Overview

overview

8

Static

static

3

big_ip_cli...26.exe

windows11-21h2-x64

big_ip_cli...rv.exe

windows11-21h2-x64

3

big_ip_cli...ov.dll

windows11-21h2-x64

3

big_ip_cli...64.dll

windows11-21h2-x64

1

big_ip_cli...64.dll

windows11-21h2-x64

1

big_ip_cli...er.dll

windows11-21h2-x64

3

big_ip_cli...64.dll

windows11-21h2-x64

1

big_ip_cli...64.dll

windows11-21h2-x64

1

big_ip_cli...rv.exe

windows11-21h2-x64

3

big_ip_cli...rv.sys

windows11-21h2-x64

3

big_ip_cli...rv.exe

windows11-21h2-x64

3

big_ip_cli...ce.exe

windows11-21h2-x64

3

big_ip_cli...UI.exe

windows11-21h2-x64

3

big_ip_cli...ce.exe

windows11-21h2-x64

3

big_ip_cli...rv.sys

windows11-21h2-x64

3

big_ip_cli...rv.exe

windows11-21h2-x64

1

big_ip_cli...64.exe

windows11-21h2-x64

1

big_ip_cli...rv.exe

windows11-21h2-x64

1

big_ip_cli...rv.exe

windows11-21h2-x64

big_ip_cli...64.exe

windows11-21h2-x64

big_ip_cli...ce.exe

windows11-21h2-x64

3

big_ip_cli...pi.dll

windows11-21h2-x64

3

big_ip_cli...pc.exe

windows11-21h2-x64

3

big_ip_cli...tW.exe

windows11-21h2-x64

3

big_ip_cli...ov.dll

windows11-21h2-x64

3

big_ip_cli...64.dll

windows11-21h2-x64

1

big_ip_cli...64.dll

windows11-21h2-x64

1

big_ip_cli...ls.dll

windows11-21h2-x64

3

big_ip_cli...up.bat

windows11-21h2-x64

8

big_ip_cli...ll.bat

windows11-21h2-x64

8

big_ip_cli...ts.msi

windows11-21h2-x64

7

big_ip_cli...fo.exe

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    big_ip_client_2026.zip
  • Size 64.6MB
  • Sample260916-vtepbsdp4y
  • SHA256 62418bc0914f805f21412f8dbe3bf2c52ae119a657e1e4307a500ed8823b6e4b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Targets

    • Target
      big_ip_client_2026/BIGIPEdgeClient 2026.exe
    • Size 32.0MB
    • SHA256 b6aa79dc51f7c501d9f648e6d5e48a41ecab8c69eeb562a61e3b3c83b660ab1c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Drops file in Drivers directory

