5477ccb668192b8268a54e29d84e5594ddcec114588307cc871ba6d0ad70bf07 | Triage™

Login
Reports

Overview

overview

Static

static

3

Password.bat

windows10-ltsc_2021-x64

Password.bat

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
1.zip
Size 11.2MB
Sample260822-vaqbqaff37
SHA256 5477ccb668192b8268a54e29d84e5594ddcec114588307cc871ba6d0ad70bf07
MD5 e3289841778ac7eb6e8fa7d6ed85caa2
SHA1 154bf2ece29f781167317227af125bb7565ad026
SHA512 229605a0dd78c0d9ea7d748675f868bd5642a89df1f7677ff5696ea246123ecf43d6e31b853d555da0c87f825a55d5857d31e5bf62b9634388d2364f5339a181
SSDEEP 196608:DDmySDi71gqQQL/iDg0a8EwQpK/TwSeXz7/OzuEjYBfCnCVjBjdodWiTPow:DDPiQTiDfa8LQpg8f/dT3VdjdsWi0w
TLSH
T12CC63361D9D7F4AFA0A7B11FBE44F3604C4F63643DB520EE9CA32096483F909E58E168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Password.bat

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

16 signatures

300 seconds

defense_evasion evasion execution persistence trojan

Behavioral task

behavioral2

Sample

Password.bat

Resource

win11-20260513-en

windows11-21h2-x64

16 signatures

300 seconds

defense_evasion evasion execution persistence trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://protoolskit.net/svchost.exe

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://downandgo.com/svchost.exe

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://softroma.com/svchost.exe

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://drsofta.com/svchost.exe

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://justrevealing.com/svchost.exe

Targets

- Target
  Password.bat
- Size 110B
- SHA256 cd312a716ac0663c9372e0582bb556bcd1aaa1b12a2d6171d6f20df069a39d31
- MD5 5533aa924862838fb7d56f91f34f62cc
- SHA1 69214565c9777a3f3b505b9f8f1afe74aeea7b18
- SHA512 dea3b9187d2880c40127141fdbf281a7ca5e16e7e1fa3cb30d86942530bef7691f4dab44bb07e4c336b5049291eae21d908e9b797ce037cde731d0f3ecb2d24a
- TLSH
  T111B0125F81933580975325808B2669503B8F506F43CBB3C23101EDCA65501BFC1E4CEA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion evasion execution persistence trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionevasionexecutionpersistencetrojan

behavioral2

defense_evasionevasionexecutionpersistencetrojan

© 2018-2026

Terms | Privacy