General
- Target RithmicPatchAtas.exe
- Size 5.5MB
- Sample261026-2tpymaw12m
- SHA256 771073f13bb576854d1a57ff545b1e6da217d147d08101b8da57b3e25a4e5fae
- MD5 3b4ef0ad0f801361f5241bc967433673
- SHA1 632244c5c46404943477474049d16d5ceec343fc
- SHA512 8891ae3772b599250198770d3885e32dc87db9555ed532ddff04755731820fc2ec55ba84755c7df2447f2b1972835d3f5cf2533031d6c240170cfe57fe190d0a
- SSDEEP 98304:1JobN6aKGTGniDje8XwwixkzHLDlt5CcXlMxiqMtcR0ykcyMxzEdqW:1CZVKUGniDSKi+bPlt5C8+xiqMtcGdqW
- TLSH T15946338A770C5EE8FAE11EB019605A0816C930502EFD82D557B8DB8EE7D3E57C2D3791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RithmicPatchAtas.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
RithmicPatchAtas.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target RithmicPatchAtas.exe
- Size 5.5MB
- SHA256 771073f13bb576854d1a57ff545b1e6da217d147d08101b8da57b3e25a4e5fae
- MD5 3b4ef0ad0f801361f5241bc967433673
- SHA1 632244c5c46404943477474049d16d5ceec343fc
- SHA512 8891ae3772b599250198770d3885e32dc87db9555ed532ddff04755731820fc2ec55ba84755c7df2447f2b1972835d3f5cf2533031d6c240170cfe57fe190d0a
- SSDEEP 98304:1JobN6aKGTGniDje8XwwixkzHLDlt5CcXlMxiqMtcR0ykcyMxzEdqW:1CZVKUGniDSKi+bPlt5C8+xiqMtcGdqW
- TLSH T15946338A770C5EE8FAE11EB019605A0816C930502EFD82D557B8DB8EE7D3E57C2D3791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10Executes a VBScript file via the Windows Script Host.
Suspicious use of NtSetInformationThreadHideFromDebugger