General
- Target CrowControl.exe
- Size 76.5MB
- Sample260827-s3w9maxcna
- SHA256 5678b3ac7d878d6265051a4f7148db4bf81a64ea181bf47978a748900515754f
- MD5 fa33d32c87962d57756c1e144dfbd9fc
- SHA1 61351425bdb009ec590facd07647642127ad5424
- SHA512 405f9b4cddb9810a060869f710115d14a3cf6064a8f02d90b7905fefdcfb7c4288c952efd00327cc6e4dd9aca462d76f4f5e6a591c0cfe48a3b589a4f1fee743
- SSDEEP 1572864:5KXzjvUMOtMWaRQ+dy2J0f0/rBdsG7bpip0WWdiIkK4cNpZ7yQq5qq:wXPUX2jRQI5BB7tE0WGN4cvZyQgqq
- TLSH T1900833059912569FF28DA737F2E2D92F3BD3244B8659C1C91BD00E478B6B1C9DE78C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
CrowControl.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target CrowControl.exe
- Size 76.5MB
- SHA256 5678b3ac7d878d6265051a4f7148db4bf81a64ea181bf47978a748900515754f
- MD5 fa33d32c87962d57756c1e144dfbd9fc
- SHA1 61351425bdb009ec590facd07647642127ad5424
- SHA512 405f9b4cddb9810a060869f710115d14a3cf6064a8f02d90b7905fefdcfb7c4288c952efd00327cc6e4dd9aca462d76f4f5e6a591c0cfe48a3b589a4f1fee743
- SSDEEP 1572864:5KXzjvUMOtMWaRQ+dy2J0f0/rBdsG7bpip0WWdiIkK4cNpZ7yQq5qq:wXPUX2jRQI5BB7tE0WGN4cvZyQgqq
- TLSH T1900833059912569FF28DA737F2E2D92F3BD3244B8659C1C91BD00E478B6B1C9DE78C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1