4655550f7e3a2ee8d330b444e1f4a6bdcf6ef9bdfcb4b18833a8f7a7305d1f8c

Resubmissions

17/10/2026, 12:04

17/10/2026, 12:02

user interaction
yes
max time kernel
30s
max time network
33s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 12:04

Target
MobiHok v6.7z
Size 37.3MB
Sample261017-n8qa2sfs21
SHA256 4655550f7e3a2ee8d330b444e1f4a6bdcf6ef9bdfcb4b18833a8f7a7305d1f8c
MD5 b14bd817431f90022821372e8e82bec9
SHA1 41ad23eba5a028c54ab24e4c833ea95d78f31be2
SHA512 5b027e93bf9515b571c2d396717cc5b82c734d7fb54d65b94cf50e581260858560d6cb1c5adebe7fc9a1948e5db9592c95e6a1aff4a7be8390d0bd35159d5062
SSDEEP 786432:lMyKPMttPqJaLH1N7J4dpqwYS3D9uDpwiMO+E9+ElJs+ZmXDyv:ONPMtwM1N7C79u6iv79+es+ZmXDyv
TLSH
T14187336CFF66EFD5FEE175FB45E764E0C22B110A9325497828A0267E32B42A0D61C70D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3784	MobiHok.exe
228	MobiHok.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3184	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 4 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3784	3184	7zFM.exe	88
PID 3184 wrote to memory of 228	3184	7zFM.exe	92

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MobiHok v6.7z"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\7zO07C1D798\MobiHok.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO07C1D798\MobiHok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\7zO07C79FD8\MobiHok.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO07C79FD8\MobiHok.exe"
  2⤵
  - Executes dropped EXE
  PID:228

MobiHok.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MobiHok.exe.log
Size 1KB
SHA256 77071d2e1fdfc305512f111f44cebf7231f696c3bed3cdf5fd369b4485330d9c
MD5 b2385a5c9864a22996a735d92ea0bbea
SHA1 6102095de817c5118b2daff432176cb1a6c31e70
SHA512 9e4b1da35348bc9e047334082a56a765d8dbcbd86594818f1dddbc46fbb6279f4389333d6fd2567466f948d1f62f0af343e48474c98c0d148f4e27ae8a2a2816
TLSH
T1D531DC7022B6B1D889023F470C6D29C417BF4329B560AE0CBAA8525EDD2B0175F323F3
MD5 SHA1 SHA512 TLSH

Submit Download

MobiHok.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO07C1D798\MobiHok.exe
Size 2.4MB
SHA256 73417e5ed573fc629d71e0e8cc4c1bab8e4b6705c9994d2c13d173ba238f18e5
MD5 9e3e09d6dc2da37e7f07b8e91e6d38f4
SHA1 410ca4d6767108b290810daa699537bcd7c5871e
SHA512 ef145f975ba80a1f0c49a001642cc37ad35e409ed1628f92beb990396b0d6107917b9a04734f5dbd83a5af60f35977ded873e4d998f43bfa70c21e5b328f6b54
SSDEEP 24576:cR9O08k8sVW40PynQSMS/jgD1EGbJP7m1eFVnbY0IVnlqYpWpp5olScxZxPZ3uVI:aLrnrgD1EGbFVMV4enWjN8JEZRuG
TLSH
T17BC57D1622A05F45F43E93793526441887F9A402F762DBCF7EA0BCE43B76344DE8E266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3784-15-0x000001F2F1570000-0x000001F2F17DE000-memory.dmp

Download

memory/3784-16-0x000001F2F4E90000-0x000001F2F4EA0000-memory.dmp

Download

memory/3784-17-0x000001F2F4E90000-0x000001F2F4EA0000-memory.dmp

Download