General
- Target google.com
- Size 853KB
- Sample261020-mcbmcaba75
- SHA256 458547d88d079913200efe316cd61ddb14a7780d4c9b753da3e0526f92dcd754
- MD5 cf27f681e6309f1c823e44c5470b31af
- SHA1 8beeedd54966e26bf6e56a54f07103c201a69d1a
- SHA512 72e954c3a0708553a96f60ef8fd948fa7bd641480e2ad04ae64147cbba25bee12121aec6d91365cd39b10b1c5b3e0f4e35a30ede222100cad853ac6058e3269d
- SSDEEP 12288:yPb56K1bGCLa2s0hBl+riTowA9KStNeY3RIe5Qf5uhl3ZNXc3:obxe2syBOiTopZe0RIe8GPNXC
- TLSH T11805E7247B94AE01E5401A3E92BE1608D73264F22713AB47370BF7654D45AFEED2C3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
google.exe
Resource
win11-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
google.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target google.com
- Size 853KB
- SHA256 458547d88d079913200efe316cd61ddb14a7780d4c9b753da3e0526f92dcd754
- MD5 cf27f681e6309f1c823e44c5470b31af
- SHA1 8beeedd54966e26bf6e56a54f07103c201a69d1a
- SHA512 72e954c3a0708553a96f60ef8fd948fa7bd641480e2ad04ae64147cbba25bee12121aec6d91365cd39b10b1c5b3e0f4e35a30ede222100cad853ac6058e3269d
- SSDEEP 12288:yPb56K1bGCLa2s0hBl+riTowA9KStNeY3RIe5Qf5uhl3ZNXc3:obxe2syBOiTopZe0RIe8GPNXC
- TLSH T11805E7247B94AE01E5401A3E92BE1608D73264F22713AB47370BF7654D45AFEED2C3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1