Overview
overview
7Static
static
3MaC.Virues.exe
windows10-2004-x64
MaC.Virues.exe
windows11-21h2-x64
MaC.Virues.exe
windows11-ltsc_2024-x64
MaC.Virues.exe
android-10-x64
MaC.Virues.exe
android-11-x64
MaC.Virues.exe
android-13-x64
MaC.Virues.exe
android-14-x64
MaC.Virues.exe
android-15-x64
MaC.Virues.exe
android-9-x86
MaC.Virues.exe
macos-10.15-amd64
4MaC.Virues.exe
debian-12-armhf
MaC.Virues.exe
debian-12-mipsel
MaC.Virues.exe
debian-9-armhf
MaC.Virues.exe
debian-9-mips
MaC.Virues.exe
debian-9-mipsel
MaC.Virues.exe
ubuntu-18.04-amd64
MaC.Virues.exe
ubuntu-20.04-amd64
MaC.Virues.exe
ubuntu-22.04-amd64
MaC.Virues.exe
ubuntu-24.04-amd64
Analysis
- user interaction
yes - max time kernel
12s - max time network
12s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 01:31
Behavioral task
behavioral1
Sample
MaC.Virues.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MaC.Virues.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
MaC.Virues.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
MaC.Virues.exe
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MaC.Virues.exe
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
MaC.Virues.exe
Resource
android-33-x64-arm64-20260708-en
android-13-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
MaC.Virues.exe
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
MaC.Virues.exe
Resource
android-35-x64-arm64-20260325-en
android-15-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
MaC.Virues.exe
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
MaC.Virues.exe
Resource
macos-20250619-en
macos-10.15-amd64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
MaC.Virues.exe
Resource
debian12-armhf-20260513-en
debian-12-armhf
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
MaC.Virues.exe
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
MaC.Virues.exe
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
MaC.Virues.exe
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
MaC.Virues.exe
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
MaC.Virues.exe
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
MaC.Virues.exe
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
MaC.Virues.exe
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
MaC.Virues.exe
Resource
ubuntu2404-amd64-20260127-en
ubuntu-24.04-amd64
0 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target MaC.Virues.exe
- Size 7.1MB
- Sample260820-bxs7cadj21
- SHA256 8d404cf95a672fccdc2b8c6a33df631e5739b63daf8bd2f0237c22f31405f1c1
- MD5 3179e15b85d678c903441ca9d2eda66c
- SHA1 50a6a3f9935e96a92ddaffbbe840db4b78002286
- SHA512 3daf2d7692dd9927db1bac0fe018ac9e4b96dbd518d13eb34083c85106f66497b83d7fbce898f3960af632449890f2366862b1a6ec32acb88ef86c425fed9d5b
- SSDEEP 98304:+fVXWQR3bGKp2dDwG1eFsr7/NPlcGxH0Ig17E3AAy5tx58D/SyPJT1bOFRqoSP:K3ygyDwGcsNtcGfcY3gt+J16FR
- TLSH T19E763378D3B80AE4EDA3543CC6D1442AEB6239AA1771C2CB03F056662F276D46D3DF25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 11 IoCs
pid Process 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe 4868 MaC.Virues.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4868 MaC.Virues.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4868 4900 MaC.Virues.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\MaC.Virues.exe"C:\Users\Admin\AppData\Local\Temp\MaC.Virues.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\MaC.Virues.exe"C:\Users\Admin\AppData\Local\Temp\MaC.Virues.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140.dll
- Size 106KB
- SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
- MD5 49c96cecda5c6c660a107d378fdfc3d4
- SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
- SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
- SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
- TLSH T1E5B37C4672A442F7D0AAD174C2E38A47FB70B4418B60A3CF03B58A650F63BE19E3D359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
- MD5 cf0a1c4776ffe23ada5e570fc36e39fe
- SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
- SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
- SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
- TLSH T133235CE157788046E4ABA5B0C1E7AE13BE38F6A24B50528F0B65D15C1F537D0B73D22E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_bz2.pyd
- Size 82KB
- SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
- MD5 4438affaaa0ca1df5b9b1cdaa0115ec1
- SHA1 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386
- SHA512 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6
- SSDEEP 1536:+O1z7poK78xa5yp6aclDqGihM8Vh948L5IsCVQ7SyhxG:31z9h9plDshvVhH5IsCVQk
- TLSH T139839DA3F76055B5E41BA27A99B10357D331FE49039093AFB748831B2F13B923C6536A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ctypes.pyd
- Size 120KB
- SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
- MD5 6114277c6fc040f68d25ca90e25924cd
- SHA1 028179c77cb3ba29cd8494049421eaa4900ccd0e
- SHA512 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d
- SSDEEP 3072:T7u5LnIxdP3fPHW+gfLIhAxKpemWtIsLPKlY:Tw+3FgfLIhFemWeY
- TLSH T17FC35B1B23541099EB67807CC9B35E17DBB1B859172087CF02A4CA9D2F637A36E7E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_decimal.pyd
- Size 247KB
- SHA256 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725
- MD5 be315973aff9bdeb06629cd90e1a901f
- SHA1 151f98d278e1f1308f2be1788c9f3b950ab88242
- SHA512 8ea715438472e9c174dee5ece3c7d9752c31159e2d5796e5229b1df19f87316579352fc3649373db066dc537adf4869198b70b7d4d1d39ac647da2dd7cfc21e8
- SSDEEP 6144:3V9E1CyOa72oP+pG1/dgD09qWM53pLW1ADDtLRO75e:jEgyOa72jw1/d4VVhLE5e
- TLSH T1D3445B66A2490DA0DE778474D89B4B57EBB278850350C2CF43A4CAA77F577A323BE344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_hashlib.pyd
- Size 63KB
- SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
- MD5 1524882af71247adecf5815a4e55366a
- SHA1 e25014c793c53503bdff9af046140edda329d01b
- SHA512 5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a
- SSDEEP 1536:nfKlLLgy209/MkZy6nR3JZlivy7OjZopRIsOI/7SyAxn4:fKBgy+IZlh7OjSpRIsOI/M4
- TLSH T1B8536C06E65540A8C97781B9D9A34F57EAF2F1001B509BDF4368C28D2F233C396FAB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_lzma.pyd
- Size 155KB
- SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
- MD5 737119a80303ef4eccaa998d500e7640
- SHA1 328c67c6c4d297ac13da725bf24467d8b5e982e3
- SHA512 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c
- SSDEEP 3072:2tZVL5rdV/REWWjAYyznf49mNo+RRApqc5IsZ1v8N:2tZV3pREMAYO+ElG
- TLSH T10AF33A92A394F4D5F7228C78D6624F27D7F6784A0310929A02CCC36D2B1FB759A2E717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_socket.pyd
- Size 77KB
- SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
- MD5 64a6c475f59e5c57b3f4dd935f429f09
- SHA1 ca2e0719dc32f22163ae0e7b53b2caadb0b9d023
- SHA512 cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973
- SSDEEP 1536:zbflGOzI+Jmrc0r3uj+9/s+S+pzpDAiTFVf78tIsLwy7SyJx+:V/IMA3uj+9/sT+pztAYFVT8tIsLwyA
- TLSH T1E6736A11A69010AAD2B3C17AC5635F23EB74F4C117D4978F5264CA5E1F23782EE7ABC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\base_library.zip
- Size 1.4MB
- SHA256 35ae97c810f9e58b13cfb1e596e458ee5fe52341bca4214757a5922eed9036e8
- MD5 2fc196b09a9a3d3fda727a27cad029ea
- SHA1 2c6dba385183c223bd35ec411248196e46770260
- SHA512 3ffd2ff0d54685204c0c892dd96da2e917286ef25641f3f721bf69345fbd94c800cb3656d7d3ae72e7ade5d1185d840bf116bf3dc9434f83e099fb86e528367b
