Desktop.zip
- SHA256 3acd07d0cfdd6651a69944cf6ac6d0e9872464163cf35d1a0f06931600638568
Static task
static1
Behavioral task
behavioral1
Sample
bat.bat
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
600 seconds
Behavioral task
behavioral2
Sample
python-3.15.2-amd64.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
5 signatures
600 seconds
Behavioral task
behavioral3
Sample
receiver.py
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
600 seconds
General
- Target Desktop.zip
- Size 35.7MB
- Sample261110-ll69yaed38
- SHA256 3acd07d0cfdd6651a69944cf6ac6d0e9872464163cf35d1a0f06931600638568
- MD5 00095369bcc6a99a452ed345361057c1
- SHA1 e0d34d9bee6312c7a97dd03eee1460c07a6fc1c7
- SHA512 5043369a04f4008be9171149f3796b5090884eaba77b2a5876987d703c549766813d8b863d1aedad3d3d2cc19723dcac2738d61d31598811d3dfba65408df535
- SSDEEP 786432:d4PuzLWCLlm0SwfTHMlpR9oeuGmwuNMSJ3PS8GT7ES:iuzLWCLo0BTslpNufyWKB
- TLSH T13487333AB4ECEF88A55818F9C148711E4701790D760DC239E769ED9C7C5F9F3A2328A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
Desktop.zip.zip 35.7MB
-
bat.bat27B
-
python-3.15.2-amd64.exe.exe 35.9MB
-
receiver.py2KB
bat.bat
- SHA256 9a41dda4cffa684f2c04ca51d972e8987a864b69762f77011bfad48c51bc0a48
- MD5 fe9e581fd8aacca03709951f2b219dd6
- SHA1 411bcc36d981f84a8115c2a6e0bfb130e450a694
- SHA512 885c09e9c6b174641f1fa65bab64d0a63b1d00246e91ac85665b721d28af9654ed02ff1cbdb2b5dc6134b030a8e8305d17e2576fe25946fdd70cfb8abaf551a4
- MD5 SHA1 SHA512
python-3.15.2-amd64.exe
- IMPHASH e277f1464e7729ad9df5ec047611738a
- SHA256 06e225a228191b0f4d1dcf6905fbb21bf9f6970d13a2ec63137ab9bee76f15aa
- MD5 e4ba8f4268f9006c875743e0a242562f
- SHA1 1dc703dfdce66e168e47926a8451cd41dd562c40
- SHA512 66f074abe7f275afd04a111166c193ad296836d40042493f04967585124bfde06c07c0f6bdd5e012c5212e0095aa50e103230a73fcca5caed6cccc241723cce6
- SSDEEP 786432:9xY7E0JOS/EP8LwQCD/kB9BhVo0Usg4RRLbdgsCo0y:oE0JOS/EkLKDcB9a0PXZ
- TLSH T175873332B0A89255F6B404B3E258A1356F28BE280745C13DE7D8FD5C7D7B8E2A733592
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:f0:53:22:05:fe:97:c8:e0:c6:81:0b:c9:cb:39:22:ea:3e:7f:6e:aa:59:1a:b5:20:e7:c9:b9:5b:cb:1c:65
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
Chains
Oct 25, 2026
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
Serial Number
33:00:09:12:b5:a8:ff:c7:25:0e:a6:c6:42:00:00:00:09:12:b5
Issuer
CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 24, 2026 - Oct 27, 2026
Subject
CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2031
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:60:72:06:24:8a:4a:05:b8:d9:00:00:00:00:00:60
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 17, 2026 - Sep 14, 2027
Minor OS version
0
Major OS version
6
Entry point
197349
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
InitializeAcl
DecryptFileW
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetFileType
GetStdHandle
EncodePointer
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
CreateFileW
CloseHandle
ExitProcess
CreateFileA
SetFilePointer
WriteFile
GetLastError
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
lstrlenA
HeapSetInformation
GetModuleHandleW
GetProcAddress
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileExW
FormatMessageW
lstrlenW
MultiByteToWideChar
IsValidCodePage
LCMapStringW
ExpandEnvironmentStringsW
GetFileSizeEx
GetFullPathNameW
ReadFile
SetFilePointerEx
SetFileTime
Sleep
GlobalAlloc
GlobalFree
CopyFileW
GetLocalTime
GetModuleFileNameW
CompareStringW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetCurrentProcess
FindFirstFileExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetWindowsDirectoryW
GetNativeSystemInfo
GetSystemWow64DirectoryW
GetModuleHandleExW
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
DuplicateHandle
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitForSingleObject
GetProcessId
OpenProcess
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
LocalFileTimeToFileTime
SetEndOfFile
ResetEvent
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadLocale
GetStartupInfoW
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetModuleHandleA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetCurrentThreadId
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
GetTimeZoneInformation
rpcrt4
UuidCreate
Name
.text
Size
307KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=28900,
count=145, id=261, version=28900,
count=19, id=260, version=26706,
count=19, id=259, version=26706,
count=44, id=261, version=26706,
count=23, id=260, version=28900,
count=2, id=262, version=28900,
count=17, id=257, version=28900,
count=334, id=1, productName=Unmarked objects,
count=75, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
receiver.py
- SHA256 f65e4004c52fef6be3ef7080beab377bd8bf3d8543356e27e68fd6aa2547f2d1
- MD5 833fec3d76a52d4e8cb9f730ce1cbc1d
- SHA1 dffa275d02d3918e735f6a02b643b3b51b4701d5
- SHA512 79fdfdb8589c87f99d407d3df78c49fcbdddc2d58cdb6accde416be07c728a56a2b0d248eb1f4744f22ac9be1399e7016917fc5d80f420fdc0ed1eb3032bacf7
- TLSH T1C641E016CC2D0926C3C3E69564F180E18F29BC139A13547976ECDBD05F8D472E3AA57E
- MD5 SHA1 SHA512 TLSH