General
- Target CWTool.exe
- Size 23.1MB
- Sample260815-ln8wjstcpe
- SHA256 eb845e14426959630abe865e8f135f0284f47ba55308d61da50c127c579896dc
- MD5 4c111395218c11cd8c72a00ff886becf
- SHA1 f243a6b056e7e4cbf82c58997044aef26f891364
- SHA512 a5837d8032c6fc48c27b3b5cb84d30b67ea4ad2e8535cffd08b14f53c8d03aae9dc320ccd278f736bad8115ab5d2645eab676ec078a3203cb4dbb74449a71487
- SSDEEP 393216:uxiLoK5HG5roEAmURLAhCZLrUZtZq5XpnsatHsxGEDweEXdK2D07vlaoa:uAFGxodmUJAuLrqtZq5aa5wG7eOLDMa
- TLSH T1D837336DA3D0156BD8DB913996E3C3B2F7B1A2112721CDEF0B59133A2AA34D1053D3AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
CWTool.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
CWTool.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target CWTool.exe
- Size 23.1MB
- SHA256 eb845e14426959630abe865e8f135f0284f47ba55308d61da50c127c579896dc
- MD5 4c111395218c11cd8c72a00ff886becf
- SHA1 f243a6b056e7e4cbf82c58997044aef26f891364
- SHA512 a5837d8032c6fc48c27b3b5cb84d30b67ea4ad2e8535cffd08b14f53c8d03aae9dc320ccd278f736bad8115ab5d2645eab676ec078a3203cb4dbb74449a71487
- SSDEEP 393216:uxiLoK5HG5roEAmURLAhCZLrUZtZq5XpnsatHsxGEDweEXdK2D07vlaoa:uAFGxodmUJAuLrqtZq5aa5wG7eOLDMa
- TLSH T1D837336DA3D0156BD8DB913996E3C3B2F7B1A2112721CDEF0B59133A2AA34D1053D3AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.