General
- Target Fih.exe
- Size 83.1MB
- Sample261024-ltakyayt2l
- SHA256 4a55f187f98340f4371a5476c9b3ca6ea97223bd418bb9136dc9e9b886b43ace
- MD5 221000e5b93d00c5508c56b6634cf8ff
- SHA1 647faf82a83b7cee912dd9ff41af4fe0f3a43d57
- SHA512 6b0945a0696118876a782a810172339e889266ac3c90301881a9a210234a08eea8fda96000e7ba9318134e2acad8ad72f489c4b94df4f96bbfd6ef7593060925
- SSDEEP 1572864:oo74f/5YEUZl7XNyjhQR5QMJJ8R/E0/utd0xywPhdqrfP6j0m7mJjodB5bo1P:ojfuEQlLgaR55oR/E0/kd0xxP+fP40tl
- TLSH T1871833556D4222FBE7F894356496EC3AE6CD31CE4F9781EF129022223F27E482E35971
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Fih.exe
Resource
win10v2004-20260911-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target Fih.exe
- Size 83.1MB
- SHA256 4a55f187f98340f4371a5476c9b3ca6ea97223bd418bb9136dc9e9b886b43ace
- MD5 221000e5b93d00c5508c56b6634cf8ff
- SHA1 647faf82a83b7cee912dd9ff41af4fe0f3a43d57
- SHA512 6b0945a0696118876a782a810172339e889266ac3c90301881a9a210234a08eea8fda96000e7ba9318134e2acad8ad72f489c4b94df4f96bbfd6ef7593060925
- SSDEEP 1572864:oo74f/5YEUZl7XNyjhQR5QMJJ8R/E0/utd0xywPhdqrfP6j0m7mJjodB5bo1P:ojfuEQlLgaR55oR/E0/kd0xxP+fP40tl
- TLSH T1871833556D4222FBE7F894356496EC3AE6CD31CE4F9781EF129022223F27E482E35971
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1