General
- Target RoPing.exe
- Size 30KB
- Sample260819-ved49agc84
- SHA256 d8f68b8a83501d5aec828bb8fd9a7ff51b9b13526387e5715cd64aa4e07a0e44
- MD5 e41963942b1d6b3b4e3b244778f106c4
- SHA1 4b3090a5faec4125b4f5c6a89eb019778702615c
- SHA512 788c71ad3c00849e706993b075d661aec33c92da607cf6de0daf610221beeea55dae9caa1941912d30eced9699a2d1bdf4f2b673eef1fa7f7f20653f60873c2b
- SSDEEP 768:EkNpZKv1DzDPlcBpLh8eqfjI0etkdFtQoBA9Wqv:pNp8vdlopLh8eqfjRetkdFtQH
- TLSH T1ECD229BE734756EDD506C438CCF6E335D9A0BC820A38513EE3D0DD634EA96409678AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RoPing.exe
Resource
win10v2004-20260513-en
19 signatures
60 seconds
Behavioral task
behavioral2
Sample
RoPing.exe
Resource
win11ltsc2024-20260710-en
7 signatures
60 seconds
Malware Config
Targets
-
- Target RoPing.exe
- Size 30KB
- SHA256 d8f68b8a83501d5aec828bb8fd9a7ff51b9b13526387e5715cd64aa4e07a0e44
- MD5 e41963942b1d6b3b4e3b244778f106c4
- SHA1 4b3090a5faec4125b4f5c6a89eb019778702615c
- SHA512 788c71ad3c00849e706993b075d661aec33c92da607cf6de0daf610221beeea55dae9caa1941912d30eced9699a2d1bdf4f2b673eef1fa7f7f20653f60873c2b
- SSDEEP 768:EkNpZKv1DzDPlcBpLh8eqfjI0etkdFtQoBA9Wqv:pNp8vdlopLh8eqfjRetkdFtQH
- TLSH T1ECD229BE734756EDD506C438CCF6E335D9A0BC820A38513EE3D0DD634EA96409678AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1