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1
    • Target
      big_ip_client_2026/F5 VPN/F5CredMgrSrv.exe
    • Size 320KB
    • SHA256 8da0242b3d34e68c359649b8127b97d5503136484cf90681cf473f6a5064042d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      big_ip_client_2026/F5 VPN/F5CredProv.dll
    • Size 272KB
    • SHA256 a27ebaab7248bfc2b517fa16c60754e77a371fea5cf28afc205d52904fcb0b8c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      big_ip_client_2026/F5 VPN/F5CredProv64.dll
    • Size 331KB
    • SHA256 3c57c4402ed66e103c8203f23ebd617f44ba2dda66c19750738fc996849a76a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      big_ip_client_2026/F5 VPN/F5CredProvARM64.dll
    • Size 342KB
    • SHA256 9db8671cac05509a60651cf41f55a826bac84321f6e20c62bfed8578da5b46a3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      big_ip_client_2026/F5 VPN/F5CustomDialer.dll
    • Size 402KB
    • SHA256 3cfdc46af9d81dbfa28390d35eaebd5b064f6d31ed3f4fda2ab67734364fe5f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral6
    • Target
      big_ip_client_2026/F5 VPN/F5CustomDialer64.dll
    • Size 469KB
    • SHA256 d5049f1a543e4e0f49c7ceebe607d4c5ae142f83fb7432a35b8571044043472d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      big_ip_client_2026/F5 VPN/F5CustomDialerARM64.dll
    • Size 434KB
    • SHA256 f808f171f88996da44c4be612821b186d67f8acdabfc891c0963d8746802c7e9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      big_ip_client_2026/F5 VPN/F5DialSrv.exe
    • Size 3.1MB
    • SHA256 f01f87a6cb31e19d72bc96be2f08c60db9895d65ede747426348d00ba7034272
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral9
    • Target
      big_ip_client_2026/F5 VPN/F5FltDrv.sys
    • Size 45KB
    • SHA256 acc6408c5d90b4c208507fc0291557189d937fc5bd63eedf3dd8498f546cdc0c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10
    • Target
      big_ip_client_2026/F5 VPN/F5FltSrv.exe
    • Size 637KB
    • SHA256 97acf70c36b18e266f342bff4f6d7b7a01c9902631197657a9965cd6c422e591
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11
    • Target
      big_ip_client_2026/F5 VPN/F5InstallerService.exe
    • Size 613KB
    • SHA256 5f9bca748a5277da379810d930a9dbad34dd41274a7ccbe74bff1a9e9549206f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral12
    • Target
      big_ip_client_2026/F5 VPN/F5LogonUI.exe
    • Size 214KB
    • SHA256 4600c7e21d7ed1d9c992b387122c42b78475f182f06283a9d6fee00a773ee6d2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13
    • Target
      big_ip_client_2026/F5 VPN/F5PrelogonHelperService.exe
    • Size 338KB
    • SHA256 cb3be18788b1212b19b6676ab915a1eacb448daa42234c159cc13d47f4ae3c1d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral14
    • Target
      big_ip_client_2026/F5 VPN/amd64/F5FltDrv.sys
    • Size 54KB
    • SHA256 ab5c8cd7382d2b8ba769a6315a67361d028936a95e5ca2f8b400450715fcfedc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15
    • Target
      big_ip_client_2026/F5 VPN/amd64/F5FltSrv.exe
    • Size 791KB
    • SHA256 8df343affe3725ab083719d60eade1f7a77986673cc1940dfc56f17ff9be6234
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      big_ip_client_2026/F5 VPN/amd64/F5PrelogonHelperService64.exe
    • Size 406KB
    • SHA256 02f1894daad72d76bad3c19ec664e0c90847a2c834e6db1ac581b2e4ecf5b922
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      big_ip_client_2026/F5 VPN/amd64/F5TrafficSrv.exe
    • Size 335KB
    • SHA256 ab16f612a9fe76650f0e56e7a36358c1435d41495f5a03ab876558bc9832980a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      big_ip_client_2026/F5 VPN/arm64/F5FltSrv.exe
    • Size 932KB
    • SHA256 a0cfa0e805db1b0f0cd7141e6655c5b9b5c8ea626a82a7a7ae9d5ab42062ece2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      big_ip_client_2026/F5 VPN/arm64/F5PrelogonHelperServiceARM64.exe
    • Size 383KB
    • SHA256 6d9bc1310a2a8f13ae0212d592cb0e87a3cddd6d5cc7ceb593eb5cfb526e1222
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      big_ip_client_2026/F5 VPN/f5InspectorService.exe
    • Size 602KB
    • SHA256 f8d92a47384aea3acc356ef808e677ca672ad7d4b4c34c5524a24f4c73751f0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21
    • Target
      big_ip_client_2026/F5 VPN/f5fpapi.dll
    • Size 2.4MB
    • SHA256 4b5c40a271b697694746d6834e81908ff7301d58830b61a227f1aa3797fb4ca7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral22
    • Target
      big_ip_client_2026/F5 VPN/f5fpc.exe
    • Size 444KB
    • SHA256 287c1c3aaf01955d294b1e6bfdac1d8744cad7b8e9d60acb9e8e9dd4fc83bae1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23
    • Target
      big_ip_client_2026/F5 VPN/f5fpclientW.exe
    • Size 5.0MB
    • SHA256 e3123222848835e0274553c81b9db733a4a79ea11250b8f48f742a837414a365
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral24
    • Target
      big_ip_client_2026/F5 VPN/f5netprov.dll
    • Size 268KB
    • SHA256 e7729e410c5109e8e7edf0d3d8f99a64419df2c12e0f0923818e23ccf4f22e07
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25
    • Target
      big_ip_client_2026/F5 VPN/f5netprov64.dll
    • Size 339KB
    • SHA256 77dbd33db03d0598a909f69fa093eac62de2fade26802a7a84b4f8e35e36514c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      big_ip_client_2026/F5 VPN/f5netprovARM64.dll
    • Size 354KB
    • SHA256 cde6943a01aaad8dc6c1389618a7b0d4c4cf4e8b37ccd258b8364692975a0728
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      big_ip_client_2026/F5 VPN/scew_uls.dll
    • Size 259KB
    • SHA256 450af1f4e237644a26bcf2d7a72bc0f74df3fd6d6ebd32c5c4eb98278eb40d32
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral28
    • Target
      big_ip_client_2026/Setup.bat
    • Size 1KB
    • SHA256 ec9390bab75cf825eed0a315ee3dc049a6dc88b23fa8f553cc01c4a37dde0089
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral29
    • Target
      big_ip_client_2026/Uninstall.bat
    • Size 1KB
    • SHA256 7e1a00a0350000ed17d07ec36de642f01aea156076408de3619905c04a014b75
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral30
    • Target
      big_ip_client_2026/f5fpclients.msi
    • Size 1.1MB
    • SHA256 21cd3733c8c6a53536d17abc7129e7d6487e23541c8be9099f475031223d9917
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Loads dropped DLL

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral31
    • Target
      big_ip_client_2026/f5wininfo.exe
    • Size 3.4MB
    • SHA256 4a8a430516fc6d092c011ceb97c9713bb6383db8045f59f0a56b6ba0d6c917ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Defense Evasion

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan
Score
8/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

discovery
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

discovery
Score
3/10

behavioral29

discoveryexecution
Score
8/10

behavioral30

execution
Score
8/10

behavioral31

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral32

discovery
Score
3/10