Overview
overview
7Static
static
3TurboToolsX.zip
windows11-21h2-x64
1App/AppDat...-0.dll
windows11-21h2-x64
1App/AppDat...-1.dll
windows11-21h2-x64
1App/AppDat...68.exe
windows11-21h2-x64
3App/AppDat...se.txt
windows11-21h2-x64
3App/AppData/put.exe
windows11-21h2-x64
7App/AppInf...68.ini
windows11-21h2-x64
3App/AppInf...se.txt
windows11-21h2-x64
3App/AppInf...sh.jpg
windows11-21h2-x64
App/AppInf...on.ico
windows11-21h2-x64
3App/AppInf...28.png
windows11-21h2-x64
App/AppInf...16.png
windows11-21h2-x64
App/AppInf...32.png
windows11-21h2-x64
App/AppInf...75.png
windows11-21h2-x64
App/AppInf...fo.ini
windows11-21h2-x64
3App/AppInf...se.txt
windows11-21h2-x64
3App/Readme.txt
windows11-21h2-x64
3App/license.txt
windows11-21h2-x64
3Data/setti...gs.ini
windows11-21h2-x64
3Installer-...68.exe
windows11-21h2-x64
7Password - 2026.txt
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/08/2026, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
TurboToolsX.zip
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
App/AppData/Installer-83.619.6968-0.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
App/AppData/Installer-83.619.6968-1.dll
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
App/AppData/Installer.83.619.6968.exe
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
App/AppData/license.txt
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
App/AppData/put.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
App/AppInfo/Launcher/Installer-83.619.6968.ini
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
App/AppInfo/Launcher/license.txt
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
App/AppInfo/Launcher/splash.jpg
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
App/AppInfo/appicon.ico
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
App/AppInfo/appicon_128.png
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
App/AppInfo/appicon_16.png
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
App/AppInfo/appicon_32.png
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
App/AppInfo/appicon_75.png
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
App/AppInfo/appinfo.ini
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
App/AppInfo/license.txt
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
App/Readme.txt
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
App/license.txt
Resource
win11-20260513-en
Behavioral task
behavioral19
Sample
Data/settings/InstallerSettings.ini
Resource
win11-20260513-en
Behavioral task
behavioral20
Sample
Installer-83.619.6968.exe
Resource
win11-20260513-en
Behavioral task
behavioral21
Sample
Password - 2026.txt
Resource
win11-20260513-en
General
- Target App/AppData/put.exe
- Size 8.4MB
- Sample260822-rxnvmafc68
- SHA256 c2814a5af7b14404b606e1e2eb988526e1d9d8f0d4839d70baa963779b7b9069
- MD5 d7c4a288d063917a6ba060bb7c55259f
- SHA1 d7383f5fbf5e96068a1dfd0cef4c41d06eec6cb7
- SHA512 7a57c1354fc706845e86e8a980c12e0425378904243b3a4f130791dbcb193a324f56aa323a731cb0db703a5ab8fe6281b6d267453a793db488b47396038d0b0d
- SSDEEP 49152:4PU+pr2U+XnS/FKU8ymWXLPPn5/1oUGds9zsAK7bWmCpd/8wc+zBXA3SzQWKewVr:4PUYinCLYbWbF88SmM0DpxF4WzEdr
- TLSH T1C3964A07EDA925E8C0ADD1358A729553BB767C490B3123D32B54F7282F36BE0ADB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-886037728.tmp put.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 put.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString put.exe - GoLang User-Agent 5 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 3 Go-http-client/1.1 HTTP User-Agent header 4 Go-http-client/1.1 HTTP User-Agent header 7 Go-http-client/1.1 HTTP User-Agent header 1 Go-http-client/1.1 HTTP User-Agent header 2 Go-http-client/1.1