General
- Target carbon-5d9f90b8.zip
- Size 24.1MB
- Sample260907-ygjdjavbmd
- SHA256 c6a929d3c66b4ac83002ce8ba1c4cf05a3c042cce0859954c630c30a27cc4ca8
- MD5 0068b01dea6127fc2a6edf697a4c13f9
- SHA1 ea92a00de9fd16333ac00e64c779a6de43d50596
- SHA512 c809d2ebae5dfc35963280446f7fc5d30af3be5728b382ce5cc3a5f7cd7ab256998198d354d70b4e7ad02100c2040d31baef1a6955d90ac0f9c11e17dd58b5bc
- SSDEEP 786432:elBhM1beiGAKkuMcjKf33Vcxvli1K/hEodsG:YmeixKZJjE1KvA1K2odsG
- TLSH T18C473359C28EC6CEF2C9F44A3C389235C895F30297A28FD25D666ED2BD8ED050F9D815
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
carbon.exe
Resource
win10ltsc2021-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
msdia140.dll
Resource
win10ltsc2021-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
symsrv.dll
Resource
win10ltsc2021-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
vxlib64.dll
Resource
win10ltsc2021-20260513-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target carbon.exe
- Size 24.1MB
- SHA256 348d0fd43dff3a881bddc0393024386af2d5b46d0f061729d6441d7a97db35f9
- MD5 8e733c8da63fff3c2f7354392fcfa90b
- SHA1 24db5f45162bb813174d71a7eb15d16a70e1f8c9
- SHA512 b7e77933291b0e9fa788fab8a797596fc3f747d2b062858313150c49a2f8f192d27cbdbaaf547c08b3610f5d37e9293c59529155ffd1c84c88331053ea026f9b
- SSDEEP 393216:g0Zn34JWl3gaYUMkK3c3v00BVBfnWDdcVZ2VS+oQr83lPpz9HKlSXh6EfsL:NWJCQaYQK8DgDdlboVlHKlSXh6Efs
- TLSH T1724733063D9801F4D0AADB762E275249B0EC7FFA2D729656294C36D8723A51F0F9F2C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target msdia140.dll
- Size 2.2MB
- SHA256 7d6b1877c119bdabbb1424ca97ce0ff4a83be25ef817feb2a0285452c9013ae3
- MD5 39438a3eb4deda7aa150d9891e8188aa
- SHA1 32c591fa9553021204d825ff4794c17e8f185dd0
- SHA512 496d849fb4d8e822be9f26c72da143a0423b83719ca84abc823815b924c2165b194e407982f3790d2d7e68665721fa7ac7ed4cf1785b522d400aeb4fc6aeb763
- SSDEEP 24576:YrYxDyspI29M7YdjhvxQidvzBVy49Fbi5YrYKaNMjt7yxqGDi6uREO6LsfxyKWUP:RVIDE5hvVvtTFbi6rYVNMJuxw6U9Ya
- TLSH T1B6B57D67E3B841BCD0FAC078C65B9603EBB278451720A7DF12A5466E6F23BE059BD311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target symsrv.dll
- Size 413KB
- SHA256 fea493309d3d5640df85f4b5523ea0091d4705780df5ca471a75cba9f0bac232
- MD5 837eb266ee187c14160ed9918683380b
- SHA1 f5663762dd0f24435412531de59c52e1f1bd4d5e
- SHA512 a7dc96c992a1566a8954e817aadff42f92fb092c0d5a35ebf12c70f36ce37e8bcc22e9a790add7eb41198359dfb253136d1f23caf287d5b30767fd04138cc753
- SSDEEP 6144:vYvMwXLY++txRdoR1XlVaoQbvnei1uppJXxBVuiHqYs1QarNrFdkbB69RYxP0j:2pedoHXioQb/ei1upvXtuiHXeQj1mRDj
- TLSH T1D794182DE7E80465E1B2A5788AB3C605D7B278A81735D3CF1194C13E5E27FD4AA34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target vxlib64.dll
- Size 102KB
- SHA256 232f7f83897f3e757620e3f85dc7aa692074bff38724fda2bb4082f86fd8f42f
- MD5 76106fddf33453c7507c85fe69e26b09
- SHA1 d5efcb2a8a7fde8a919961c9e10edfd630cc9a56
- SHA512 2f869c91aec0dae5b65aea1058b79978841a7a63a6c99c55a6aeceae779314d72d95dee2f29a7fa7b371774aad71fde3272dc81ec4fbcf1c6489d708a4859551
- SSDEEP 3072:O6sA1I4JIXBRdA0qxxI16GMt9l0edbOs3ZDj:DCEE9RqxxoYVZj
- TLSH T1EEA34A5BB6E500BBE1B7867889670E05E7B6F82107619FEF0360425A2F237D14D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10