Overview
overview
5Static
static
1bin/gsudo.exe
windows10-2004-x64
1bin/gsudo.exe
windows11-ltsc_2024-x64
1bin/rig-shim.exe
windows10-2004-x64
1bin/rig-shim.exe
windows11-ltsc_2024-x64
1bin/rig.exe
windows10-2004-x64
1bin/rig.exe
windows11-ltsc_2024-x64
1share/fish...ig.vbs
windows10-2004-x64
5share/fish...ig.vbs
windows11-ltsc_2024-x64
5share/rig/_rig.ps1
windows10-2004-x64
3share/rig/_rig.ps1
windows11-ltsc_2024-x64
3share/zsh/...ig.vbs
windows10-2004-x64
5share/zsh/...ig.vbs
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
bin/gsudo.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
bin/gsudo.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
bin/rig-shim.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
bin/rig-shim.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
bin/rig.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
bin/rig.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
share/fish/vendor_completions.d/rig.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
share/fish/vendor_completions.d/rig.vbs
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
share/rig/_rig.ps1
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
share/rig/_rig.ps1
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
share/zsh/site-functions/_rig.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
share/zsh/site-functions/_rig.vbs
Resource
win11ltsc2024-20260911-en
General
- Target bin/gsudo.exe
- Size 4.1MB
- Sample261029-2rwcmacf52
- SHA256 80429dbaf959263030c87fc610c2f1052b08c63575e1dad56cac5e502eecb414
- MD5 cd9ca49714ca97c78a1da84bf1e58e84
- SHA1 64ea3ee312922774c74d2a8a77170217521eac7d
- SHA512 cd55596402ff1578b2f054cea34435a74f91f7dcf1ade8578fbd561d46eb760b627b34590d09c7f17011b0db8c2b594646482c3c51067aa723943ab0f16de860
- SSDEEP 49152:IsOTyIe/mfHR9/zVFlheaNJ88/hQzKNg2V6SpaOkGscSZ231DIwz99c3hV3rKd2y:KBVFDhQx+zLzE
- TLSH T17F169E1593E900A9E437EB38CA65D233DAB07D925734D24F0698F6062F73A508B7F726
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1672 gsudo.exe