General
- Target usbdeview-x64.zip
- Size 124KB
- Sample261024-al4y2aex9v
- SHA256 1acfeaac8352313a607d2aa55a8a56e3662054ccf0bb05fc1eb909e1159152db
- MD5 4757c96bf9d4feb1bc71f16bc37b9a32
- SHA1 8fb836b3d0b2b2d12e6d3d706330ce060bd0c339
- SHA512 d89ffaf26220d471779a263631e0aa6756c1a8cb483ef18b71bdeede060e3cd1c7eb52cf81aad731667cf2126fc5a3b90d623c36802d0f7a67b780e9c8d353be
- SSDEEP 3072:DRgzf7HY9/f75jkNi6ttLEDIFj5aUHdFLja2gOg:I7HWIWqj5/LGcg
- TLSH T18CC312C8247ABCBCE3C80A3154470823139B254F7F75B65AE55FA8B37DAB058079887A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
USBDeview.chm
Resource
win11-20260911-en
1 signatures
60 seconds
Behavioral task
behavioral2
Sample
USBDeview.exe
Resource
win11-20260911-en
5 signatures
60 seconds
Malware Config
Targets
-
- Target USBDeview.chm
- Size 24KB
- SHA256 bbbc6ca7ac498ffaac06b8b71a4508628d6d21af465bc93e6d1a6c6844a805fa
- MD5 fc776429bb0abc9695c84c48911f3dea
- SHA1 b9ba2cb353443682c0f98632c8a7bdc8460eaf04
- SHA512 4bd409b13b0bd322b918feb0381f3df2da26a1bbd44ec3ba95278c80a36626f1686890fa5cb5f7e331315320a0f6277e74867804a388ecf2a1aa61480d33ab9d
- SSDEEP 384:8zoFWDWtVSnVqXId0fDIrnVg/fQVebJ8t1l/tgN64xWYK:8zfDqVi+IFrK/fjJGl/QC
- TLSH T16BB2D0A1B230853DC417917FAF84A886DB6CF4B1D831178A73A7810DEAAEDCD99C7481
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target USBDeview.exe
- Size 192KB
- SHA256 57f7cedd6bc0be6adc9a4816a5893bc42fd0c6b05ee993fe24e86d36975e0c20
- MD5 47dcf62390925838511422da7543614f
- SHA1 4c3ba6133c5e17439915b7288d954ab4fb4c448c
- SHA512 327b4fa63aa3216ba436cf74a5224247d2795c35e18197c8f123d37dab2c6b5524ee324657686301775dc0eec482f7127a59e3b6a7c418d2d5812cbeeed30f5a
- SSDEEP 3072:z51/nUN6gFRi8nzOPxzUwKUVpfVgqgxPp/mTwtvIJd6du23sjMZ1PUP7g84oavMj:FsDiWyt97mdT3iy1PU1GK
- TLSH T1E3144915A3F800A9E4ABE675CEB28623EAB17C541B34872F0770DD6A0F27350FD25726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.