General
- Target Kryptex.exe
- Size 10.6MB
- Sample260919-2w9qtacd64
- SHA256 7775d333f0f61b4a6b29d11eb12a28405b74709ef0c4e67eea40e516ba255b05
- MD5 a5abb4dd9cb143c0271d3fc89811334b
- SHA1 2eba9a6af509f6bbc739ac7a5d5408156e62c30f
- SHA512 1ab0ad632e0ed678472d4d2d8240c19529dcbb51ad729f10294efbb8946b36e7126559fd8a0d4e4a0bad7e86f84cd934b2cfb4096d16e3d960adbb6bdeac1b1d
- SSDEEP 196608:bFUAVOgVZydzPbszX7gWmK8/IPrvzo2C9wI+QJBp:bmAVOgVMdzA7mRADNCFJD
- TLSH T115B623477B24E9A2C5241777D8B2C8944B75FC089A52EB67389DF33C0C73392990B99B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kryptex.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
stealc
Botnet
-
traff_1
C2
-
http://193.233.254.53
Attributes
-
url_path
/278c2fb3d8583f0e.php
Targets
-
- Target Kryptex.exe
- Size 10.6MB
- SHA256 7775d333f0f61b4a6b29d11eb12a28405b74709ef0c4e67eea40e516ba255b05
- MD5 a5abb4dd9cb143c0271d3fc89811334b
- SHA1 2eba9a6af509f6bbc739ac7a5d5408156e62c30f
- SHA512 1ab0ad632e0ed678472d4d2d8240c19529dcbb51ad729f10294efbb8946b36e7126559fd8a0d4e4a0bad7e86f84cd934b2cfb4096d16e3d960adbb6bdeac1b1d
- SSDEEP 196608:bFUAVOgVZydzPbszX7gWmK8/IPrvzo2C9wI+QJBp:bmAVOgVMdzA7mRADNCFJD
- TLSH T115B623477B24E9A2C5241777D8B2C8944B75FC089A52EB67389DF33C0C73392990B99B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Suspicious use of SetThreadContext