General
- Target Carbon.rar
- Size 10.4MB
- Sample260822-lrm39axvgw
- SHA256 fb98662a602fba99ee0a93bbd1cd987b22baf0f2d9811a941ec0558ecc0bc6f7
- MD5 d572b7a14faf2c1a77d5dc03d451ddc1
- SHA1 ad552c831084ded1f35b4b62fe5bdae6cf0bf315
- SHA512 be4eb13ff5b5715ed3249a529fff66ed05c2baf5081854d38b697d85469203d22e2b1c9531913718620914d81092024f7bf43f669dca04d68517dacc2ace6701
- SSDEEP 196608:NB3mInbB37c7PRPoHykSHjMuPAL2F93Cf8Ln2j0OniBAhlI8X50:N4ibB37clwHyXHjMuPALG1Cf8rE0MJhS
- TLSH T179B6334CE5968290E6158E1BFA8A3968C6F24453BD77B9C1C2C7770EA5CFA0FD6047B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Loader/Checker/CarbonChecker.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Loader/Checker/CarbonChecker.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Loader/Debug/Debug.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Loader/Debug/Debug.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Loader/Loader/Loader.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Loader/Loader/Loader.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target Loader/Checker/CarbonChecker.exe
- Size 1.7MB
- SHA256 a0580084b05e47892997c88cf992a4a326c5eede2e87af5717d99731ee450645
- MD5 55ce00183e1df2683305238e788b6274
- SHA1 3140d7aa80646874ab15ae6283e7f51645b41732
- SHA512 695057b291e7c26fa8f46c05958e653d256df93c7a72df7c61622dfabffe644e65318ffafc1a611da6151b179ebe8c0a9d67aa8250171adee77a505692f9e489
- SSDEEP 24576:TmNNVDRKlmJMsCxeODS4SYpGBO5IsogsX+D+DOxrYn/BLfaIuN:cNhRKcPCxeOD6ZBs5xEnpLfuN
- TLSH T1A085AE05B7A442A8C17B90788886D63AE7727C161F2096CB23F41E673F676E05F7B391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Loader/Debug/Debug.exe
- Size 1.1MB
- SHA256 81b863aab2979e4e86e3157e2102a2bd14d5f98062fd6098bd50f303c89584ca
- MD5 786e6cd3772438f1373f203de55ae044
- SHA1 e5fd42bc773ccf6cf2efd0d8165cdfdbde7055c5
- SHA512 f698b9fd5ded0562f2ed7b6c284835d3dfd97a5150e3799bba74877f8ecdfe6dd3d1c1691575d3c15bf6b3c3764e52042a6055c12fed1a871f787c24c2ce7a41
- SSDEEP 24576:fR7Gau0x4z6KTyxkFTwxrkKhMiT3yCnAy6wwEaIuN:fR7DHKTyxkFTwxgK73/nuEuN
- TLSH T18D45CF06B2A542ADC01795388566E33BFB36BC1507315AD733E42EA77F635E49E3BA00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Loader/Loader/Loader.exe
- Size 9.5MB
- SHA256 be8b16fb43c09d61ba7d3d44cdecbb776972b03bf3651fdf82b8efa0b30effdc
- MD5 eb31c5547019f73a73b457f852d4a11f
- SHA1 32deea163d4fa73f2f81a05f1a75fd50c54c86f1
- SHA512 40b58dd996d42de05b515ab329144b24dc7a562ac96b1685c99c641744195c150d7bd84dbfdc7d76c6ef45837c7dc4d3e469b20f9d688c87fccba931c9edbdf2
- SSDEEP 196608:UyLgHGBesKKQuT1RItJMxqjxpLtPPqOCd6VlfuttvdDGoKDreeVt:UTmBeDZq1sJWADLt3q16V8tlDODKeV
- TLSH T14CA623BE65443398C41BC8755033ED05A2F6164E4BF8DADE72DBBAC03BAF8159A03B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10