aba4a84c5539ca60f340c2901096dbb31b36017a85fcb05259e4c23b74c834e5b652d95cfa1097549efad89130d809746b37ca16
- SSDEEP 196608:crKckxXn0OGJGP48cGLG9CJqf40UK2fyKB2ba6qOmSZoeF0a9mx8Wsjhvh00:VBjGJ648cGLG9UBf2balOmBePmWWm2
- TLSH T1BFF623C27ED9E6E8C0978D1015C2538DA1F7B3D982FE1B0E39CE9C032A51D159E5E2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger