General
- Target extractthis.tar.gz
- Size 102KB
- Sample261102-e9ljtaea98
- SHA256 dac38e347a3b39ce734997ab485b32024968e29cce9065f9ba0d414dba52cced
- MD5 25412533c5f50bd0ad1d4352869c97f5
- SHA1 d0b226ff4e9946612d8c62066c44817c5ebb4a51
- SHA512 7fe5aea0f5cd1a41287784e6d8546728cd634ded00524758dea0d9c5154e198c2fc48506760c171959fc1a6d143afa995cb5adb86c3add35147b3dd74c46aef8
- SSDEEP 768:1HOnk/rVurmlCbNkv/Smmil00DsKTNZFPJXpDQUN:1unvrmlANk3BXPNZD
- TLSH T120A303DF2D4E35930F3D819C29C571473AE221C62F35121A387A456FB09E2B9D9AF81E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
Behavioral task
behavioral1
Sample
.bat
Resource
win10v2004-20260911-en
1 signatures
900 seconds
Behavioral task
behavioral2
Sample
.bat
Resource
win11ltsc2024-20260911-en
15 signatures
900 seconds
Behavioral task
behavioral3
Sample
duplicate_zip.py
Resource
win10v2004-20260911-en
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
duplicate_zip.py
Resource
win11ltsc2024-20260911-en
16 signatures
900 seconds
Malware Config
Targets
-
- Target .bash_history
- Size 2KB
- SHA256 e0091ea29bccca88fa3a1e05cb25cf61d3063ab440a2298ef555d94321a09a7a
- MD5 a38a6eb268ef830a940d7afcbb64569b
- SHA1 575209eb132d2c22420647e63facaf0868766561
- SHA512 2e066e208c12a1d970b85aee2e01f123209f9a3485ee2b1e239b110fc490913e35c07342f8f3fe28968b34b97483096588d8ee97c38d919b59d461c8faa03858
- TLSH T123511259AC51B1B584FEC130F9884663F25DE783CD47494102358EE62B4F8AA67FE31E
- MD5 SHA1 SHA512 TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target duplicate_zip.py
- Size 846B
- SHA256 a8dcb58f30f5744c7c5ad2551842dc2b3b0d26ab45e70370f3f3ca7b20d76361
- MD5 11ee437a713d684a8dc282ee9f0e6543
- SHA1 4458a618e651b1f9c8d151fd20431a30a42a6b25
- SHA512 dfee88420374d2ac21e7e57b2c380e00117787976b58b02f3c7023700cd88b519f1b8f31cc7fc4a578bed6e6628b03d5bcf6e0b8328234dda9c3c8a4f3d4a5f1
- TLSH T1240125665C8C04F356129DE4E8C5555D873269579B413134F1FC86D8CBC0691CFF2CBA
- MD5 SHA1 SHA512 TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.