General
- Target tshfer.COM
- Size 1.1MB
- Sample261003-wtaaaavv9m
- SHA256 55f2efdb27f6d2dce9b627d245594d3ae9d43731862fe49f10165998aff0d69b
- MD5 3349b1a929bdd14df95b1c35794ca2b0
- SHA1 433b83add803ddd81119b196e645792e7f30f8a5
- SHA512 c95e9bf311e3be66b66a5c3a5e3515216823be08765bb8d0463ce91b9121c419327c6b0e05751fe4d736ab80efa8bd06046a13667579b66088e4e559b4645daf
- SSDEEP 24576:LCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATczVJP:GF+LL+fIWybB8KzVJ
- TLSH T1C345F10399154B87D47953F9BE431FAC2F5A3F1CA9923AEF00225E8B7E702520D5E46E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tshfer.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tshfer.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target tshfer.COM
- Size 1.1MB
- SHA256 55f2efdb27f6d2dce9b627d245594d3ae9d43731862fe49f10165998aff0d69b
- MD5 3349b1a929bdd14df95b1c35794ca2b0
- SHA1 433b83add803ddd81119b196e645792e7f30f8a5
- SHA512 c95e9bf311e3be66b66a5c3a5e3515216823be08765bb8d0463ce91b9121c419327c6b0e05751fe4d736ab80efa8bd06046a13667579b66088e4e559b4645daf
- SSDEEP 24576:LCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATczVJP:GF+LL+fIWybB8KzVJ
- TLSH T1C345F10399154B87D47953F9BE431FAC2F5A3F1CA9923AEF00225E8B7E702520D5E46E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory