General
- Target ntoskrnl.exe
- Size 12.4MB
- Sample260903-n5cwjsstdy
- SHA256 ee04f9e58743d6a6b5bc53c4bfa89ff97cd715b9091b0d67afd72e278bfc5395
- MD5 fd768e4fbab63155d3608e914b5606c7
- SHA1 0c391cd81c517933edd6129fd2282b08c64d4fae
- SHA512 9885796b03f48b6c4e7811f14821b4a7b2537d55d9cf96683da1e4719184a1316de38ba14c02f54434b7d4e8f179097aac2445a0bdee69860f0f2fff3fbd30fa
- SSDEEP 196608:qBJh+yfu+F5AXP/LmD1I2hj4NR2miCYDvlwddnFikr+pTNRK6G7:ULu+jDu2hE/6vKBTuZ4j
- TLSH T14CD69E56E2E911E8D5BBC179C69A8617EBF1B816133097CF12A086592F33FE0673D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
Behavioral task
behavioral1
Sample
ntoskrnl.sys
Resource
win10ltsc2021-20260513-en
1 signatures
900 seconds
Behavioral task
behavioral2
Sample
ntoskrnl.sys
Resource
win11-20260513-en
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
ntoskrnl.sys
Resource
win11ltsc2024-20260709-en
15 signatures
900 seconds
Malware Config
Targets
-
- Target ntoskrnl.exe
- Size 12.4MB
- SHA256 ee04f9e58743d6a6b5bc53c4bfa89ff97cd715b9091b0d67afd72e278bfc5395
- MD5 fd768e4fbab63155d3608e914b5606c7
- SHA1 0c391cd81c517933edd6129fd2282b08c64d4fae
- SHA512 9885796b03f48b6c4e7811f14821b4a7b2537d55d9cf96683da1e4719184a1316de38ba14c02f54434b7d4e8f179097aac2445a0bdee69860f0f2fff3fbd30fa
- SSDEEP 196608:qBJh+yfu+F5AXP/LmD1I2hj4NR2miCYDvlwddnFikr+pTNRK6G7:ULu+jDu2hE/6vKBTuZ4j
- TLSH T14CD69E56E2E911E8D5BBC179C69A8617EBF1B816133097CF12A086592F33FE0673D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.