General
- Target support.client.exe
- Size 305KB
- Sample260811-trkbcsttct
- SHA256 eed03a1e011650d505e7fc11aa99f8043ec23ef5d606e7933e2a7c9fc89613b5
- MD5 fd6a57fb788855f8983329e20e29c140
- SHA1 ed7f20ab1c9e0f857007b7d08f6e6112c00b2757
- SHA512 b224bb0e6e5aaa48e8fdef158f30ca1ccab746f50e2ec267738beccceaffc290fd11f6ec28eead71e41e2e816e823d2137b0125ee1e83625b06de47f7ce2645d
- SSDEEP 6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9
- TLSH T1F9647D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
support.client.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
support.client.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target support.client.exe
- Size 305KB
- SHA256 eed03a1e011650d505e7fc11aa99f8043ec23ef5d606e7933e2a7c9fc89613b5
- MD5 fd6a57fb788855f8983329e20e29c140
- SHA1 ed7f20ab1c9e0f857007b7d08f6e6112c00b2757
- SHA512 b224bb0e6e5aaa48e8fdef158f30ca1ccab746f50e2ec267738beccceaffc290fd11f6ec28eead71e41e2e816e823d2137b0125ee1e83625b06de47f7ce2645d
- SSDEEP 6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9
- TLSH T1F9647D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Executes dropped EXE