General
- Target virüs.zip
- Size 10.7MB
- Sample260814-mpbswassa1
- SHA256 7951fff690eca2dd7c658cb396f162c66baf8eb6a6284d022e6d897933769013
- MD5 521d6eee3e2587b048670c49fb2b4d8a
- SHA1 0c2f5e922fe10fa3632dc58e4c69f3d90b143560
- SHA512 bcc458bca80a3e9b9d47a579086b82a1a0bce2d9e5a2f0ffefda8bfc1097ad583957cdf9d81ea203c660f1aa88413baadd4623d00458beef718e356c439d7ec9
- SSDEEP 196608:G+KhN0e3uHQzayvkbDFx93JDCJ0du9wQRQahcfIK6g8zebQ:jKrD3uqc3ppChaQRQVfIKDDbQ
- TLSH T15BB633687936D14DFACDAC7377E8894031ED86325B6356D0EEA417EC208F7BF0A9450A
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
virüs/main.exe
Resource
win11-20260513-en
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
virüs/main.py
Resource
win11-20260513-en
15 signatures
900 seconds
Behavioral task
behavioral3
Sample
virüs/virüslü kirüs/test-icin.py
Resource
win11-20260513-en
4 signatures
900 seconds
Malware Config
Targets
-
- Target virüs/main.exe
- Size 10.9MB
- SHA256 9d9965c5f9f5642f6f5660069a381e4536966ae7451f90229eefdff1fdd48317
- MD5 7ad1b586f1985b20bf775355b3be7e9a
- SHA1 2209605f22854373a4ebf1994f5725d7c5781289
- SHA512 05f22ab89dcc432bdfc4a17316016071edef69cdde7a5a8ff3a0eee5c6bb7bfcb57433081cd04d2466628c201aa92a2005273ca5f18668d7b546bf920b35478f
- SSDEEP 196608:BhHAEDKtbW897GJr1LDsBTG9WdEeukWWQGamR6O:LHFDK1S3sB1CeXWWQhnO
- TLSH T19EB63394736804DCF9AF623E69C4455353E1B43247A0CBCB5BF40EA82E5B2E9EE74B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
- Target virüs/main.py
- Size 2KB
- SHA256 ee7621433088e6e8ff7b492837365ee203e0f7fe7915e71c40cc339bd3ae1008
- MD5 deb672d1c3dfdb2a954b7fa2e8746d46
- SHA1 387ee1f99c1ee681cb73887c6396fb15ca047007
- SHA512 e5dc634329dc871c5df637db302d986c6dd3d039819cbb8c2577919599d295424fb9b2ace492a5ec66b58308a323e272f8cdacd2b8d3be97446b16e5741b4f8a
- TLSH T14E5122856E89A43C8B7646CEAA0F9079E35B522BB6727807F2DCC534DF6472043728E5
- MD5 SHA1 SHA512 TLSH
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
- Target virüs/virüslü kirüs/test-icin.py
- Size 4KB
- SHA256 786baffb7e42decb44b82760a7bfca106ba150c0f5612a3e4f4b9d0eb328b3f5
- MD5 7b874bd1979cfdff7a7f6d40af80790b
- SHA1 e4a27b26dc81c341db98effe9c336b9293f3c9d6
- SHA512 1999cdf04536aa0e6e3aaf402c80e74fa18c4550310f04c0dbdef756c5b12d7d41ad118e7ada6f29af5ba13de905fe1fa132d05ccc7139b017c7f5a01e56dbcb
- SSDEEP 96:feRp+rilolDIA/e1R4/Oq/iHf2A/yxssDj6Pc9EpOzwlsquiq4vQ:YloZD/PR/qb/yxssDj6PcsjlEiK
- TLSH T11E9173441C49A4BC803A8F996DC3D133D60C034B2F629C0BB96D8B752F7E5A356B67A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1