General
- Target tgwsproxy-windows-x86_64.exe
- Size 2.2MB
- Sample261027-p2npbac15x
- SHA256 335ce4152863d820103e498f9485d6f56528b464e9325c4decf9d888adbb8951
- MD5 d2a2968e9a8b86b2c5a8df721f1ae64e
- SHA1 3030d6507d3a3d26bbfa8f9708057689c1ab3352
- SHA512 155d3bfda10f144bf3ef504566d19aa362199ce29fb35589d3523d8a1999b751ca70ef535c47bce69e1ac381bbfb11451638c123039af2aac6174ccc497389c1
- SSDEEP 24576:xj07jbtoNMDYb+SjE+Fycbhmu4jEP5ACNxMVy1ORz4a6kdOmKHqFM3VIH06iyCa:xEjRzY+Sjau4ClOR0a9JYIU6i
- TLSH T1A4B56C03E29580E9C49EC078C357D537AA72B89D0A35B2EF2BD45B112E3AF906F1D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tgwsproxy-windows-x86_64.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
tgwsproxy-windows-x86_64.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target tgwsproxy-windows-x86_64.exe
- Size 2.2MB
- SHA256 335ce4152863d820103e498f9485d6f56528b464e9325c4decf9d888adbb8951
- MD5 d2a2968e9a8b86b2c5a8df721f1ae64e
- SHA1 3030d6507d3a3d26bbfa8f9708057689c1ab3352
- SHA512 155d3bfda10f144bf3ef504566d19aa362199ce29fb35589d3523d8a1999b751ca70ef535c47bce69e1ac381bbfb11451638c123039af2aac6174ccc497389c1
- SSDEEP 24576:xj07jbtoNMDYb+SjE+Fycbhmu4jEP5ACNxMVy1ORz4a6kdOmKHqFM3VIH06iyCa:xEjRzY+Sjau4ClOR0a9JYIU6i
- TLSH T1A4B56C03E29580E9C49EC078C357D537AA72B89D0A35B2EF2BD45B112E3AF906F1D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.