General
- Target Crack Fix.zip
- Size 10.9MB
- Sample260813-lp4yzseq6t
- SHA256 47c4cb1c4b99b62529c20060159a6ba5e29253eb565b7b37ec4ed2003a08cb5b
- MD5 18fc1164ea0b55a1850ddce0ee0887a1
- SHA1 9b00cc35b1010a474ea8439c6b2431a4f4971e8e
- SHA512 9ca233c2ae0e125786b91c0fe70b9e0458a420becb06db83553903a7b1cb854396a6e2a9928e17570cbb64420d02a8e022f806741a33d549d5d3010196c82cae
- SSDEEP 196608:/vgzo6mSpOL/89mfITwluua8LqGbHiXovaunbPu5/FZwY3glooaqJlSJkU+KusWA:/vEovWUk9mQT+u0IiE9ZwY3uq3nusWyz
- TLSH T187B6334DCE409F1EDE26C330DA6DE5FE6200CEB98AD451B759EB194674BB31C437A282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
freetype.dll
Resource
win10v2004-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
freetype.dll
Resource
win11ltsc2024-20260709-en
18 signatures
900 seconds
Behavioral task
behavioral3
Sample
xzblib0.dll
Resource
win10v2004-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
xzblib0.dll
Resource
win11ltsc2024-20260709-en
2 signatures
900 seconds
Malware Config
Targets
-
- Target freetype.dll
- Size 345KB
- SHA256 1564976acd77fce6ee578d2949085d578c9bc223aea746afb62d0f8967ba3e64
- MD5 8bf1bacf102eebec360fc0c3fd0280e2
- SHA1 3ef95ea05bc51b252f1d33157a248218052c2d55
- SHA512 7a15934643fc8445ff873821770622f4bdac73ad11eae5462a4f30177ed8d015f2fb65210610384f0b8cfe84a8bb6e9e69399e865bb7949deaa59dd1fc288071
- SSDEEP 6144:VBP+f1qncfZgVffkzl/dtkSYGyv0dHbFG1iHDeCutKZLqvlw6ChcJp/8uxllP9qZ:3PoUsiAbGSYGL0QHyCuCLKXChcJp/z1e
- TLSH T1E47423E96D9A0C9FD2E79C75BE16C36230170D1200CB5E8096ED0A4DADBC5938D8BF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target xzblib0.dll
- Size 11.7MB
- SHA256 c67a1b2a7a79357e12d85dd51ebb7b54cf53087e45268b8daaaa7bc4147c3c40
- MD5 f20da3f165d0b00a95e2646f0325abe3
- SHA1 6b2503d6fda9f86f312fd6dd87f85755899d2e04
- SHA512 6cafc0d713e2e045bd72d4372d7d5b33f1040488ec7ad0fdd62a99c0b45298a1a34b5b44893bb2fb68946e8ed9a5efdfa00d46e5060dceb690549b7be97b09a6
- SSDEEP 196608:ktzlNvUqsLfeXITy/2nu6q8hqEjvOrKfwuvzVqp5CzsyxfQ0ucSdn4aPQPhkQQYP:e5NvdKWXIu/4uo2A+i40ucSiaYPGQQ5a
- TLSH T12FC623DE0BE552B8D0934610628A939A74C1E65D42FD0C3A3DDB2C06A71CD7A618EFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger