2939810b20adeb5fa1b6e537fdc4d655fc21c2d3520f82826bdcfd0c224aea2d | Triage™

Login
Reports

Overview

overview

8

Static

static

4

ls.exe

windows10-2004-x64

8

ls.exe

windows11-ltsc_2024-x64

1

Resubmissions

11/08/2026, 06:19

260811-g3avvahn2v8

11/08/2026, 06:12

260811-gx786attdt4

11/08/2026, 05:55

260811-gmxpnss1cy8

Sharing

Copy URL Twitter E-mail

General

Target
ls.exe
Size 6.6MB
Sample260811-g3avvahn2v
SHA256 2939810b20adeb5fa1b6e537fdc4d655fc21c2d3520f82826bdcfd0c224aea2d
MD5 40a81d775a2e3310c269d4690bb56170
SHA1 3801a44d8c016e0c0142a3da457d9e9f8819bd8d
SHA512 80d3a7416d37cf80e64d3e42d5a01a3f208abeb0f178a411821741db171a009df8d4c0381bf969e6deef5f42ed8392b5da7aba1304badfe3b3156fb70ac5c22b
SSDEEP 196608:6Ug8dGoHfyxZoK9B24Yhzs82OptAHoDvSAY4ITuu0pUUWN9Zdf1aZ4xNs4fuF8/J:6kLHfyxZoK9B24Yhzs82OptAHoDvSAY1
TLSH
T12766E992F542EE50C4455E6A9D2AB9D453337AC6EF4B63363040BB3E28F35C2972D6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware costura defense_evasion discovery execution packer persistence privilege_escalation spyware trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ls.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

25 signatures

150 seconds

adware defense_evasion discovery execution persistence privilege_escalation spyware trojan

Behavioral task

behavioral2

Sample

ls.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  ls.exe
- Size 6.6MB
- SHA256 2939810b20adeb5fa1b6e537fdc4d655fc21c2d3520f82826bdcfd0c224aea2d
- MD5 40a81d775a2e3310c269d4690bb56170
- SHA1 3801a44d8c016e0c0142a3da457d9e9f8819bd8d
- SHA512 80d3a7416d37cf80e64d3e42d5a01a3f208abeb0f178a411821741db171a009df8d4c0381bf969e6deef5f42ed8392b5da7aba1304badfe3b3156fb70ac5c22b
- SSDEEP 196608:6Ug8dGoHfyxZoK9B24Yhzs82OptAHoDvSAY4ITuu0pUUWN9Zdf1aZ4xNs4fuF8/J:6kLHfyxZoK9B24Yhzs82OptAHoDvSAY1
- TLSH
  T12766E992F542EE50C4455E6A9D2AB9D453337AC6EF4B63363040BB3E28F35C2972D6C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware trojan
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

behavioral2

© 2018-2026

Terms | Privacy