05d2276bd3fe6d7343feb59627866d3300f0eb91d5c530ad3e506bd751534a5e

Resubmissions

04/05/2026, 04:14

260504-etmryafy9q7

04/05/2026, 04:08

260504-eql18sfy5n8

Sharing

Copy URL Twitter E-mail

General

Target
社媒助手-v3.2.4.crx
Size 1.5MB
Sample260504-eql18sfy5n
SHA256 05d2276bd3fe6d7343feb59627866d3300f0eb91d5c530ad3e506bd751534a5e
MD5 6f94bc1e95833898958183fb1ca2aecd
SHA1 745a450191b3acc0500d305cb281e5330b5a6ea5
SHA512 0c1e1a89cf62cf693cac8a5d2664e67d13d2ce02df873fb98a9f55f5b1f0cb9d0fa0380775f3f3ce1f46a55b9e05d073207491f60b87322659527b055632f19e
SSDEEP 49152:iEzG4kkw1zNPhxDmITkFFoeqvOMr2LTHN:iV4kkaNPhBTUFBqvOMcTHN
TLSH
T1F075334A74CAE416C51C913D9CFC05771A2D24BDB102D4BFA1A9ACE06A34B92BF66CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  社媒助手-v3.2.4.crx
- Size 1.5MB
- SHA256 05d2276bd3fe6d7343feb59627866d3300f0eb91d5c530ad3e506bd751534a5e
- MD5 6f94bc1e95833898958183fb1ca2aecd
- SHA1 745a450191b3acc0500d305cb281e5330b5a6ea5
- SHA512 0c1e1a89cf62cf693cac8a5d2664e67d13d2ce02df873fb98a9f55f5b1f0cb9d0fa0380775f3f3ce1f46a55b9e05d073207491f60b87322659527b055632f19e
- SSDEEP 49152:iEzG4kkw1zNPhxDmITkFFoeqvOMr2LTHN:iV4kkaNPhBTUFBqvOMcTHN
- TLSH
  T1F075334A74CAE416C51C913D9CFC05771A2D24BDB102D4BFA1A9ACE06A34B92BF66CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence
behavioral1 behavioral2
- Target
  assets/bilibili.svg
- Size 1KB
- SHA256 cc82e7eb88f4452f64045397da6e80a533358e602dab5c7ee4043519e0b4aa92
- MD5 a32a34afa1b55d9304ff9ebf99584496
- SHA1 335ae5c0309185bef9f14ef40c3698c925c174bf
- SHA512 89d5c3ca3bc092c56d2c8cd37aa18ac899678e20c4441846242f9a6a64dfab0ce6dc02020fa6ae616f252c5482e3013a8a7d5521a4bb48c483ebee94ec3499c5
- TLSH
  T1364156EC6D2C1BBC49CB82BBEEA450C4770D60A472768D38D8CC5464B083A9BE59BD57
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral3 behavioral4
- Target
  assets/douyin.svg
- Size 1KB
- SHA256 3b471c8ea24a7b65af2da74556193929c0f2535e83d65c0ca8f1fbbfc47ec64b
- MD5 d9d5a07592404c903230d25f26150391
- SHA1 e45971ef1097e6ca87724daedb26f4020638eee0
- SHA512 e74d0a39cb25dcf728766b0069e0618be68fe2afd2f6bff2ba96eae709fabf5117738929b430c3aa9cec297aa9cc51a389031a763796d2fede5c15f28f774970
- TLSH
  T1BF4141A1AB2E6BAD4009E3E94716D54125CE20F7F28290E4880DFA20B00F5F7CD52DAC
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral5 behavioral6
- Target
  assets/kuaishou.svg
- Size 1KB
- SHA256 7395eaf91fd0ff704047eabec5d16b7f1753c57ee8c7bcb73a3326e33ea1d2b2
- MD5 1e3813367b70bc62601289ebe8853576
- SHA1 90bf187aaaa38860b00d391a74bad9af79894b89
- SHA512 10a39acfbdc4da247222e06749b1d8ec6701e8ca74660c5e9fa0ee7a9430f711f25fc1394a19e80096900859d9f5f4d222e44a1f460f0afd135d66c635187756
- TLSH
  T16B319D72872C0EAC422F02D81165D159A1CD46DA72938D3DD66EEE32F90B5D6CB27C4C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  assets/notice.svg
- Size 1KB
- SHA256 c1715b601e261042f14d29e6ebc3179e98970dd811472b9eccbb8007e19bcf76
- MD5 82ce635291b6afc049ec57d7206dfbdd
- SHA1 629fbc5279559e10f34f5904ce257a41eed4644e
- SHA512 33eea09919c35402a2376220d604a990da5d7fb66fc11c9041324fb9b139dee832376bff4f0ce5d79d73ebaf6f3d8f8e36e4404e5deea73fd2b9ff69bae6402a
- TLSH
