General
- Target AnyDesk.exe
- Size 8.0MB
- Sample261016-xamxpsyvfx
- SHA256 e0bb78dd82d1377c11e85ee8d6ea0ebfa84a868e6a87f3fc560e2043285d9674
- MD5 4449250b5dccb08adadcff8cb2569d3c
- SHA1 a484331574e31ab462f95a0b97bcf2ddb140b8ed
- SHA512 ea2c10f3439b273550f340d404f036aad625a80b57ec78b830207e23abc16e349c16acad97e3e76c9190dde593674a9375528ddb036e9693d555a2e6d540d144
- SSDEEP 196608:CfoJwZGmI0Xag59pM+Ab1XVqeLkIEgMF+d0mA1gUpQxfccT7iKxh4dH7you:Co+Z00FpM9b1Fq0kI3XymY6koiKxh4d4
- TLSH T102863341B3C85EB3CE1E59F82B8C5C9E41B0BAFF565D33D22A43E521E6939931A0C4D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win10v2004-20260911-en
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win11ltsc2024-20260911-en
19 signatures
900 seconds
Behavioral task
behavioral3
Sample
AnyDesk.exe
Resource
android-35-x64-arm64-20260325-en
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
AnyDesk.exe
Resource
macos-20260915-en
1 signatures
900 seconds
Malware Config
Targets
-
- Target AnyDesk.exe
- Size 8.0MB
- SHA256 e0bb78dd82d1377c11e85ee8d6ea0ebfa84a868e6a87f3fc560e2043285d9674
- MD5 4449250b5dccb08adadcff8cb2569d3c
- SHA1 a484331574e31ab462f95a0b97bcf2ddb140b8ed
- SHA512 ea2c10f3439b273550f340d404f036aad625a80b57ec78b830207e23abc16e349c16acad97e3e76c9190dde593674a9375528ddb036e9693d555a2e6d540d144
- SSDEEP 196608:CfoJwZGmI0Xag59pM+Ab1XVqeLkIEgMF+d0mA1gUpQxfccT7iKxh4dH7you:Co+Z00FpM9b1Fq0kI3XymY6koiKxh4d4
- TLSH T102863341B3C85EB3CE1E59F82B8C5C9E41B0BAFF565D33D22A43E521E6939931A0C4D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.