- SSDEEP 24576:UXn3cnz/bucEvUFi8HH/QR5pJTv/RkeIPYdYfyM0iwhL:5QR5pV/Rdm6
- TLSH T1986509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libcrypto-3.dll
- Size 4.9MB
- SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
- MD5 7a6a8c2a8c379b111cdceb66b18d687d
- SHA1 f3b8a4c731fa0145f224112f91f046fddf642794
- SHA512 f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5
- SSDEEP 98304:OH+jTaoFABs2NPAE7uLcdKmj8waP31CPwDvt3uFlDC:kQ+Bs2NQcdKmj8waP1CPwDvt3uFlDC
- TLSH T161366A6AA7A80189E4BAC13CC9574A13D6F1F81A577097CF18A1567D0F33BDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\python311.dll
- Size 5.5MB
- SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
- MD5 58e01abc9c9b5c885635180ed104fe95
- SHA1 1c2f7216b125539d63bd111a7aba615c69deb8ba
- SHA512 cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081
- SSDEEP 98304:BBduVia4N3NWLvJP8IjF/d/aHMMwuPQyFF+RdioiZPbwappjDq:BBduVv4N3ILvJ8M/4wZy3+RdioiZPbwl
- TLSH T1FA466B22726584A0C97B8076EA2F8647D7A27C505F20CB0B6164B7D92F33B531EEF746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\pywin32_system32\pywintypes311.dll
- Size 132KB
- SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
- MD5 b108ecfa1fd82d3f55c0fdc84500f7af
- SHA1 f6245298569d262ac71105125380dff3768579a0
- SHA512 9da19975c46d2e49962237dd0998caebb087562e0e2d34a0d875abe18cdd8abd0503282aae9e50a2b5edcbd6586191f56f1610aa23917e70cd7a47bd32df8ca7
- SSDEEP 3072:WOppcCV+gN/23V2rxkq+QY/r06YrhY14eqjgEeqMbR:jpcu+gV2F2roQY/rktu4JgNqMb
- TLSH T120D33A47374684DAE936D37DCD671A02D3A2B0110315E3CF46A1C29B6F63BE5AD3BA42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\select.pyd
- Size 29KB
- SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
- MD5 653bdccb7af2aa9ccf50cb050fd3be64
- SHA1 afe0a85425ae911694c250ab4cb1f6c3d3f2cc69
- SHA512 07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277
- SSDEEP 384:dEeecReJKuHq1W57AvB0EZtIsQGQHQIYiSy1pCQvC5HAM+o/8E9VF0Ny5X3:XeUeJPHqoGDtIsQGq5YiSyvmAMxkE/3
- TLSH T100D28F97AB505C85D8238A71A8E64E17EA36B6664B10C2CF3358C15D0F327C377B73A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\unicodedata.pyd
- Size 1.1MB
- SHA256 b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
- MD5 1905b5d0f945499441e8cd58eb123d86
- SHA1 117e584e6fcc0e8cfc8e24e3af527999f14bac30
- SHA512 ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522
- SSDEEP 12288:P3EYbfjwR6nbsonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1JD:PUYbMB0IDJcjEwPgPOG6Xyd461JD
- TLSH T1EF355BC9BB828D66D87B31B944D2212F1361C273475B233BB65513285C8B3B74EE69EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\win32\win32api.pyd
- Size 131KB
- SHA256 cd52611ae8331959797d4a6e1087bdb4816a3ffabf97bfd135568786339a9ed4
- MD5 2e7d63adf3632a81f03cc363bd2124da
- SHA1 8407f8b634f63fa3cdc97516c0bc731380d357a7
- SHA512 dfe8bd48c0a99cbdb3c38333afa6c048e9ba755f08f422ebf90a767ccc17294329bce864f837bbbebb83e09ae9d817b70d13fefcd593dcc9995b6d400b9c8dc5
- SSDEEP 3072:zZPZxZPMhtrX+TXi3HlRVFhLaNzvrM7UbmwCiLNs94eB:FhzPMbrcXmHlRVgvrIUmixE4
- TLSH T162D30883B39410D6D82A96BCC4675B27D772B4240761A7CF0A70C28B0F23BE97E79795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\win32\win32gui.pyd
- Size 215KB
- SHA256 56c4284a00bc18e0a1b629cbf588d9bc1e25311b0bab771dceb37630903f7762
- MD5 cfbd5408237759bc3544c457b788fc1d
- SHA1 c0a5740cb0ebe1cf09321262d80ca6ae4a1de216
- SHA512 ce55f14034f0f0b5cc156b8105edd3c6031d5ddc7a2bdbae55a1a913cc3efdd61797056278b734875ada6e827d68f257e9b8cd43555c742fd512553adb96cd5d
- SSDEEP 3072:+WJ2iroOnrR2c+1jip8jo7jvALDRyZUoZEw9W0xV9:5J2xiMD1jiijo4IZUoZr9W0T9
- TLSH T1BD24E557B29510D5D86AA1BC995B5E12F1B374200320ABCF0630CBBA5F1B7EA7A3D7C4
- MD5 SHA1 SHA512 SSDEEP TLSH