General
- Target new.exe
- Size 127.1MB
- Sample261024-vrvyjacy8r
- SHA256 a7aa1338f3f01f4736a2780234f3c0629448e9afa80b9d86090be40ba0c5f83a
- MD5 6920eb79b08591493b7b7b18eedabb70
- SHA1 9a11a74254830c6e65957c50b80d8c9d19bf469a
- SHA512 ad722a4175a1bd17c4a59e50053a4dc18716c5c81835e2230644b29c41766361c77ac0984d32da45e39b04b7ef0ae427f617e9adc668cbfde49f32144c8172af
- SSDEEP 3145728:49m4MZo4+nMbOqMBYoY1bxETb/xOucshSu/K1kVSChbwH:4HMigOTeoY1NCJO8hg6VSCZwH
- TLSH T1E1583386B7E026B3CD3996B882CF43017BB58EA52354D7C703827756AD7D6E1EC1A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
new.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
new.exe
Resource
win10ltsc2021-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
new.exe
Resource
win11-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
new.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target new.exe
- Size 127.1MB
- SHA256 a7aa1338f3f01f4736a2780234f3c0629448e9afa80b9d86090be40ba0c5f83a
- MD5 6920eb79b08591493b7b7b18eedabb70
- SHA1 9a11a74254830c6e65957c50b80d8c9d19bf469a
- SHA512 ad722a4175a1bd17c4a59e50053a4dc18716c5c81835e2230644b29c41766361c77ac0984d32da45e39b04b7ef0ae427f617e9adc668cbfde49f32144c8172af
- SSDEEP 3145728:49m4MZo4+nMbOqMBYoY1bxETb/xOucshSu/K1kVSChbwH:4HMigOTeoY1NCJO8hg6VSCZwH
- TLSH T1E1583386B7E026B3CD3996B882CF43017BB58EA52354D7C703827756AD7D6E1EC1A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Modifies boot configuration data using bcdedit