minijunk | 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b | Triage™

Login
Reports

Overview

overview

Static

static

file/Connection.dll

windows10-2004-x64

1

file/Connection.dll

windows11-ltsc_2024-x64

1

file/Signa...er.exe

windows10-2004-x64

1

setup.exe

windows10-2004-x64

unbcl.dll

windows10-2004-x64

1

unbcl.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

Target
8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
Size 1.2MB
Sample260923-net25ssdqe
SHA256 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
MD5 1004a0df8dd34741b40ed6bc3c04ade5
SHA1 25c14e19526be586b75b52cae8bdb1553c746642
SHA512 4a2dfbb8e1e1062f19903a92b7a3b4638a1e7b8df60cd5b133bea99f4aecb393a8921e916e5b0d2cd8e3087ad438d38c42e3ceaefa1d033f7d285931db2275ac
SSDEEP 24576:/HhTDVYxwRr7ilzyodjvjF9n1WRemesUYZY5Ci9VDjiysMlcoA0d:/H1JswRrEzHfcOsBS5n9AnUA0d
TLSH
T15845330E5D88DAC6703DF87B048129023E58C497B1C76E3526CB33F0679BF97692E969
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

minijunk nimbus_manticore unc1549 apt backdoor execution persistence

Static task

static1

4 signatures

backdoor apt nimbus_manticore unc1549 minijunk

Behavioral task

behavioral1

Sample

file/Connection.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

file/Connection.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

file/SignatureExplorer.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

setup.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

9 signatures

150 seconds

nimbus_manticore unc1549 apt backdoor execution minijunk persistence

Behavioral task

behavioral5

Sample

unbcl.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

unbcl.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

minijunk

C2

https://NanoMatrix.azurewebsites.net
https://QuantumWeave.azurewebsites.net
https://ElementShift.azurewebsites.net

Targets

- Target
  file/Connection.dll
- Size 2.2MB
- SHA256 43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa
- MD5 34af888f33898a4c3b93ac0e8fecf3a2
- SHA1 f2049d64631264ed6c8ccabdd486763341e18163
- SHA512 a96a5b5c637384846d280a878774b472c28c3d8d587394d99c3fc0852506aa2bd3e38c83abd2b166b771e733d0680dece866dc2e47c631399d24d57bed49864d
- SSDEEP 24576:A5TqAtC9p+h3mR1IWSkr1iIzb0FXFqKrH:A5TptWq3mRhhr1iI/0bq
- TLSH
  T1BCB5187011DA80C6F8DBE5302B20F4DDA9EB687300F937D76BA28E6D4B1D47518DB64A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  file/SignatureExplorer.exe
- Size 249KB
- SHA256 4973b13c9a959ace4a5b33445cac3d2960754e54dcf45a484c35905d7b622a80
- MD5 9bdcaf0aac5e422c600d160cf01cca12
- SHA1 65a1f050ed04792f2017d8efd8488d6b38ff6840
- SHA512 ff9c3a6bebd8e386e4d0d2c079ce11ced600c50b74751dfc1033807e65cdef1faf60da6bf718e40e76f08c13525c84fb4b0246c02b67b61c65c22a45aed839fd
- SSDEEP 3072:B/FdMyQfF+VOWI0TTU/wcvS+Om5wjm8K57NnpO7SBROwzcUeY:B/Fd3QfFoM0TTU/lvS+T5w68K5ZJ
- TLSH
  T1ED4494AD2BD63641EB33E9B99854C2E17E717520032457EF2911FA686E0A5E0FC3F709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  setup.exe
- Size 249KB
- SHA256 4973b13c9a959ace4a5b33445cac3d2960754e54dcf45a484c35905d7b622a80
- MD5 9bdcaf0aac5e422c600d160cf01cca12
- SHA1 65a1f050ed04792f2017d8efd8488d6b38ff6840
- SHA512 ff9c3a6bebd8e386e4d0d2c079ce11ced600c50b74751dfc1033807e65cdef1faf60da6bf718e40e76f08c13525c84fb4b0246c02b67b61c65c22a45aed839fd
- SSDEEP 3072:B/FdMyQfF+VOWI0TTU/wcvS+Om5wjm8K57NnpO7SBROwzcUeY:B/Fd3QfFoM0TTU/lvS+T5w68K5ZJ
- TLSH
  T1ED4494AD2BD63641EB33E9B99854C2E17E717520032457EF2911FA686E0A5E0FC3F709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

nimbus_manticore unc1549 apt backdoor execution minijunk persistence
- Detects MiniJunk Backdoor
  backdoor apt nimbus_manticore unc1549
- Family: MiniJunk
  MiniJunk is a backdoor deployed by the Iran-linked Nimbus Manticore (UNC1549/TAG-117) threat actor.
  backdoor minijunk
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral4
- Target
  unbcl.dll
- Size 812KB
- SHA256 9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1
- MD5 16b421555b84b87e82a56813e86dbf80
- SHA1 4b35cda868585a0e593f6d316b17633b1fd42f1c
- SHA512 207e7c2693ffd01c20518c2d4c0ed65a022ed64e45e463f1707f1bbb16a8f43836437f3a25dfa49681aee27af823670e4ea42d1ba23a0491a8a172d5c514b290
- SSDEEP 12288:h2xa78EpMeFZ98GM7HXDmvM9kpkZ9hkvJerb8:Ph+zbXsM2p+h+1
- TLSH
  T1F505E7B422DB80C2F8DBE2B02A20B595DCE3586242FD7BC657D28D78075A0FD05DFA59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

backdooraptnimbus_manticoreunc1549minijunk

behavioral1

behavioral2

behavioral3

behavioral4

nimbus_manticoreunc1549aptbackdoorexecutionminijunkpersistence

behavioral5

behavioral6

© 2018-2026

Terms | Privacy