6a95103ed0be3ea8020375dbe695cb9c0a7b12cae98bad5906f314d8b28c05dd | Triage™

Login
Reports

Overview

overview

3

Static

static

3

FULL BUILD...er.exe

windows10-2004-x64

1

FULL BUILD...er.exe

windows11-ltsc_2024-x64

1

build.bat

windows10-2004-x64

3

build.bat

windows11-ltsc_2024-x64

3

code/driver/valk.sys

windows10-2004-x64

3

code/driver/valk.sys

windows11-ltsc_2024-x64

3

loader/kir...er.exe

windows10-2004-x64

1

loader/kir...er.exe

windows11-ltsc_2024-x64

1

tools/BeDaisy.sys

windows10-2004-x64

3

tools/BeDaisy.sys

windows11-ltsc_2024-x64

3

tools/WdmDiagSvc.sys

windows10-2004-x64

3

tools/WdmDiagSvc.sys

windows11-ltsc_2024-x64

3

tools/kdmapper.exe

windows10-2004-x64

1

tools/kdmapper.exe

windows11-ltsc_2024-x64

1

tools/sig_scan.py

windows10-2004-x64

3

tools/sig_scan.py

windows11-ltsc_2024-x64

3

x64/Releas...re.exe

windows10-2004-x64

1

x64/Releas...re.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

Target
KIRKWARE SRC.zip
Size 10.0MB
Sample261029-ypncfscc86
SHA256 6a95103ed0be3ea8020375dbe695cb9c0a7b12cae98bad5906f314d8b28c05dd
MD5 d78d569ec4ee97bfabb1f70a6928a109
SHA1 a83b5778a84a3486543fa76f1e01449372b2b17d
SHA512 111145c77d88bf40019e73cb3146475d921b11f40470169701f86fec98e175440d2ccba45372cf3836ee41ba56dba23c067d6926a03d2c9acff94d279aa82c3f
SSDEEP 196608:UWNggFzWNggFSNXJ+Sgq/rZ4WnXBPrmi5+MknXsQnEp1lP28Mj4PZGzvp/:UWN1dWN14NZ+Sgq/rlXBjmipasQEhPDU
TLSH
T13EB63315EA2D784CF876D7F7E52878206700DE5EB130689B88C8965CE92937F1F1F286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

