General
- Target Civ.exe
- Size 15.2MB
- Sample260816-l4fvpsvepf
- SHA256 38c14ff5be7061d2100fc7b76df423b10d6f37a2bc40f4e7c1faf3bce7700b0c
- MD5 8bc969aa528b02dcc2c9579cc562c003
- SHA1 8e495a64bc76895f24faac8273d9eca884b244c3
- SHA512 709b5ebc6ff274c108d467fcf33e37a5eae3376f549b068aa36c47c8526d25cd92efd4428d3dd3c0d058be265189ef46a91dd435990be19ee889592ef5642ab9
- SSDEEP 393216:JjBMuwGaa5wEMiuHCl4uCzhHTodRGkXh4FLMTAqdUUBv:/uaGziuilVC90LhXqg9zB
- TLSH T181F6336D22D006B5FDF6A8389A129364B7773C521320C26F47DC8B517E7B1B43A3A1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Behavioral task
behavioral1
Sample
scan.pyc
Resource
win10v2004-20260513-en
16 signatures
900 seconds
Behavioral task
behavioral2
Sample
scan.pyc
Resource
win11ltsc2024-20260709-en
4 signatures
900 seconds
Malware Config
Targets
-
- Target scan.pyc
- Size 40KB
- SHA256 f727a8c13ac4815d2095e1b27e3f4bcf043a4d64fefcd45e544865bd7ba74d90
- MD5 dc0b4ca1d3c669e5d6971a3837adefe6
- SHA1 39e2850904f9d80ea8d0cfd28f6be75512c5455a
- SHA512 56e6fc771e29a45c7e587b1d43436675bcaf54a59ed3af2f18296a1e3c127e07958d13e2e787dd8401b12737c93aaa52866db8a439948767b8f9d18f03069391
- SSDEEP 384:jnSNP3kHMaQ2JlXts+Nn+ixDf5zMz8yJLNoE14fcaNLbwC50WRQur8kVpT4a/o:I0HlN+iFf5G8ULN/PSLb2WedkVpTLo
- TLSH T167136165A352C33BF540F8784A706B6BB77591B0F601830375EBE0B42EAA560FD164ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.