General
- Target 5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58
- Size 4.2MB
- Sample261003-p8e1rayfrb
- SHA256 5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58
- MD5 92210c98ab48f1ac1d3a8fb9d362146d
- SHA1 dd3cc38f4453c3e7ef6dd7d5c47ddb106ebdfaac
- SHA512 9258225a7974c57ebec9db2410431844bd63594c131288330ebca32aab856a9bf1cce3b075be75162214f08f17da8142060ea8e51a6c371dd1ff31fca5531d8c
- SSDEEP 98304:L21N2fGe9gS1IGxsn2sSIzjXB34BrCk61+ky2UQo:L2OfGeuut+nZzLR1MXQo
- TLSH T1AA16336DA22B0993D39B14A07DF023CDBDE04E9CB9CD27C517946F263F242BA599805F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
HEU KMS Activator v63.3.0/办文绿软.url
Resource
win10v2004-20260911-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
HEU KMS Activator v63.3.0/办文绿软.url
Resource
win11ltsc2024-20260911-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe
- Size 4.3MB
- SHA256 9cd237d04d1b2dbf2610e1ed5ca130295a8640664f9bc33bf0ee73997e360ff0
- MD5 574f39c2c5e78ced0755cae991e0ab61
- SHA1 8b9dcc94ec61c899d031ce53d91c499afa4b9b30
- SHA512 c8adb347e2854d9f94855fe2c44ba102e47f29abcf2ca531ec76fe65b039f9345d872d27ef37db372821799f6cecf18a07be077a8189d2d6ca9d5931638097ac
- SSDEEP 98304:2+S9bg0UTqy14GZOiRQL+IyA/r7v3IlhCA6l+UeOq8:tMc1TqyiwT2LH/vXlmP8
- TLSH T1842633D5B11FDD0ED5A2D7F0691C0D46EE92AF9E6A4F338E7BA02AA91B1035008CC5D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
- Target HEU KMS Activator v63.3.0/办文绿软.url
- Size 114B
- SHA256 77fff6ceb634e8b3512c81b05ee0d07c4a6501f7426efaf288f903c811fa02f6
- MD5 453de2c12c01d5a14cf7d57916e89eee
- SHA1 7adcbb6d42cd75f4899b79c8709e6be6320a955e
- SHA512 b6c173be893d62a354e94bbe7a5b22b8a1395918513638dd1ae1b03c66993b5e481095d9d0e6060bc6f3058651eb969c91f737e75b19634f19a4b6c9ac7bb2cf
- TLSH T1E5B012AE5509C69AD141C41A5070F9089C0F79A08CD2D0DC6548DEDB4C480D2C565B37
- MD5 SHA1 SHA512 TLSH
Score1/10