roningloader | 3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71 | Triage™

Login
Reports

Overview

overview

Static

static

3

_3218d686f...71.exe

windows10-2004-x64

_3218d686f...71.exe

windows11-21h2-x64

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

CalculatorApp.dll

windows10-2004-x64

1

CalculatorApp.dll

windows11-21h2-x64

1

S2SzqO.exe

windows10-2004-x64

7

S2SzqO.exe

windows11-21h2-x64

7

oP6MiopZ.exe

windows10-2004-x64

1

oP6MiopZ.exe

windows11-21h2-x64

1

Resubmissions

11/04/2026, 19:27

260411-x53xeaay7x10

02/04/2026, 17:58

260402-wj6kqshv7r

01/04/2026, 16:03

260401-thhq6sdz9q10

23/12/2025, 14:42

251223-r3c1batjez10

Sharing

Copy URL Twitter E-mail

General

Target
_3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71
Size 81.4MB
Sample260411-x53xeaay7x
SHA256 3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71
MD5 2ed6cdd9fc98fb1158a20e6c979ac3f0
SHA1 6e1e9c7116c42b44416bad21836221e838460e97
SHA512 996ceb13313edd3b2bda9eb3f35fd5024927c7c684150eb7ceff47671e38051d0147c5b4e72246220c2b64d69066d32de7cd3b607c01c2843c117ccd5e526df7
SSDEEP 1572864:9rJSBE6eSbIwck3oo9SU6KurqlzB4mAhL03iWnJwcHreXw/oUZ2V:9rJonCk3tSWumicznJw0eXw/oUEV
TLSH
T15F18334C16A92D4FE5127E30FDD4BF160B845CA56AFDE543870CF9B2B181AC4B6C682E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

roningloader dragon_breath apt defense_evasion discovery installer loader

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

_3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

20 signatures

30 seconds

dragon_breath apt defense_evasion discovery roningloader installer loader

Behavioral task

behavioral2

Sample

_3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71.exe

Resource

win11-20260130-en

windows11-21h2-x64

12 signatures

30 seconds

dragon_breath apt discovery roningloader loader

Behavioral task

behavioral3

Sample

$PLUGINSDIR/StartMenu.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

30 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/StartMenu.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

30 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

30 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/System.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

30 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

30 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

30 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/nsis_tauri_utils.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

2 signatures

30 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/nsis_tauri_utils.dll

Resource

win11-20260130-en

windows11-21h2-x64

2 signatures

30 seconds

Behavioral task

behavioral11

Sample

CalculatorApp.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

0 signatures

30 seconds

Behavioral task

behavioral12

Sample

CalculatorApp.dll

Resource

win11-20260130-en

windows11-21h2-x64

0 signatures

30 seconds

Behavioral task

behavioral13

Sample

S2SzqO.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

4 signatures

30 seconds

discovery installer

Behavioral task

behavioral14

Sample

S2SzqO.exe

Resource

win11-20260130-en

windows11-21h2-x64

4 signatures

30 seconds

discovery installer

Behavioral task

behavioral15

Sample

oP6MiopZ.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

0 signatures

30 seconds

Behavioral task

behavioral16

Sample

oP6MiopZ.exe

Resource

win11-20260130-en

windows11-21h2-x64

0 signatures

30 seconds

Malware Config

Targets

- Target
  _3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71
- Size 81.4MB
- SHA256 3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71
- MD5 2ed6cdd9fc98fb1158a20e6c979ac3f0
- SHA1 6e1e9c7116c42b44416bad21836221e838460e97
- SHA512 996ceb13313edd3b2bda9eb3f35fd5024927c7c684150eb7ceff47671e38051d0147c5b4e72246220c2b64d69066d32de7cd3b607c01c2843c117ccd5e526df7
- SSDEEP 1572864:9rJSBE6eSbIwck3oo9SU6KurqlzB4mAhL03iWnJwcHreXw/oUZ2V:9rJonCk3tSWumicznJw0eXw/oUEV
- TLSH
  T15F18334C16A92D4FE5127E30FDD4BF160B845CA56AFDE543870CF9B2B181AC4B6C682E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

dragon_breath apt defense_evasion discovery roningloader installer loader
- Detects RoningLoader loader
  loader apt dragon_breath
- RoningLoader
  RoningLoader is a multi-stage malware loader used by the Dragon Breath APT.
  loader roningloader
- Roningloader family
  roningloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 32KB
- SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
- MD5 6ebdde247cad8468575f1f2a4d7ae2a2
- SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
- SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
- SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
- TLSH
  T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  CalculatorApp.dll
- Size 210KB
- SHA256 8cf49d5efc1f513a1395134bdc0cffb7c7cfcfc8847f336cf082311fadc3a6a6
- MD5 4bd57e739438b6bfabde18545cbc3775
- SHA1 4808dc2f1077e0879ac503d3167286e2cc9e1f29
- SHA512 924585cd04177b35786dc4e700fc576110e59f2d3aa0b49d65235d6ab1c53f2198b9cd7d5d05d7989c9916ad31515d37093be8479b20d52b66fc01042c3248e5
- SSDEEP 3072:N/BwWz7rktkwq0Sz0LeSozJ7tZqOCLmrn1OzeUHUw0szkAMnfkcnNHi:jz7xqSz0qXzFtZqOWYWfoMDcNC
- TLSH
  T151247D16769104BCEC67C078C2574A56B672B8850B21AAFF03B44279DF1FBE66B3CB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  S2SzqO.exe
- Size 47.8MB
- SHA256 4f5d71cb54f21aae3b7e03781ccd838c3870ab4566084e0e3f35884b6666fa52
- MD5 a272405fcc7184922f57b3e85044b944
- SHA1 f52567bd7a4d30430fa1bcbd9b740a3fb47eee2c
- SHA512 12a42223a880b7f8d06a1d3f6322da7c97c7fe1e124cc434931276d6b5621fbce83646bc22bdd4ea78203a04a99dd00cce5387fefb51f2baa60a2c727f1ce75b
- SSDEEP 786432:EZR80pLevjNZs0IqynwTuF8pMwqYpgA5xaq31ybizqL4qDn8tOmOYlHT808Fway:ED8Cg3IqywyGpLgAOqlXzg80bET0y
- TLSH
  T1D6B73317E34E233EF57B5A391563EA50193FAE11661ADC578AE04D0CCF6A0601E3EE27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
behavioral13 behavioral14
- Target
  oP6MiopZ.exe
- Size 19KB
- SHA256 adb28491ec232854d8d8998f407cd5076adcc58ece8bdd356264a2735c018701
- MD5 199804569ec82f2d0d63a2f00d6627e4
- SHA1 e5c6ff9feb32dcf153c22622b14b36fd433d1093
- SHA512 fa8f6b6e6238eb24462141b36131933fbbee9d0e17907c0c0bf9bd942db7d4c7ad96339e20735f67e278da79a32f05c451f29a92a5a075006101c42d4c91aa47
- SSDEEP 384:NN7PJTQ/tBaxc8IcbUi+7AOA6HMf82utc2N4Wm4W:NN7PJX+c
- TLSH
  T16492CC6403E84196FB43A7F9CC31FCEADA726BDA1422B86571DC1648F35E88C2275D93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dragon_breathaptdefense_evasiondiscoveryroningloaderinstallerloader

behavioral2

dragon_breathaptdiscoveryroningloaderloader

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

discoveryinstaller

behavioral14

discoveryinstaller

behavioral15

behavioral16

© 2018-2026

Terms | Privacy