General
- Target EmuDeck.cmd
- Size 168B
- Sample260810-nfrcmssvdv
- SHA256 e1e0c87545a48c95b8a2c0d4e0e15f1c7d2127c19ef0579b08e947a72e26471a
- MD5 d8de94c4971875b352de839698a778bc
- SHA1 d4a3a02523d8458d07dbd2b0b0986ade752f73b0
- SHA512 5adcb7c3f007defd470cc8dfdae3ee3433f6a77fdc3b0e76a1f4efb240ad970f88f31e09a0f5ea8db61d1e6b2022a5dd54241cbcc7c51ca64cd930ba235b5363
- TLSH T111C0C076C205DBFC0410C0CDD0385C80C11041906070D86253F8CC08CB44132B6D921B
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
EmuDeck.cmd
Resource
win11-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://raw.githubusercontent.com/EmuDeck/emudeck-we/main/install.ps1
Targets
-
- Target EmuDeck.cmd
- Size 168B
- SHA256 e1e0c87545a48c95b8a2c0d4e0e15f1c7d2127c19ef0579b08e947a72e26471a
- MD5 d8de94c4971875b352de839698a778bc
- SHA1 d4a3a02523d8458d07dbd2b0b0986ade752f73b0
- SHA512 5adcb7c3f007defd470cc8dfdae3ee3433f6a77fdc3b0e76a1f4efb240ad970f88f31e09a0f5ea8db61d1e6b2022a5dd54241cbcc7c51ca64cd930ba235b5363
- TLSH T111C0C076C205DBFC0410C0CDD0385C80C11041906070D86253F8CC08CB44132B6D921B
- MD5 SHA1 SHA512 TLSH
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.