General
- Target NullCore.exe
- Size 225KB
- Sample260819-hr2d4afk9v
- SHA256 b048b0030f648b61ec484b63e910bd6505c09cabd246360525f01bbe1a648b1d
- MD5 1af6f2817210465c72d3c8db7eb5fa5d
- SHA1 2c751de552eb9089b25e21234f7a59ca3bac2720
- SHA512 28242b935647b8025c07f415a05aef584ac03311198165a8cefa661248822180ebffb4912332b4192d4e171fc6b010125422e4ed659fbd394c969264736d8fda
- SSDEEP 6144:IJH7JNtMp+B63cztVqMj3mqCJ2ktCC63LzxzMfZR7BwcPsbWl3ojx:4H9NtMkBsOtVqMbmqCJ2ECCsXxzMRFsj
- TLSH T17134E602454C8465D362A938A8A60A41B7F53C95C7BCDFEF27F04C790FA7AD0793EA91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NullCore.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NullCore.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target NullCore.exe
- Size 225KB
- SHA256 b048b0030f648b61ec484b63e910bd6505c09cabd246360525f01bbe1a648b1d
- MD5 1af6f2817210465c72d3c8db7eb5fa5d
- SHA1 2c751de552eb9089b25e21234f7a59ca3bac2720
- SHA512 28242b935647b8025c07f415a05aef584ac03311198165a8cefa661248822180ebffb4912332b4192d4e171fc6b010125422e4ed659fbd394c969264736d8fda
- SSDEEP 6144:IJH7JNtMp+B63cztVqMj3mqCJ2ktCC63LzxzMfZR7BwcPsbWl3ojx:4H9NtMkBsOtVqMbmqCJ2ECCsXxzMRFsj
- TLSH T17134E602454C8465D362A938A8A60A41B7F53C95C7BCDFEF27F04C790FA7AD0793EA91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1