Overview
overview
7Static
static
3Push Tethe...er.exe
windows10-2004-x64
7Push Tethe...er.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
6$PLUGINSDI...up.exe
windows11-ltsc_2024-x64
6Push Tethered App.exe
windows10-2004-x64
6Push Tethered App.exe
windows11-ltsc_2024-x64
6libusb-1.0.dll
windows10-2004-x64
1libusb-1.0.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
Push Tethered App-amd64_arm64-installer.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Push Tethered App-amd64_arm64-installer.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
Push Tethered App.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
Push Tethered App.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
libusb-1.0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
libusb-1.0.dll
Resource
win11ltsc2024-20260911-en
General
- Target Push Tethered App-amd64_arm64-installer.exe
- Size 7.6MB
- Sample261027-bchvwazzbw
- SHA256 d9ec6186ba80cfffc65d57c90838fd2dd4b5da3467c1fa9b412c90fbe7986ac3
- MD5 135b20899e0710c1fe5f5720b66d12ec
- SHA1 fac1d469f4a445c9c60d449cba573c57f48ee939
- SHA512 0f890b049be04e6702c25e5eab2ef46c8d6eb1a958df45359802e101f9d6eb02a3ced396ce4d576a18d82291d88c5e0045b6dffa7faddae104dc88587bf14557
- SSDEEP 196608:OG70yAyMGBZ4LPwHffHAR7gE66XNPtbPsiB7kHud6j:O9OBZ4LPw/IR7d66914e7guUj
- TLSH T1AC8633766061D20EDA9A743088EA03344FE1D91B9E78431F45F09D77EFE288DEEBA550
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4288 Push Tethered App-amd64_arm64-installer.exe 4288 Push Tethered App-amd64_arm64-installer.exe 4288 Push Tethered App-amd64_arm64-installer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Federico Pepe\Push Tethered App\Push Tethered App.exe Push Tethered App-amd64_arm64-installer.exe File created C:\Program Files\Federico Pepe\Push Tethered App\libusb-1.0.dll Push Tethered App-amd64_arm64-installer.exe File created C:\Program Files\Federico Pepe\Push Tethered App\uninstall.exe Push Tethered App-amd64_arm64-installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Push Tethered App-amd64_arm64-installer.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Federico Pepe\Push Tethered App\Push Tethered App.exe
- Size 14.6MB
- SHA256 93ca0cd72ad20e0c5555cd9acd85a352ccc45ee0c8bc78471c3236bc2a6bbcdc
- MD5 7309e67c0ddc5c6b2d7d2cdebd0cfafe
- SHA1 3659b7b2cb7774d7bc1999f1d94e3f9d43a8c437
- SHA512 1bb34c4b66905021031eb7f0e8dca0def226e1b510d54232b4c905aedbc3fbe564627dda20c52774f00089dd4620f34eb179bc7faa5a8daa512a233b354c2037
- SSDEEP 98304:vXSd3Up6Od8qhkF/7a21O9aoJy1Dm2duOsUzE/P68DBMztcZwbGKw6aY0WEdm/ZS:/WEIOaqhkMYo41Dm4uOsUg/PPDgUwe
- TLSH T1C7F67C87E96500E4C5AEC5358672A673BB717C490B3027C71B64F6243F76BE0AEBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nst7432.tmp\InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nst7432.tmp\System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nst7432.tmp\ioSpecial.ini
- Size 1KB
- SHA256 4ea75faaaf62d492b54e27df95218016f53c72c8d88265e277332348bbaa828e
- MD5 b8a28ce7b76cf3c3be490547a1bab3b1
- SHA1 b93ecb11b8ce7feda6f1792a5e5122fef3cbe1bc
- SHA512 61e53fdf5f3e2705f12f13bafea8ef2e7265ba4c75e973f2f5e57045c299a21278629127f5559e0b877861bc4c42f47cf9530fa5dbd5701c13f56e74fada19da
- TLSH T1941160133AF95414E2BAFB08EFF5807987397856582DD91E95C10A0F48E6B408923BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nst7432.tmp\ioSpecial.ini
- Size 1KB
- SHA256 929f2f58c77b5671ad431d0c128da44e61709a37e26b1a447f91fa87827e2327
- MD5 bc1064b8859b45a587ebd604a7cc6026
- SHA1 433277927acb54f9ad7b6e0be23396cddf7c3fd1
- SHA512 181cc734c4c060c217ad004cedb5ccf626c88a4ade8d8c3b8c8f6e144145a1ea7fe818e514e236b36791505d58c41419a4178d8038f941501dc11b0161cfccfc
- TLSH T16521AF437AF81504F3BABB14FEB540748B3A7856AC39C60D41C0090E09E5B408963BAB
- MD5 SHA1 SHA512 TLSH