Overview
overview
7Static
static
3World.Moni...up.exe
windows10-2004-x64
7World.Moni...up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3_up_/api/[...pc].js
windows10-2004-x64
3_up_/api/[...pc].js
windows11-21h2-x64
3_up_/api/[...pc].js
windows10-2004-x64
3_up_/api/[...pc].js
windows11-21h2-x64
3_up_/api/_api-key.js
windows10-2004-x64
3_up_/api/_api-key.js
windows11-21h2-x64
3_up_/api/_cors.js
windows10-2004-x64
3_up_/api/_cors.js
windows11-21h2-x64
3_up_/api/_...mit.js
windows10-2004-x64
3_up_/api/_...mit.js
windows11-21h2-x64
3_up_/api/a...hot.js
windows10-2004-x64
3_up_/api/a...hot.js
windows11-21h2-x64
3_up_/api/bootstrap.js
windows10-2004-x64
3_up_/api/bootstrap.js
windows11-21h2-x64
3_up_/api/c...rge.js
windows10-2004-x64
3_up_/api/c...rge.js
windows11-21h2-x64
3_up_/api/download.js
windows10-2004-x64
3_up_/api/download.js
windows11-21h2-x64
3_up_/api/e...h]].js
windows10-2004-x64
3_up_/api/e...h]].js
windows11-21h2-x64
3General
- Target World.Monitor_2.5.23_x64-setup.exe
- Size 26.9MB
- Sample260418-bh7fesev2t
- SHA256 e8120199d9b1622f4fdb572cbac3b0de26499aad8d181659a9f50fe828adf121
- MD5 83a2bd380013c2fdf488c24b25ae2011
- SHA1 bc2ebc791373c53e1a6c503607750a28ed6bd687
- SHA512 6a1976868eab84c17148feb7f75fec5635cbc2cbad7af2d28999717e524019d0565bad54af436c391cec2f07b7c538ad3ca8f95eab8224d6e0a51c38b2d4c745
- SSDEEP 393216:tmh0r3DUUpp+pfrnzabVIeqKsFV7lcoVMjVfAQ2N7HOyg/SK0/vodKdu7Bw:tw0r3QUpIZ2Nq7Rez4b5KhO
- TLSH T17E5733779430B72FCC815E788D7E616EAD85CCFAED450A14BA8695E132F9638FC44B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
World.Monitor_2.5.23_x64-setup.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
World.Monitor_2.5.23_x64-setup.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
_up_/api/[domain]/v1/[rpc].js
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
_up_/api/[domain]/v1/[rpc].js
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
_up_/api/[domain]/v1/[rpc].js
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
_up_/api/[domain]/v1/[rpc].js
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
_up_/api/_api-key.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
_up_/api/_api-key.js
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
_up_/api/_cors.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
_up_/api/_cors.js
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
_up_/api/_rate-limit.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
_up_/api/_rate-limit.js
Resource
win11-20260130-en
Behavioral task
behavioral23
Sample
_up_/api/ais-snapshot.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral24
Sample
_up_/api/ais-snapshot.js
Resource
win11-20260130-en
Behavioral task
behavioral25
Sample
_up_/api/bootstrap.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral26
Sample
_up_/api/bootstrap.js
Resource
win11-20260130-en
Behavioral task
behavioral27
Sample
_up_/api/cache-purge.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral28
Sample
_up_/api/cache-purge.js
Resource
win11-20260130-en
