eaac64c113ebaba1fae924ad1b6239a44c8806bf2b85d8dc11a27ad65a981cc1

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bypass2.31v/Bypass2.31v.exe
Size 785KB
Sample261011-hp1psade98
SHA256 eaac64c113ebaba1fae924ad1b6239a44c8806bf2b85d8dc11a27ad65a981cc1
MD5 bca6478b230b6920fe79b97a3066e835
SHA1 f61e771c53c63f35f5a2b416c260c74d29329adf
SHA512 463f16b737768ac2bb285efc09e69781132e95c234e2eab37eb98be797606e45d1dbb38df3a6ef55144f4f7e1b08a213768e915b7d967b8c90bd03b216a07ff7
SSDEEP 12288:/AstffLBk3Q45wU0/St0Z4j9lAx5ylTxEIyTXnxYV:4s9uQ45oyj9lE5yFuTXmV
TLSH
T1CB058E6A66AC01F8E0B7D17989964907F7B27845137197CF43A087AB2F276E05F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Ml5PkcXoAgNCH8WV.exe

Executes dropped EXE 1 IoCs

pid	Process
3568	Ml5PkcXoAgNCH8WV.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	Bypass2.31v.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3568	4600	Bypass2.31v.exe	89

C:\Users\Admin\AppData\Local\Temp\Bypass2.31v\Bypass2.31v.exe
"C:\Users\Admin\AppData\Local\Temp\Bypass2.31v\Bypass2.31v.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\Ml5PkcXoAgNCH8WV.exe
  "C:\Users\Admin\AppData\Local\Temp\Ml5PkcXoAgNCH8WV.exe"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Executes dropped EXE
  PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ml5PkcXoAgNCH8WV.exe

Path C:\Users\Admin\AppData\Local\Temp\Ml5PkcXoAgNCH8WV.exe
Size 593KB
SHA256 dc774e571135d2d29e19a655bd228bb8e154689ef7c264407885c32280c8aa46
MD5 885b29e17b2519259498d24c4ae1c39a
SHA1 bdb623fc5532d28d48bba43b78af1fbbc6dbeb28
SHA512 bc34431e6055f9980bc734f3322d8327318228b7197d136edf965793b6744ff887b1335411faf6bd1a1bd413fbaa3fa83910b3e1de559f9832673fdd6fad1a35
SSDEEP 6144:/F/VjhicuYpAxu23t7IyUnKhPNeZ1YgGDtWBsV8mJ/gV25tS/t9tFopmuKXgl7LZ:/PkcuUFZnKDfRG20DeMuKXUl
TLSH
T1ECD4E8A2D65265D9E9538138E81A330BB83E38907584EBF156169D833EF0EB7476C31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download