General
- Target zahid_antivirus.zip
- Size 349KB
- Sample261030-wdcepsez8k
- SHA256 799f62a1ccde676df8799392dc92d428d47c8243e5dbe7a1b90ec244c6eedb83
- MD5 fa9f0feadfda1fda22cfc015013e3366
- SHA1 26f242dad08e0d85f1d99d543c7b02907ae61f9f
- SHA512 b068daf13170b8d02997b84c8b49521636362672342b960002c0a8c8ad6d5d6c55adfd2a8856853266e7cb24bf491a8dfc5592d7cab5b0ddd8ab715f7b0879d5
- SSDEEP 6144:5RgaYmifhzMtOfqe7AXnY2RxltEPB0WwT5VU99PN579h8jzJZWZzjAhpOzipJN3c:EaTifD7AXdEPOVyv57wP7wz0h0ziJ3ta
- TLSH T1A0742391918222C2E3936D71D6AFDD31A24F224F7E0CE517EDBF26930CD6955C6A1C70
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zahid_antivirus.zip
Resource
win10v2004-20260911-en
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
zahid_antivirus.zip
Resource
win11ltsc2024-20260911-en
26 signatures
900 seconds
Malware Config
Targets
-
- Target zahid_antivirus.zip
- Size 349KB
- SHA256 799f62a1ccde676df8799392dc92d428d47c8243e5dbe7a1b90ec244c6eedb83
- MD5 fa9f0feadfda1fda22cfc015013e3366
- SHA1 26f242dad08e0d85f1d99d543c7b02907ae61f9f
- SHA512 b068daf13170b8d02997b84c8b49521636362672342b960002c0a8c8ad6d5d6c55adfd2a8856853266e7cb24bf491a8dfc5592d7cab5b0ddd8ab715f7b0879d5
- SSDEEP 6144:5RgaYmifhzMtOfqe7AXnY2RxltEPB0WwT5VU99PN579h8jzJZWZzjAhpOzipJN3c:EaTifD7AXdEPOVyv57wP7wz0h0ziJ3ta
- TLSH T1A0742391918222C2E3936D71D6AFDD31A24F224F7E0CE517EDBF26930CD6955C6A1C70
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects KillMBR
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.