FULL BUILD/kirkware_loader.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

FULL BUILD/kirkware_loader.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

build.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

build.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

code/driver/valk.sys

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

code/driver/valk.sys

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

loader/kirkware_loader.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

loader/kirkware_loader.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

tools/BeDaisy.sys

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

tools/BeDaisy.sys

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

tools/WdmDiagSvc.sys

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

tools/WdmDiagSvc.sys

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

tools/kdmapper.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

tools/kdmapper.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

tools/sig_scan.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

tools/sig_scan.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral17

Sample

x64/Release/kirkware.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

x64/Release/kirkware.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  FULL BUILD/kirkware_loader.exe
- Size 1.2MB
- SHA256 793eae8e87722db796d53180f561cf875e462f87b8c5a016a99dcad570baa1f3
- MD5 6c2adcb7bfc7685dfb288cd959835472
- SHA1 5926873043c73fe2c35d0b8e2175fff03724f10d
- SHA512 4e50728117eb57b9f6bc2a320b308c51db2a1e611f31885e1318f11aead0684b1addfe713108bfba63f491a8edc4680e8943258acfc35f4ac6d63ae579667519
- SSDEEP 24576:KFa1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZ20B/nk:u0K05WnHr019VWPN4OZjB/
- TLSH
  T1F8459E4BE6A610F9D1BAD038C556651BFEB13895073097CB67D00A662FB37F0AA7E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  build.bat
- Size 1KB
- SHA256 2375f4d83f86148dbe560b3717e7fc5cea174b03497a4a2a7b926fd221f1d18b
- MD5 9f6ee4859e33d8ed02e6c3406e10e5c6
- SHA1 491978f3510c07b584ffb628e7bd6ccaac103166
- SHA512 182d7c8c56ae4d2be89adea522213a5ffa8c5089500a643b1a2cffabbf4ca75c1f691a3da5acbb51922014be5c75f3e5084a72e8efd23a0aa4c71ec538b8ae08
- TLSH
  T1033144B6116ED0527022988ED7A108C07DAA66C303395F7E2096512FD1CA7C9F1FDDD1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  code/driver/valk.sys
- Size 27KB
- SHA256 87cd2d97ccf190fb599d960d319e2c6cdba400b2279503f392d7b3521473563f
- MD5 eb688129bc1fbc5cf717954ea0718ba5
- SHA1 fb9da680674933d45896a48d21749f26f260e301
- SHA512 f91cb342fc964de6e7da252ba08a52a0e7b3c483ecc2e301ac8cadaf2da06a7c963421dcd88acede8c0f84dbc95deb787a10d9a1980362cbc5afbaf984c6fbdc
- SSDEEP 384:uKL22xajr5g5zrrXkR4cTUFg8K2m4qmsammid9kKVZXhGX2CL:uA0tR4cTUFgtfmsammi8KzXhGGa
- TLSH
  T125C24E8AE3A624F9E5FFC23981B1129BB6717A16431197DF4560C5385D27FE0AD39F00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  loader/kirkware_loader.exe
- Size 1.2MB
- SHA256 793eae8e87722db796d53180f561cf875e462f87b8c5a016a99dcad570baa1f3
- MD5 6c2adcb7bfc7685dfb288cd959835472
- SHA1 5926873043c73fe2c35d0b8e2175fff03724f10d
- SHA512 4e50728117eb57b9f6bc2a320b308c51db2a1e611f31885e1318f11aead0684b1addfe713108bfba63f491a8edc4680e8943258acfc35f4ac6d63ae579667519
- SSDEEP 24576:KFa1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZ20B/nk:u0K05WnHr019VWPN4OZjB/
- TLSH
  T1F8459E4BE6A610F9D1BAD038C556651BFEB13895073097CB67D00A662FB37F0AA7E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  tools/BeDaisy.sys
- Size 18KB
- SHA256 35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b
- MD5 4c0c465499d6ee54352570d2807d12d8
- SHA1 332a6b3bf722e97780d09328d420fc8815f8e514
- SHA512 53124eadac016c0ad5c2937d09a8a37a4fabda32b56bb3fb90defdab9fa2ba149841056f992e0fb7154308aa71b4f5352a5dcbb5d7ddecf0b5aa036f1899c5ce
- SSDEEP 384:e2regI48Iq1qhvYoP6MUMv5g5M/b0475a:eaUi/UMvTJa
- TLSH
  T15C822CC3A39C58E5E31DC1BB46661A27D1B2BC25272377DF0251C13A2757AE8753AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  tools/WdmDiagSvc.sys
- Size 20KB
- SHA256 48e670cf6ee75e7d139e74aaa3c5531f42dede80c03218dd5773988f35fff957
- MD5 ce95344e1d78eec761fd3e5363c3b097
- SHA1 df4a40f8c06edde365f36f37bdc49fb1b0717328
- SHA512 8ea6f7965d8ccc4fc7cb62245490e1dfa26ff18784339919676003a6756e7091dd4b27262f0c0be5232bc7b5377a2a8518e9480e692af447c6a7b7e591422b99
- SSDEEP 192:uh009g77XA1uvF0o52OS4+KEQRg+R7P/Xr6G61VqG/XddwvKklHVdvG5Sg:Eg77JF92OS1K95XgkG/PwvS
- TLSH
  T1E69283D7E2F651E8D4F6D93581467A2ABD72B42587208BCF1950890B1FB2FE0B93C784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  tools/kdmapper.exe
- Size 150KB
- SHA256 3d0326be77fd736ee57d9ec3722c1e7be2d7ecfb1b3e56adcc4f055198263d84
- MD5 103349d9ab1968719b2f6f7e8e57b1bf
- SHA1 ec2b4dcc62038becd7dd7458c704ab8df4cd638b
- SHA512 b2315dc066803a7b4c86c05a7d0b71f8d36682da7728c7aef6783895094343b826cea7b88ef6427efff29d81218e2e4e2957cedb18ad1c9e029da2d1f0db6f0f
- SSDEEP 3072:eEQeuLZ8OB7/Uc7sMDcFS0Dzri2kwBmJTQSaMm5/6YjCNHwU3:lgNpBDUc7ncFSQniXJWljuQU
- TLSH
  T15CE32A5787A9106DF1B7D6B9CAB24911EB717C950B74D2CF135048BA0F227D0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  tools/sig_scan.py
- Size 5KB
- SHA256 9bf75511e252c2e9c17993169cf60ed2618a5da0d47414aa48124b18dfc3da6b
- MD5 74b8cac1999fab71da07e00eb5d1b99c
- SHA1 81526998e1d8f21840977d2bbd2a45bf9447c822
- SHA512 df7b63b4773b53003461dc853d2ac9e1dac13b0c1db27dba39c607ff324480a48a8d21c4886b65267b86f1fd018a398f8aca1a43b5b4896d8716d4a09abe356a
- SSDEEP 96:xI+UVlObmSbn62WwZFMiPPMZxEBBmY2sg7O+hZXh:xI+oAbd+wZeiKabmY2sOOUj
- TLSH
  T1ABB1238AD4B42CDD92069D5B2F5E9806B61DA90719456E3CB86F517C1F0E93C83B08FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  x64/Release/kirkware.exe
- Size 847KB
- SHA256 0132c8f794791d954c68e02b228fc70377be7c5839bf41e8298051c0bd44f001
- MD5 cdb5588d4ed206abd8ef2b520bca7d6b
- SHA1 4339d37a2bb02a099fb11da5ffe5426de71e6184
- SHA512 ee760ca953dd5520ad106cd4db6485688daa6506bfa14be6e0bab1607f73b3295d2e69da78a9e71146689131ad9c717e48973bb7b148421a10481f991a8abb03
- SSDEEP 24576:/a1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZ:/0K05WnHr019VWPN4OZ
- TLSH
  T182059E8BE5A250F5D4BAD0389596712BFDB138EA05349707ABD44E563BF3B30EA8D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

© 2018-2026

Terms | Privacy