Overview
overview
3Static
static
12.36.4-k8s-node.tar
windows10-2004-x64
12.36.4-k8s-node.tar
windows11-ltsc_2024-x64
12.36.4-nob...ode.mf
windows10-2004-x64
32.36.4-nob...ode.mf
windows11-ltsc_2024-x64
32.36.4-nob...e.vmdk
windows10-2004-x64
32.36.4-nob...e.vmdk
windows11-ltsc_2024-x64
3k8s-node.xml
windows10-2004-x64
3k8s-node.xml
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
200s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
2.36.4-k8s-node.tar
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2.36.4-k8s-node.tar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
2.36.4-noble-k8s-node.mf
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
2.36.4-noble-k8s-node.mf
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
2.36.4-noble-k8s-node.vmdk
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
2.36.4-noble-k8s-node.vmdk
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
k8s-node.xml
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
k8s-node.xml
Resource
win11ltsc2024-20260911-en
General
- Target 2.36.4-k8s-node.tar
- Size 344.5MB
- Sample261029-veee1s1vbz
- SHA256 b1b700d42f890ed16d7627d54dc4ac33f7a4a69e36bbe05ff7b3758d70edbb0e
- MD5 3ff6101c9adde3ad592c099fadbbb7a6
- SHA1 f8f83ff07f79d8d2696c9efa6ac01bc618a80737
- SHA512 2681f26b1efc439a7dab6ebc59489269f12053e8d6fe20fbce3d2f7966fea6760687e6258e9da1a31993f6c2010e9351a5e693cb813a17b68bb43efe0eee7a60
- SSDEEP 6291456:rBLzU6uJo5CK9J6kMEcvKy8QHIpBb6djtfy2q9Ol6thpJoQqyV5:1UDt82Hx8QHIp9yjuc0hpJ5qa
- TLSH T1CE09339CB0705F09DD9A2733E9703FD4621CA8AE94A20DB2A32D87EE675B3C1175543B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2488 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2488 7zFM.exe Token: 35 2488 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 7zFM.exe