  T19221F0CCABBD51ECA01DEBDA80BC4110162FC5C9E9821568C8FD7B218B42696D703DCC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  assets/options-azv7urj4.css
- Size 38KB
- SHA256 b7c4ef6bdd6542b04cdce31dd0b3b4fc6755e0d5ba9d9b37adbf920f7b47d20d
- MD5 02daf2e1c5f4effc3775948129e83bea
- SHA1 002255df4c09c989d6e42deeb579c2e639a9f0bc
- SHA512 928e492ef36b7b13f4ca230d09a3f2b5248a0b33b3482dc22c1e7e164ccf0809db8de435f5eaa66553e97c7a0eda3c0846e1cb689619c30a5740d45320b167ed
- SSDEEP 384:kwBcVyh4Fi142AUu6StCA+6SC7M6AQ/+SexrG2LR0LXZU:QQZ/TStCn64rxrVR0XZU
- TLSH
  T19F034328A768503F7C17D0F9D6C8B86DF61AE2C1DF3A9AE6EC85132593D13F61C62604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  assets/pgy.xiaohongshu.svg
- Size 2KB
- SHA256 0d01d5176facbc2c495b6fddb7870eea53f2fecc6d7a025ac68ee45a5abf6ae9
- MD5 6390b7067b5430c28fda01a56979369d
- SHA1 a1619273d4f6ce1501a4e07e949c01638bbb1f72
- SHA512 14109ad7bababcd0ee62cf0aaf89c60037d4279d3aa1d4e470750249b45eb6d15d9a8ff8e3b9c06d5e9086b100a0226a09d7a7178854afc1a7565540e8efc673
- TLSH
  T1504162994AADD63C880A87C4DFB6C2CA032414C4E94A9E7CC88C2A7654D7184DF57DDE
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral13 behavioral14
- Target
  assets/sidepanel-DHBbuRep.css
- Size 37KB
- SHA256 cce4f49f8358d176c8c510d8f05d21ff5e4ee587f02558740236a3ccfeaa2923
- MD5 3716901ef1d6b404e743b491ea0aede1
- SHA1 7a7335fcf94e6e001d7661863779530f5df03db4
- SHA512 cf879691a13a10ddbb3fe1fdc75eaff60eb0524b29c1847924266ac888f870c656443d87f88484969d46a38cc0cd48e7068b19c2a0cf1bb4c951f747c764dfe2
- SSDEEP 384:kwBchgkAUu6StCA+6SC7M6AQ/+Sexrpy62LR0LXZU:Q9TStCn64rxrpypR0XZU
- TLSH
  T1EA034328A668503F7C57D1F9D6C8B96DF616F1C0CF3A9AE6EC851321A7D13F60C62608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  assets/tiktok.svg
- Size 2KB
- SHA256 fc58b56ee110328320d2f9918e57261efc47e3d9af0871f83bd7ecfa764f5b3e
- MD5 0666f5d0642961536c61caa1ca623d2e
- SHA1 9c304c6431376693bc61cad407f5dea1158f44d8
- SHA512 258c2fe28cefdd22f5d1046095667f9f8ce2ff4e71db228d3293f88ab2a8539bcb6f9d6421bc85d6574ebe18af580990ccaaf011581acf1318ddde66f1ca10e1
- TLSH
  T13051ABE8A60957AC242352DC71AC3C64A31E30B67ACA5D3C860D14E488C3D95DD177DF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral17 behavioral18
- Target
  assets/xiaohongshu.svg
- Size 7KB
- SHA256 5ffc04ff4315dd05388b4453b9563cba5e0589878742656fc215dd86da089180
- MD5 f847baf738a151a627b03a8dc5d8dca2
- SHA1 079cfd34283e04d3fb88bb1370733b3a5010bf86
- SHA512 fe15ffc8194c52bddf7908d3a36b70451d7af8bf9f015d6da994b1fdc6ad53b70b3803213c6ffe3bfc322dffec0a99965daa8f843795fd93d8a12e88cea24ea8
- SSDEEP 192:L1cVqhvHb1TrV3TjIVGwFe2Yw8YY7giCpMGRkoCKpr4:LuVSJVfWVYrAwKZ4
- TLSH
  T1C6E184F2DB3896BC5E1F0DE4ED271E4C121C2876BEC00CFCD19AD8C19996AF69E05845
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral19 behavioral20
- Target
  assets/xingtu.svg
- Size 526B
- SHA256 f296c1e37db61ab361f1751ef1f3fd6cffaf38cd47c900abb796db6ec1ee518f
- MD5 d47a1f4289c7a99fd1ebcb112b33a092
- SHA1 ccd177030fb4f29bd0a5be70e9e555e0dfd21e4d
- SHA512 35a3825e36e0c59743974a1fc9160e487f77e6bb38af65e4cce59f243fe249d13bb06248c78a11a9b67f1e8d8cdefadcd68c0fabbc92605e619d7a1c1a353ea6
- TLSH