Behavioral task
behavioral29
Sample
_up_/api/download.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral30
Sample
_up_/api/download.js
Resource
win11-20260130-en
Behavioral task
behavioral31
Sample
_up_/api/eia/[[...path]].js
Resource
win10v2004-20260130-en
Behavioral task
behavioral32
Sample
_up_/api/eia/[[...path]].js
Resource
win11-20260130-en
Malware Config
Targets
-
- Target World.Monitor_2.5.23_x64-setup.exe
- Size 26.9MB
- SHA256 e8120199d9b1622f4fdb572cbac3b0de26499aad8d181659a9f50fe828adf121
- MD5 83a2bd380013c2fdf488c24b25ae2011
- SHA1 bc2ebc791373c53e1a6c503607750a28ed6bd687
- SHA512 6a1976868eab84c17148feb7f75fec5635cbc2cbad7af2d28999717e524019d0565bad54af436c391cec2f07b7c538ad3ca8f95eab8224d6e0a51c38b2d4c745
- SSDEEP 393216:tmh0r3DUUpp+pfrnzabVIeqKsFV7lcoVMjVfAQ2N7HOyg/SK0/vodKdu7Bw:tw0r3QUpIZ2Nq7Rez4b5KhO
- TLSH T17E5733779430B72FCC815E788D7E616EAD85CCFAED450A14BA8695E132F9638FC44B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
-
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target _up_/api/[domain]/v1/[rpc].js
- Size 952KB
- SHA256 56d3bc4c016f081c4131b2d980ee2255d26bc5d7e8ff5865fd38f7c4c3bee786
- MD5 03123effb7a1f5a06ffca272278c048e
- SHA1 44cc94c6dd9cc20ac69ae87775505f5ac4db741f
- SHA512 2b72f1bed8c93d253109f50c218dc7cd7b882fd43496ec0278fdaf3b67a6cf0a68a61941c9cfd8d2a784415eb4d6e2221ae00a4bcc2899a50724b2acd82e8488
- SSDEEP 12288:hLEuzVlIlnau9gv+svBirUpVS4z386+l0C:Xog+sJirUpVPI6+l0C
- TLSH T16825195D28F711A247A331B91A1B5107B230A603354DEC69BAAC93901F8DA7DD2F7BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target _up_/api/[domain]/v1/[rpc].ts
- Size 14KB
- SHA256 77410d16a1c9aebbf005105588d72711d341108be8be467e0e38f920f1c2695d
- MD5 b0c5f991906a19193bc91121702968f8
- SHA1 efa68b206f5012c957bc0b543ba4d84810dcdfe6
- SHA512 606f40160773d49307933e79518818ed219ef6a9acf58d76e2de374dc2904223e5f8f9e1a78116c8aab4efb16cdbaed4a1e7c6244f4e1ee3b21809c9383747bf
- SSDEEP 192:p4SbSOdlSZRyR32e4pUBG0x9/pmTeaeJ9Cp/agOq8OaSaG1IIzAHQEv3fOX1:pJS8MsR32e4pKZKPm6i9uzEv3fI
- TLSH T1CB62317F901551FB8EB623AE8E169D31832D4256365069E3377CEB3B7BF088841B864C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target _up_/api/_api-key.js
- Size 2KB
- SHA256 5ab6d38014a064e654dce8e38787cdb78c19ca5a5bba400a647e077f1c1487aa
- MD5 aefc45f89798f25f71e865903ae3419c
- SHA1 d9a97fe135d25a298af44aeea3760ef26afb5e03
- SHA512 31d9005f4fff09c3d77ef1d943709f7347636706b1af62266a0fd902b1b0f5325d31ca29062283a6746ba3609ff6ae9c3a21f8d66665b893912b0644dfb86f64
- TLSH T1BF511496B2CBB0185EB163F547467D1FFA8BC521600A89A4F27CD1D177D2B610252EEC
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target _up_/api/_cors.js
- Size 1KB
- SHA256 3b95f0c3317b401ea985841965fb88ee6ba8b107047698625f4116de021688ab
- MD5 db0c5bd6f889470a51cd259a8ee02968
- SHA1 df719c2c8dd2315ef278b398e4dce0e5f3c162a2
- SHA512 47b403a3634ff3816ff865ff48261a3603e1f94df6009d0202de794fea72f52921d9f26fc1fe3facf0919f380b1c5e2e87842d24aa97c9931927471f94ac10ba
- TLSH T14521DFAD37627448D2B37BFC07163C3DB203A252B007D5DBB878E4D2179632A4112CAC
