General
- Target Fih.exe
- Size 80.9MB
- Sample261023-saffeaywaw
- SHA256 1a1a43c0b05219a43fec98800f89ba66c1a092389f52dfc20c6c22e06323c41a
- MD5 e29bd8e3c0f817a808cb3916c78dcf0f
- SHA1 f1add2318d4749373917390009cbe4e596ea90be
- SHA512 25b21b7a169aec8c9ea36a4b556f9a5d5d8df0ef2aeb7bd1ffebf7a63351f12d7275809452db5f43e7fcf14ac35473b3a0677f77c8ffd377cdeba969e45eb940
- SSDEEP 1572864:Bog4f/KYEUZl7XNyjhQR5QMJJ8R/E0/utd0xywPhVrfP6j0qmkXodB5bO1P:BEf5EQlLgaR55oR/E0/kd0xxXfP40lr8
- TLSH T11E0833956D4712FBE7F894312486AC3AE6CD31CD4F9781EF169422223F27E483E35962
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
Fih.exe
Resource
win10v2004-20260911-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fih.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target Fih.exe
- Size 80.9MB
- SHA256 1a1a43c0b05219a43fec98800f89ba66c1a092389f52dfc20c6c22e06323c41a
- MD5 e29bd8e3c0f817a808cb3916c78dcf0f
- SHA1 f1add2318d4749373917390009cbe4e596ea90be
- SHA512 25b21b7a169aec8c9ea36a4b556f9a5d5d8df0ef2aeb7bd1ffebf7a63351f12d7275809452db5f43e7fcf14ac35473b3a0677f77c8ffd377cdeba969e45eb940
- SSDEEP 1572864:Bog4f/KYEUZl7XNyjhQR5QMJJ8R/E0/utd0xywPhVrfP6j0qmkXodB5bO1P:BEf5EQlLgaR55oR/E0/kd0xxXfP40lr8
- TLSH T11E0833956D4712FBE7F894312486AC3AE6CD31CD4F9781EF169422223F27E483E35962
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.