General
- Target status.zip
- Size 1.1MB
- Sample260910-z5dzdswfld
- SHA256 77ad14d39515bd2351d98ba1101002d58e09b8f5098d0847547812424d057e1b
- MD5 8de2f51ee3085cd66fd9a148336c9a34
- SHA1 5827c525de746a5af2e045aee1d833523c8d63fc
- SHA512 2154e12fd34ab52b70076259f6ce1e57f4fe8553444aff8f39aebfe7484fd8d3dcedb24df076e29276ba3d5c4c5661f714aace4e1f2b8c77d997fd223ee56a6b
- SSDEEP 24576:/pjFJTU0nwKqUVX21pYqi4Qo6ehEPivIoiUqqz4vzhz4+nw0Kfi:/pj744VX2T0OhIoL4v15Sfi
- TLSH T18B45333BB47F36D04ACBA64C5E9BEF5108761B322638845BD5DEAFE11132A430CD7992
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
adobe_licensing_wf.exe
Resource
win11-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
adobe_licensing_wf.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target adobe_licensing_wf.exe
- Size 2.6MB
- SHA256 85d89054740a2ea81475ad20d486b2883932b736fcf573ba700f605b2d464440
- MD5 0ef17543a4b23f5b9e969373e8f58aaf
- SHA1 c3523220656c6572e07915c39ba74cd0cf3f8d7d
- SHA512 5cbc3735ec7c10d413a43129dfcea79d044c0af0d2bcc6e84e01b5f9c9665d0e62d434e003aaf17f25152a30944e7e6530efb43766065b371bc575196614d4fa
- SSDEEP 49152:tywRPFqurhNXzXSmhX/fWYbKdKbhMpXx+:2G1zXWYbKdKbhe0
- TLSH T1B3C53A7DB2E920C5C175E1B8C9031261F6B3B861C73155DB31642E2EAE3FAE48A3D725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Adds policy Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1