3edb34f41711233f2693e9443708eeecb2438dd275678508c80844d8320d6620 | Triage™

Login
Reports

Overview

overview

8

Static

static

5

bdbak/Cisc...er.dll

windows10-2004-x64

3

bdbak/Cisc...er.dll

windows11-ltsc_2024-x64

3

bdbak/Conf...er.dll

windows10-2004-x64

3

bdbak/Conf...er.dll

windows11-ltsc_2024-x64

3

bdbak/Conf...ub.dll

windows10-2004-x64

3

bdbak/Conf...ub.dll

windows11-ltsc_2024-x64

3

bdbak/PopMgrStub.dll

windows10-2004-x64

3

bdbak/PopMgrStub.dll

windows11-ltsc_2024-x64

3

bdbak/Safelive.dll

windows10-2004-x64

3

bdbak/Safelive.dll

windows11-ltsc_2024-x64

3

bdbak/dfh64.dll

windows10-2004-x64

1

bdbak/dfh64.dll

windows11-ltsc_2024-x64

1

bdbak/j1wkYbo.dll

windows10-2004-x64

1

bdbak/j1wkYbo.dll

windows11-ltsc_2024-x64

1

bdbak/kwchtG94.exe

windows10-2004-x64

3

bdbak/kwchtG94.exe

windows11-ltsc_2024-x64

3

bdbak/micro.pyc

windows10-2004-x64

3

bdbak/micro.pyc

windows11-ltsc_2024-x64

3

bdbak/run_process.pyc

windows10-2004-x64

3

bdbak/run_process.pyc

windows11-ltsc_2024-x64

3

bdbak/tost.exe

windows10-2004-x64

1

bdbak/tost.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
3edb34f41711233f2693e9443708eeecb2438dd275678508c80844d8320d6620
Size 2.8MB
Sample260826-llbg9swdpf
SHA256 3edb34f41711233f2693e9443708eeecb2438dd275678508c80844d8320d6620
MD5 2cbf1d9b16d6980a9e42312c2e6646ea
SHA1 8db5ed47da7397d026485e1a6c359c7c1280f46f
SHA512 8c0e958e8cf885bc0951b7155e3c440a621850e99bcd5c88e696a9b28b159c02c7a9fa90557ab3c5e7a08847348307332277785934e83e6e4c3d9f580b11feef
SSDEEP 49152:evnT+Z3na9cPssv8+SdXzlvEbt+tZjp3xhIhP6yVjexRLq9GIe4eT0BTsMyE5TIp:efSZ3aEssPUV++tZrhIhF79zexT0BTpE
TLSH
T1C7D5330C8D871583DFC4FEB48FE80D0C6A7B35ADA716AA748B840B44538A5E797E174E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

