Overview

overview

10

Static

static

3

3eb7f1dd02...50.exe

windows10-2004-x64

10

3eb7f1dd02...50.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3eb7f1dd0274bd4ffcdf463876ab547503f9e6120db22c5e1923fe16cab71b50
  • Size 1.7MB
  • Sample260204-td2ngsdz4d
  • SHA256 3eb7f1dd0274bd4ffcdf463876ab547503f9e6120db22c5e1923fe16cab71b50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
d0glundefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target
      3eb7f1dd0274bd4ffcdf463876ab547503f9e6120db22c5e1923fe16cab71b50
    • Size 1.7MB
    • SHA256 3eb7f1dd0274bd4ffcdf463876ab547503f9e6120db22c5e1923fe16cab71b50
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryd0glunransomwarespywarestealer

    • D0glun

      D0glun is a ransomware that has been active since 2025.

      ransomwared0glun

    • D0glun family

      d0glun

    • Renames multiple (294) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks