General
- Target dll.exe
- Size 32.9MB
- Sample260823-axg9ea1eng
- SHA256 85c671370fdca9874db8f56081d8069be21ac0195af2267fc1bbea2d5739c3e6
- MD5 565d28c1cda1031ba967eaaced566f24
- SHA1 eebe1b1d6f3d419b88c1778c208529d9aff8e38a
- SHA512 0e3be54d6f35f17b88c57f9a893e6341ea0c8cd2cdef4c17c32795b0b5e99713b45f8fed57512b8168ccd3681d8febce5ded0c8abe6cf89cc588645f8e301cf8
- SSDEEP 786432:+5vzd21nbhVEHCYFqSSjkLZIHLOSuXMb8O2PBD+gEwLKbuLz5HMLyRtDUW:+9zM1CuHKpcF+BDO0mufl
- TLSH T12577336563B6C0F6E8F305314A8B45D4B727BC545B60D9CF4AA42A332E731A06A3CDF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dll.dll
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
dll.dll
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target dll.exe
- Size 32.9MB
- SHA256 85c671370fdca9874db8f56081d8069be21ac0195af2267fc1bbea2d5739c3e6
- MD5 565d28c1cda1031ba967eaaced566f24
- SHA1 eebe1b1d6f3d419b88c1778c208529d9aff8e38a
- SHA512 0e3be54d6f35f17b88c57f9a893e6341ea0c8cd2cdef4c17c32795b0b5e99713b45f8fed57512b8168ccd3681d8febce5ded0c8abe6cf89cc588645f8e301cf8
- SSDEEP 786432:+5vzd21nbhVEHCYFqSSjkLZIHLOSuXMb8O2PBD+gEwLKbuLz5HMLyRtDUW:+9zM1CuHKpcF+BDO0mufl
- TLSH T12577336563B6C0F6E8F305314A8B45D4B727BC545B60D9CF4AA42A332E731A06A3CDF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Loads dropped DLL
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.