bdbak/CiscoSparkLauncher.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

bdbak/CiscoSparkLauncher.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

bdbak/ConfigCenter.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

bdbak/ConfigCenter.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

bdbak/ConfigCenterStub.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

bdbak/ConfigCenterStub.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

bdbak/PopMgrStub.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

bdbak/PopMgrStub.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

bdbak/Safelive.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

bdbak/Safelive.dll

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

bdbak/dfh64.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

bdbak/dfh64.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

bdbak/j1wkYbo.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

bdbak/j1wkYbo.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

bdbak/kwchtG94.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

bdbak/kwchtG94.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

bdbak/micro.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

bdbak/micro.pyc

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

bdbak/run_process.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

bdbak/run_process.pyc

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

bdbak/tost.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

bdbak/tost.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  bdbak/CiscoSparkLauncher.dll
- Size 81KB
- SHA256 edb7934bdf74a9bba1b6e466fec58e3b3e16fe458bfa93f87743a7acf7ef9f22
- MD5 74282dda94d99076b95cf4635e41b5d1
- SHA1 aeb397402c05103be8814bcbc052e7ed917d2855
- SHA512 8fd3ee30076a87b395729588c3719f65890aacc8ab26c7cd7bbce95f3746ac0e4f1f9cb37773dcad9812e6926a3a7740b1810de13badce49b5d17c6bdec8f881
- SSDEEP 1536:FByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WH:Av4JKXTx71wnArSsXFpeXq8WH
- TLSH
  T1DC835911B6D1D075EDBE29355424DAB14B3EB920DEE1DDAB279A066A0F302C0DE31D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  bdbak/ConfigCenter.dll
- Size 524KB
- SHA256 f081baffabb2f30520b57cb4a1a8b2eb80962d640abc47a4cf013d242a68c6a4
- MD5 e74aa202f755af1a36f62b5979a99035
- SHA1 366bb6676fe7f5642c35c721eabeaa897cd7b717
- SHA512 b8aee74a80c7c38fa98beefdb86b64aeb9c617af239da899c11a5e61af3553a148eec22ba21f3b11fae77b4348acdc9dceb1ad2a3a0f464dc08e8be7dfddd1d9
- SSDEEP 12288:WTHe2kCoVa9B57vfLLh3uCNhYd8jpf9NBe78MC:Q4ab5MMh5FwC
- TLSH
  T11AB47D207546C136D5BE11B0593CCE9F246C7E700BBA54DBA3E82A7A5DB04C39A31F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bdbak/ConfigCenterStub.dll
- Size 240KB
- SHA256 69dd630c518faf319900e83c47dbd9fc7dd8bb3e9b181d09d2570c41efad1bc6
- MD5 d6efbf167b734c90d769eabdf0605af6
- SHA1 d4f923a614d0f3814ecc8d48930bca99151d2d75
- SHA512 408907530dc818549d4cdd952449217d3211703ccf451ed454d6a1c4728ddaf3f2f714563a56b7d8b480c682704e813270a30804ae0254be7a08484faf6b7355
- SSDEEP 3072:cukXjvByofadSl3kuio7x3zBgIp7q5Uk7HNBD+V5OAFlZodzqih9qlb/NTTIxhmz:cukXjvdfad03kudN+ce5Uk7HD8n51cxs
- TLSH
  T126347D603985C432D9BE06306979DB7B497CBE304FB4C5CBA3D84A6A5E311C26A35B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  bdbak/PopMgrStub.dll
- Size 1.1MB
- SHA256 b94f0d12842a3e06dcc6101d3f00f909fc5c48b2a0aad1db453235ef2fa99f69
- MD5 abc7ea24691e991e329a2e0cbd8b5848
- SHA1 1fa1d66246ca540e9316dab093cc56214604a62c
- SHA512 73c15cc5b748959461484ff0a9951388655ff1f0823240877e7f79754a1fb383119491ce17711c121b938fbd32cdcd5b3628d39f5471d06ea9205c258df6215f
- SSDEEP 24576:ShFlejaEX5ZYmRN1CKKh9CoK3OfkzxvD56Dek80DVpt5GwmvVi7b:Sh4V5ZYiqLGLvVi7b
- TLSH
