General
- Target fatality fix new.exe
- Size 816KB
- Sample260831-slfkjsxtgz
- SHA256 a1ca87f4aee3bd42e0a18e4e046708c4a42534479ba5d6585c9d55fa7ddbfe8d
- MD5 845db37b6d3058fc3053255ce5cd86ea
- SHA1 6fe7ada83866fb47ed1a2d42e99467b28f23dfea
- SHA512 e7f824b054dafe1f27dfc1f2ce6d596d6f3ea7316d651d810d82b31faa7b0663542532629dbc9a996814bf6525ff8930a9bd056d7e1eb7cde7911ff84b95798d
- SSDEEP 12288:YqC/guM3l5lzoyZT0Z+az/FRHpX9OfM0zj3Qjz5qHEZccPp:HogNdQPOUtkHw
- TLSH T14305E66A7B828F09E075697DCCCD3322D7A51FF32723634B3B086714178A1CA9D1A796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fatality fix new.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
fatality fix new.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target fatality fix new.exe
- Size 816KB
- SHA256 a1ca87f4aee3bd42e0a18e4e046708c4a42534479ba5d6585c9d55fa7ddbfe8d
- MD5 845db37b6d3058fc3053255ce5cd86ea
- SHA1 6fe7ada83866fb47ed1a2d42e99467b28f23dfea
- SHA512 e7f824b054dafe1f27dfc1f2ce6d596d6f3ea7316d651d810d82b31faa7b0663542532629dbc9a996814bf6525ff8930a9bd056d7e1eb7cde7911ff84b95798d
- SSDEEP 12288:YqC/guM3l5lzoyZT0Z+az/FRHpX9OfM0zj3Qjz5qHEZccPp:HogNdQPOUtkHw
- TLSH T14305E66A7B828F09E075697DCCCD3322D7A51FF32723634B3B086714178A1CA9D1A796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1