General
- Target ShadowsocksR-win.zip
- Size 686KB
- Sample261113-vcc46sys4n
- SHA256 a4fef3c602ded2fb21ab6503f194d897eb3033b16606627c39ff312a2fd0895f
- MD5 3248b2e1cb2fbc76209b043d1b83a20a
- SHA1 90df69ece3d2507d628e0b2e72b27ebf743a9784
- SHA512 a81563914f94c0fd84ac82aafabf26f2e534568bcd884aa8162e19b72ac92c0414be7facca1d32c7a34f6eb8a0e389094203ec7dbfad4c8839f45f0b3fc5877b
- SSDEEP 12288:63/a/Iw5FnzMVnSzCipiHO4gmHmqUJPjupTO/lK2YRot72pSHQ:63/inzinSztpiuvmH5UopTsYe9iT
- TLSH T1ACE4337DED2EEE28C3E5D8DFE169542129A2FFA5C919260235F377A417B0412DCF0409
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ShadowsocksR.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ShadowsocksR.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target ShadowsocksR.exe
- Size 958KB
- SHA256 26a049bc2ec394dd4f8029becadd0fb1c59ecfb1f85c284b5f2f17e53b3c637a
- MD5 15988c6190052b9ef4cdd7c487091523
- SHA1 c94fbef3098bc48da47650cc9acee1d520593e84
- SHA512 1e2e49816cb2827beaa7fe2a686f3efaf43a932a16fe9951f3dffecccc62ec987a4ee2bd8f6610bea1f49f7bf8f1ecc9d084fd90038d77fb2f0d66a7f460f28d
- SSDEEP 24576:KN7FDa1z5QTDy5uFroNc9wOi50VJiwf4/ZHlpzwgyROi:KNhmJ5Qfy5uFroNwwV50V3AhDXyw
- TLSH T1FB25BF4273E80E0BE5FFC3F9A9B6541193B0A526D6A9F7CD4C8230EE1AE1B90D941717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.