Analysis
- geolocation tags
cacanadananorth-americatoronto - max time kernel
30s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 00:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AtherLoader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
AtherLoader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
30 seconds
General
- Target AtherLoader.exe
- Size 2.0MB
- Sample260817-an6weacl91
- SHA256 6abd666445e89a52d93c95f786b6390ac0fe9dbfb496d01f3aa11a5707a86235
- MD5 0e41f37b4db129e3e8fffab817b51389
- SHA1 6c8dfa8c4d00b2a0de26d988d5184a612cbc79ed
- SHA512 60d92f14aecf78e22d0cb2091f9ae5467ef13c666f72b487c3389e7eb3034aec6abbe3373d8c446944b0b64530db7045759aa8306ea100bfed9513a70761bcdd
- SSDEEP 49152:uF/nX4oW4ogx9ahg+m/ErmnRSJtrBmO7iR+O:nzmyJ3t7K
- TLSH T149A5AF42B7DC4249E02779348B92AA1BA23374240B21D2DBBF64155D8F7B6F0CB7BB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5808 AtherLoader.exe 5808 AtherLoader.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe 5808 AtherLoader.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5808 AtherLoader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5808 AtherLoader.exe