General
- Target b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.zip
- Size 4.1MB
- Sample261113-vxkprad17x
- SHA256 ba0bd947b1762f6b7c8f10c514e6ce4010cf8dd931edba20854e19e565c8fd69
- MD5 82d3da6288b4fe6a973543d3631801fb
- SHA1 7a5a2990ee23f962271895225edaae9e64719806
- SHA512 868a416ba938fefa7f2ecec7271735616905463f8116a94e2b5d660e5f05d7e385415fb62c3086b6e4d7659c90332e8632858af5f76674acc647656e8f781967
- SSDEEP 98304:5+MBpPhqOS9CAUnqcjx+HiEY1euG75SvlHB/8jf22:5tPgX9zcF+HZ39S5Bb2
- TLSH T1C41633783491B2D01D167DD80DE6A542C2383B28268CBF9383796747BB37244F7BE699
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.exe
Resource
win11ltsc2024-20260911-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b
- Size 8.9MB
- SHA256 b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b
- MD5 2d85768b2ee8bcd304ce9a5725f3bcf9
- SHA1 4ccbec3e26c0a19a74cf9a956e4f403179ed6d27
- SHA512 f1fea8df52806299134313a9f776feb3855c3dbb20956261bd87ea90a4f64d4aa6830bb00b894c25a3894499a3db9ff825d9981ee814e087ea2ea14d3e32af94
- SSDEEP 98304:pzAVQj4XrjtVSan/MjAIIEomk6E5H0cpk+YgQggAeKbiUUe22SOyEM4sdu0BEj:pF8XtVSaUjzrop5HHN0Cj
- TLSH T122966B07ECA145E9C0E9D27486629263BB717C491B3123D32FA0F7282F76BD06EB9754
- MD5 SHA1 SHA512 SSDEEP TLSH
Executes dropped EXE
Adds Run key to start application
Checks whether UAC is enabled
- Custom signature
Detect suspicious telegram bot
Detect suspicious telegram bot.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2