General
- Target Updater.exe
- Size 64.4MB
- Sample261030-dy3hhsdb56
- SHA256 77d591ac1b6e35ca9838021b864098a40953f9d6b800c7c9edf8e54e05d09e50
- MD5 bd5b2cdfa120076c979eebe314e52efa
- SHA1 8b9f2e19f17b6ff6ea9d5314207bc056902d1bec
- SHA512 898b0a13eb81c68e28c0378eb4fd3a573838610b4c4440e6923abd10f8019c824c2743ec2223911dde6a7ad21e8324e2a70ab55a1b69fd3f06d42b1bee686627
- SSDEEP 393216:S9zczfVHDSqTG2MOB26e2blZcvbpmu7aT/g8v9p9wN1UjMIg8wkJ7XzuYy:TthMOU6e2MtnSlp9wNIDx
- TLSH T146E7AF15B3D80A16E63FC27DC6638112E7F1B8931352D6CF0558EA992F53BC1AB37262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Updater.exe
Resource
win10ltsc2021-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Updater.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Updater.exe
Resource
win11-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Updater.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target Updater.exe
- Size 64.4MB
- SHA256 77d591ac1b6e35ca9838021b864098a40953f9d6b800c7c9edf8e54e05d09e50
- MD5 bd5b2cdfa120076c979eebe314e52efa
- SHA1 8b9f2e19f17b6ff6ea9d5314207bc056902d1bec
- SHA512 898b0a13eb81c68e28c0378eb4fd3a573838610b4c4440e6923abd10f8019c824c2743ec2223911dde6a7ad21e8324e2a70ab55a1b69fd3f06d42b1bee686627
- SSDEEP 393216:S9zczfVHDSqTG2MOB26e2blZcvbpmu7aT/g8v9p9wN1UjMIg8wkJ7XzuYy:TthMOU6e2MtnSlp9wNIDx
- TLSH T146E7AF15B3D80A16E63FC27DC6638112E7F1B8931352D6CF0558EA992F53BC1AB37262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.