General
- Target fi.exe
- Size 10.6MB
- Sample261012-xmef4aws5q
- SHA256 b15261829981d69e83a94e41b4640d724678fb01c5a18fe49a8e538f58f8bfb9
- MD5 ada3ac2831911f370d6bb9cbad9ffeb0
- SHA1 cf90d6b88823264ea8043378ac0b210ba4acdf03
- SHA512 d499ebc0d9eceeee62814c95c08949495d0b5d29bc7e68e560cf7d2443ac97dfda4f40ca51374e0199a65dd411d0350659eb27a330c649f46b236e86d974778b
- SSDEEP 196608:Ns5nAuowgMoPrv4QEhs2SV5lien8aLMAo7h5kSZvxiRDRIn:NQLgNTv4fShB8CMbCU5sK
- TLSH T146B6331DA26218A6D8565E3B8891D3FAD5233D2B0770C6CF11E47E633E272E31DF5292
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
fi.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fi.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target fi.exe
- Size 10.6MB
- SHA256 b15261829981d69e83a94e41b4640d724678fb01c5a18fe49a8e538f58f8bfb9
- MD5 ada3ac2831911f370d6bb9cbad9ffeb0
- SHA1 cf90d6b88823264ea8043378ac0b210ba4acdf03
- SHA512 d499ebc0d9eceeee62814c95c08949495d0b5d29bc7e68e560cf7d2443ac97dfda4f40ca51374e0199a65dd411d0350659eb27a330c649f46b236e86d974778b
- SSDEEP 196608:Ns5nAuowgMoPrv4QEhs2SV5lien8aLMAo7h5kSZvxiRDRIn:NQLgNTv4fShB8CMbCU5sK
- TLSH T146B6331DA26218A6D8565E3B8891D3FAD5233D2B0770C6CF11E47E633E272E31DF5292
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Renames multiple (61) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Loads dropped DLL