  T158356C213615C036E9EB11B16D3DEADE459D6E610B6144C7B3D82F6EA9301D3BB33A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bdbak/Safelive.dll
- Size 459KB
- SHA256 032342565c13cc65ad6150113f80b4a3885e3f775077cbfdbfbc0374a7864d71
- MD5 e5b8cee534558d9ea8f68ad45141cfe2
- SHA1 8f5f5a71ff326f620aa13b5c7a8a4a5d9cecab01
- SHA512 e8f43238cb3c466c6fad05204886ca04ccd81dfa1fbfed1f17943201a0d1d719955f462b18c7bca86630b149b9f865af43cc93cd8f590cefcb4366a460b2e769
- SSDEEP 6144:uAm5FXnDWJ7Qbn2so+Qtc3aPNuX+PEg2RqqoIKW9gYefm9CqrOAO05KuRrVoDWR:zCy1Q6Zt26I+PEgiobZfm99OXkrVoDWR
- TLSH
  T141A49E117682C071D57E02306968D76A1ABDBE304E7C959BE3C8563F2EB05C1AB38F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  bdbak/dfh64.dll
- Size 124KB
- SHA256 0612c48b750998e448fdf43c3d786d59c1f7c1d074566a93151a134906dc7f90
- MD5 0ffeeeba74a6901fa530b0fa79e7dfe8
- SHA1 2829be20d09ab95ace2db1d58ffb9756fcc311ee
- SHA512 aa06e5dbb60ab8fbf00165935a94277fe585d8576b521a8ee87d5b06d58f66b45beea3f324265473af9311c4da9d5a72293b64a177d41d1d749ad379e3dc4980
- SSDEEP 3072:GtFXmyegJuwKmzm0GKd2jy6KIuD2onR81:GnPegJuwKmSwd2lKIUC
- TLSH
  T168C35B4B73E940BBE16B8279C4630A45E776B8114B60AFAF03B047561F237E19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  bdbak/j1wkYbo.exe
- Size 128KB
- SHA256 d7a3c7423a79fa89fc8cee1a0eb0869ae6be13eeeb1d7aea432d1531a6a76df5
- MD5 71755dcb10fae97f29064d32d5e88240
- SHA1 4407cd0e20b9ed05958c107fdc0c5685970353f3
- SHA512 77f577da2d9d0576f6492e6de77ea22bd4435a7887157b160aa50595fdef9f75b3dd70603410f1ede231dee7d5e1643ebc26b09b9b66e81dbc89e8b9082d4726
- SSDEEP 3072:3D0TWVxagiZg4NIh2/YC51HYCZMTB7t10gQpy1:3DgWXHCBN+2N1szyy1
- TLSH
  T104D3480139D1C472E5B219315920DAA45B3EF9114E31DA9F37B81E3E5F7C7C29A28E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bdbak/kwchtG94.exe
- Size 1.5MB
- SHA256 49710ccc6ca0cd72affa0d423d97a568e177a51fdf01aa723d5f86585ae2f1dc
- MD5 0e43b5eb2f1f23c184a6d2db0b352642
- SHA1 22a65b571b68d79fb6817b87829ccd968549fb23
- SHA512 aa6e447b3ef1aa2d50514f60e1fea62c13a799fadf5a3ffa7f786b56506f088f59b73240e3a934f58d465633d762ebef24f47494cd3caa91750bbe6d21f7f8bb
- SSDEEP 49152:dpdlghXgOVb8xtjkAz9U0XYRd0zb78N9hQsLXA:BlghHBAZgH0UhPA
- TLSH
  T19F7523399FDE51D1D7DA1A34EB5B118B37F4D00542B9883827C92842F463F27B2A7A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  bdbak/micro.pyc
- Size 3KB
- SHA256 1932ef5c4ca8ca09b6a057e95340fe2f34bbfbe42e35c7d0f8923e4bae2402fc
- MD5 5b00910114f8ebd16c998fd9289950a4
- SHA1 67f0cb07edaa0d9e701e28e4144bae8aae93731b
- SHA512 da49c051fccd8c5df5cd9955880a513856af495645d7e718e12d6830cc9e3789bcd74a7ffc8fac1301a796f3b7c7602e5f146bcaaa517f3adce687ba5ff8b3cb
- TLSH
  T1E47184E2CC4F4F5EFA76F379C0AD0204DC5157E9938988265B04919B3D0A7A8DDA468E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  bdbak/run_process.pyc
- Size 3KB
- SHA256 18d500f605c6b0894282675777e7b74381d62cf24266ffc13daac2155892a9e0
- MD5 6d2a2655fd8db09090dd0b3e6fafcabc
- SHA1 f9dbf558c7ea1878c3c13154ab7b232c8586e731
- SHA512 449316a9a2ed196e6399e8fa2d5d2c7a4833cd08aefc7c2216d5724435d1e0c32debc1c242f8e0e7432aacb6a4d4142ebcef8d91b33767c60b25ac876f1a007a
- TLSH
  T1406175E0D5168776F9A7F675981E02128AC4DAB9C2E5D1331B0CF6AB5F09784947038D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  bdbak/tost.exe
- Size 182KB
- SHA256 4a9d44d92ca990e7341f7881e88bb1ab13367c9b6d93944cf9dd22fe224b328b
- MD5 87eb92c245f9322bf3c0d6005170a0e2
- SHA1 d6865457cf53d3d1c8821c1eed89a1f5641d8598
- SHA512 176f9ee19d9a19eae3483495dd2ce83f6645a2a2adf65a26a9af86cad5eb4e9236184ef17ce26a121a7fc222e7284618ff31ea1b7d910d3c69eb91b4292b9909
- SSDEEP 3072:UJ4AY5DCV2S/TjiPnYUJ5npAqtxqP4m1Fs0VFVUKB6Xs18N9G9GwTcbcVy9+4zB8:s+2Vd/Tj6nYXqtxqAYFLVFVUfsGNkkwx
- TLSH
  T11A048C5EB96290F5E4378178D4A65B3AEB3330152330A6CB1624EB394F377C61A39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

© 2018-2026

Terms | Privacy