General
- Target emi_client.exe
- Size 4.9MB
- Sample260826-shetvayvay
- SHA256 0c1991c9448d2d2403707f21ac7550d72ff750900bb101f0f82f0fc165a8ba05
- MD5 7d4ca00fb1a0ea8cd8070fe4c5bc5540
- SHA1 6f16aea08167ab21033503868634ca6fe91e9274
- SHA512 b75f5a44eed190663efa90276a1ea0c97d54d87c1c38db2fe70e5102bbc9486c296698174388d6b67d85ff563c279c2ee1ac307014c865515cd2fa06e3b0f4aa
- SSDEEP 49152:p+vqbdHihq3F47CXXSOEqNCpdXnkwHgPvNxdgCJ7z+itX5BVQ06dk0eDcIWAGzTP:6qt43RCJX+aRGFzj9Mx
- TLSH T1C2361822BB6A98ACC89AC0B483964B72597134CB0F3579FF448456383F69AF51F3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
emi_client.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target emi_client.exe
- Size 4.9MB
- SHA256 0c1991c9448d2d2403707f21ac7550d72ff750900bb101f0f82f0fc165a8ba05
- MD5 7d4ca00fb1a0ea8cd8070fe4c5bc5540
- SHA1 6f16aea08167ab21033503868634ca6fe91e9274
- SHA512 b75f5a44eed190663efa90276a1ea0c97d54d87c1c38db2fe70e5102bbc9486c296698174388d6b67d85ff563c279c2ee1ac307014c865515cd2fa06e3b0f4aa
- SSDEEP 49152:p+vqbdHihq3F47CXXSOEqNCpdXnkwHgPvNxdgCJ7z+itX5BVQ06dk0eDcIWAGzTP:6qt43RCJX+aRGFzj9Mx
- TLSH T1C2361822BB6A98ACC89AC0B483964B72597134CB0F3579FF448456383F69AF51F3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Adds Run key to start application
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1