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target _up_/api/_rate-limit.js
- Size 1KB
- SHA256 35f9c5efd6dac10d71c2834131a7413cfa5238d0e2bf80a6c79b184e3e6ba831
- MD5 ef1c5869b07c3c674c223dd87fed234b
- SHA1 d67e0505b52d1ebea7a2c0862909966f81ae559e
- SHA512 87aa252fbbdd4c7a6751cbbeb8f015e8dd074f368b1ea48a2e52352ca7e764b963b1de484ded0ef2d35517a2b7631ced148e0266b8b7fd5a8ccfbb36a9f6e935
- TLSH T1AC31FEE21623747D0E321269EA27C604F635E3AB25208051B57C45EA6FBE6DC817BD8F
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target _up_/api/ais-snapshot.js
- Size 3KB
- SHA256 b16141882b7397b92d741e934c7d2042fe5562ffe7febee10ac2ba2635d368fa
- MD5 0558a0e86adc7dc3794e7cc4c9cce2b7
- SHA1 c9fcf79874c2db1a924ae1c9ccaf5a4f85bbe85d
- SHA512 2705f936df2bc21f02daec3f320b6c0e638e82365b1553932d9724282d28c507ac85b695a4e0a0f50d47c848439de55fb900527e3ee7bdf965c7ca84c5c1b39c
- TLSH T1CA7133865853255A0FB352B6F3135C26F627A32A3662C2D57D7C40A62FF45C8C227CCE
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target _up_/api/bootstrap.js
- Size 3KB
- SHA256 a7ce2cf62f559272d4cc00a689374e2bc0d5bb33c961c5f24b9a7e9a41a81d5a
- MD5 d6dbc69718c64880b33f5ac2bb89a665
- SHA1 798b2d53e6c68161b3cc4dc54ecb6fd164ff320f
- SHA512 7d04d1c8073e51a3bc6021940c8e4e01c2c379b7a4c09c539fefd330aadf1ed023ff6ee31bf1c44147f90a6d8ae1d85285f5989814de0a8e307db939b7ee118c
- TLSH T1937174D32C6230155E3295F6E6578C2AF61796113602C5A3FB7C48541FE298DC1B2EFE
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target _up_/api/cache-purge.js
- Size 6KB
- SHA256 49fbd7d5c526bc8562bc2df607470338b2f96712a207a981b519029c70012c11
- MD5 191b4bb65c85038e7c3891efd88d5730
- SHA1 121c7ea5a8c95dc3ec072c0debe621b228ae4845
- SHA512 399c2e0c62637a20a2b88b00b75bf24287de4e3a2fab6f117d4b397adac703a388f107456624babbcc74ca3957af4cafbfeda741550a6529b717f842bc8b6fe1
- SSDEEP 96:A2KVGfw7cdECELRnZct7HSw6IUsR7fdH7xZK2YTEuUzQh1T8s2BZ8Pp9bdOgIVYM:uGycQ6Nl6KTG2Qh17GZ8x9WEbK7l
- TLSH T172E1A4A428A6781A4E7713A9C793402BFF37C5223856C290FE3C01553FA7694C266EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target _up_/api/download.js
- Size 2KB
- SHA256 259dcf481fdb50a999d88bf15beb41d1fc9f6a0a411bd054f5b16a7ac1567172
- MD5 963140e52f1cbfad4b81e8ecec3de300
- SHA1 b127c1d6b80eab897a4877badb416122a06c3376
- SHA512 d0a84151354550acbeed0b0a4bc1ed86c378608c029a003aaf9e2b4c2a72b14d1b1987347ca7d54ae82d44889a2ca32d3c090737d47e8abd972ec56c2eac67dd
- TLSH T17D514349E1B291020B310BB9B99B851AF41A863B3748D19CF97CA2447F75321C503FFD
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target _up_/api/eia/[[...path]].js
- Size 3KB
- SHA256 c0d1a830d8121aa6ce2b39d338fa4329c1d3630d997b4e42201ebdeeae872790
- MD5 702e6d73f8fbc479cecf5ae143b0adbe
- SHA1 606a1ff138680e6a9ebc3ad13ede497c5925027a
- SHA512 b1aa85bcd1bc5790ce0e84ae2fe55ac7c2e78fad8153502a109d7e12c3e1d77b3ca6233ad7865e3bf42ae43502bd709eded85f79eb3a716e6ae8af854ade1ad6
- TLSH T1556144DBAC1224030E76A3A8DB27442FF707572B3649C5867EBE46201F768ACD551ECD
- MD5 SHA1 SHA512 TLSH
Score3/10