General
- Target DemsV6.exe
- Size 70.3MB
- Sample260810-krzavaej5y
- SHA256 83a71b614955d33e878200a915807da3a1b3467953557c874e7b07bdbee9f302
- MD5 2fb6b2fabd0367e93dffc151692cc9d8
- SHA1 0053fe9bc9b51900119f29b2a3c2cc3a8a8134d3
- SHA512 56ee05771eacab02976dfc506d0e7efba12fb5b318b98ddae1977c63e5f1e29dc5d3d95a337a36471c39fb655b22b1765e7da0c9031badb5d65be09e18e43f1b
- SSDEEP 1572864:p50D+RBwXzTUX0w8mxmVEt7y1ubpCwC3dUup7tR00UJk:i+RBwXP5fmxiE5y1ipCwQ30zW
- TLSH T180F72356E3F900E8D9BAC0BCC6571617E7B134551760A7EF62648A692F23FE06E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DemsV6.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
DemsV6.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target DemsV6.exe
- Size 70.3MB
- SHA256 83a71b614955d33e878200a915807da3a1b3467953557c874e7b07bdbee9f302
- MD5 2fb6b2fabd0367e93dffc151692cc9d8
- SHA1 0053fe9bc9b51900119f29b2a3c2cc3a8a8134d3
- SHA512 56ee05771eacab02976dfc506d0e7efba12fb5b318b98ddae1977c63e5f1e29dc5d3d95a337a36471c39fb655b22b1765e7da0c9031badb5d65be09e18e43f1b
- SSDEEP 1572864:p50D+RBwXzTUX0w8mxmVEt7y1ubpCwC3dUup7tR00UJk:i+RBwXP5fmxiE5y1ipCwQ30zW
- TLSH T180F72356E3F900E8D9BAC0BCC6571617E7B134551760A7EF62648A692F23FE06E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.