General
- Target WINchanger.Loader.exe
- Size 9.3MB
- Sample260829-ph1jrsyfkd
- SHA256 bf4b81e76904b2741c732c36a9ca89c672ddf12d8ef61fd69119d08dce3b86f8
- MD5 97ed79409832e17627de992b5974f1b8
- SHA1 cd602dec140e1e393c1c254134a74db196c9c647
- SHA512 0fad40e4bdc923c0313a091e9082dc4f13cfda3c06aff197130b74621d0f469da08be6c699a8562295c0f4c8706827db113846fbbbd8f7ee46011fd9a9dd41b7
- SSDEEP 196608:PeYlWK8UngBwWlVYC9vC3p0KTwpdyu2B7C8wbHvEspF:8Un1WoKv5SwPR2U8wrEGF
- TLSH T11DA6F159719800F8C0BAD179DA47691BF776389807319FFB16E05A562F636E0AB3FB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WINchanger.Loader.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
WINchanger.Loader.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target WINchanger.Loader.exe
- Size 9.3MB
- SHA256 bf4b81e76904b2741c732c36a9ca89c672ddf12d8ef61fd69119d08dce3b86f8
- MD5 97ed79409832e17627de992b5974f1b8
- SHA1 cd602dec140e1e393c1c254134a74db196c9c647
- SHA512 0fad40e4bdc923c0313a091e9082dc4f13cfda3c06aff197130b74621d0f469da08be6c699a8562295c0f4c8706827db113846fbbbd8f7ee46011fd9a9dd41b7
- SSDEEP 196608:PeYlWK8UngBwWlVYC9vC3p0KTwpdyu2B7C8wbHvEspF:8Un1WoKv5SwPR2U8wrEGF
- TLSH T11DA6F159719800F8C0BAD179DA47691BF776389807319FFB16E05A562F636E0AB3FB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger