General
- Target CHEADLE+SSC.zip
- Size 61.1MB
- Sample260928-dr286steqd
- SHA256 e137afcadc61f28a47c8fbf06b149edd1fdb869855393ee9406d3ad7ae0ad0b0
- MD5 5b614fdfe5f62a2847d673ac3bc503bb
- SHA1 bb9888a3b14bece22e6c7e7fdb8a43c664ff6b5f
- SHA512 5f7c031b87363eff294bc663d4e3d4eb67acb9fc839a3ba741a743808a49c849066042275449f5532081bea688309470bab7697014b8e110b538e9087d32d9ca
- SSDEEP 1572864:GnhGGTzD+CTsKeotUX5vbIGv3VAsjCb8g/DogUi:gDzqCpe4UX5vbBPKuU/D/R
- TLSH T158E7330024F8CE7ADD4F62351E6B49C979AB7E1AC58223B762B423BC4C61F7783115E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CHORIG/CheadlewareLoader.exe
Resource
win11-20260911-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
CHORIG/CheadlewareLoader.exe
Resource
win11ltsc2024-20260911-en
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
SSORIG/SecretServiceOriginalOffline.exe
Resource
win11-20260911-en
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
SSORIG/SecretServiceOriginalOffline.exe
Resource
win11ltsc2024-20260911-en
25 signatures
900 seconds
Malware Config
Targets
-
- Target CHORIG/CheadlewareLoader.exe
- Size 15.0MB
- SHA256 8ae400be0ea341ca3119edf973d87c63dadd69df6e43f421b99012bd6d85275e
- MD5 6468211258614b0d7f535f0869fc7942
- SHA1 1b65f438b326594d3bbb3e95218ccd007e1d7ee1
- SHA512 2cc86910d9de60e152a34c32f36b2263e04b65a3f4250f4bb1bff63cfd1728230fb3e09c3878df005b15dbcc6eba24ca9f6ceeb0a30210204307b437b0aef55c
- SSDEEP 393216:9GI9sNEV3q7c7tTF9/f7tSV3/WM0VIXTu:FbVaKth9/zeAe
- TLSH T14FF60286A1D492BCC441C134E2455BFAF1A4BC880F79999BBFC25A113F31DD5C9BAB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target SSORIG/SecretServiceOriginalOffline.exe
- Size 62.1MB
- SHA256 a362afb7859675118b24afd7d0667d9b8b68d3ab17d5a5d50299c996226534f9
- MD5 c443cb5e6adf1bd8fcfb457ecc364013
- SHA1 ebc95ea0315c9dfc8771e3738a8956aa96d99552
- SHA512 fa93959f9cd3eacf1707ac88569c5d2b8f6686c3c0894209ba467b39e75912108c660adac8205fc06efebb7b81976437916ae31bf315a0ac943b246f4ce6502b
- SSDEEP 393216:UmNYgUw6pz9uRq/QahhdIUcq9gqS4SzWUw6pz9uRq/QahhdIUch9gqS4SzrUw6pe:h1q984H1h984sF4Nw4
- TLSH T16FE77BD276E5D098C126D1B9CE02E6EFD66F7C298F2069DB36D0375F5A33990263A700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.