  T10FF0C0DCD31DA930851C4749A3FC1BD4901F00CAD0CA119CE8412884C461EF62E0DBBD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  background.js
- Size 5KB
- SHA256 10248cdafbb80476a630666882cab21e54f949c9515d7350a69c5adaf1ebf7b8
- MD5 ee6d8ef7325d4cd017f6a876147d6f88
- SHA1 c9f8e088e4dc0aaf165ab7cbcd9bd13df9b44d17
- SHA512 9af4120a366dbb36bc7d45e969b3017e2a3fcedac897ddcfa58ba7a7fbae0cd1fcd177273734d4a5c2e0d37a4c775523ade8711e98c28b378c093a2bbc52c3a6
- SSDEEP 96:Z5xMZoZeQABG3NdxjcRrZ28+l1e4TKbjfnfihUtJf1yOfLag+XoRluYALXNtyKl5:OYeQsIN/228+ze4+bW+0+6XGluYAhF8W
- TLSH
  T1CEB1E76C6AF9E076F2546C8D50352313641C3A276CBAE0D1F17D4F761E68A8289AD738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  chunks/_virtual_wxt-plugins-CVOG8Irs.js
- Size 36KB
- SHA256 c1c28585988011322e8db12a842d48fcd7cc70f32a71010a316f1a2f78b923d8
- MD5 818f3e88b322eacdb45f7c0b236148ae
- SHA1 e190449f88061c6b1d01c0643d807f760680663f
- SHA512 a32d828d4fee887ba865cdeb5c518c64d006ed49810ab17311825be1d2586dac0b9a99534559c31c0417d30b65f3079fba64fc6ca31768d53dcf45caf91582a3
- SSDEEP 768:G/FoAkfWIoihj98LJ2DZZYfJFvewVQYkUsOGBtZkbgDKGWIpRVdSgxQHx9WEPnPb:Wo4+oIpkHfbr
- TLSH
  T182031A8931F9E2F1D1B1A8DA50BB041FB12E99BE744CD0D4B278D99929770CC8636F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  chunks/chrome-ei6IVMWn.js
- Size 6KB
- SHA256 4ddde2f67a587bf716a5c003b1e94db11423a9ff3db458a0e980f28d4bd910a4
- MD5 6eafba69157514b3ec740e22eebdc79c
- SHA1 01cbf7afc4859816e39a885399b9471c9d44cdc0
- SHA512 fdcd0b5559cf75c4db8ff38d1e12c113ebbffb3fc95b1b40a81aa095872d1a2a1fd7c84f19ade783e1cbb2c6ab0a1bc5eeaffd3960e2f994b8a53eba1440819f
- SSDEEP 192:PXZSOc4EUdsBbQTUfoZSY+nLI64IR1K+zvf4IGevzsvlt0zozp3vu:PXZ1cQdaQowYY+nU64I+ovfKOWiUt3G
- TLSH
  T154E1FAA224F7B0B2778538F9853660122121CA1AB8A78170BB3DDE9E6D19511FFF3F14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  chunks/feishu-sync-config-DQEibVHl.js
- Size 1015KB
- SHA256 8741635fa15b894ba53efe624789a17ac783b9aecdeaf7386ec46f6484bc03a0
- MD5 62612ebac4498996c4d991bd813cfbab
- SHA1 5027ae2d5c8558a7a351987fec4d2b546455bcbb
- SHA512 726f36a67347f286a9ea34b49309d729eb00c360dbe251b612c82a6cc5721297c8f8711945056173f3c4606ebd7a04176afd952bbbace31e4175fe1fcbdab923
- SSDEEP 12288:6oD5zcYFy0YcaKLQE2oZ2Uwj9la9jcD+QcvKrZ8dhR92soe:6WHFyT9KLQEDwj9la9ID+QcvaZ8fRR
- TLSH
  T13A256CE87294B47556A781E9407F450AF33A3945A80CC8A0F279C8DE3AF0A0D9577F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  chunks/options-BHuSiEjE.js
- Size 73KB
- SHA256 57a9e51cc5e1f530a1699be889090396fd3278dc3ba77c42eaa274ad416deae4
- MD5 eaa9bf178935e93eaa3f2e6964acb8bc
- SHA1 776516180cf70c765bf28d680931d95680108eb5
- SHA512 354c5ec0c6a25004263ea3859af8eb33cf94e9cfb7d9a8319679133d80151b86e849439592cb6ca11002479146caa569cea1b10eb7aec95cc17645bf7b3d2079
- SSDEEP 768:De5AIFUKH75lG9oJsc4EvrHOE0dYQaOrz+k0yvi7K2iyHvkSHxePLttYCdVvlACt:N3Y7XPHOjwCz44fdtlztP10R6+KdDUZY
- TLSH
  T1AD73EA54E054EAFCE93B59C46D7F800CB11B1F88D5AD84E1F03FA4102BB0599B993BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Loads dropped DLL

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Checks computer location settings

Loads dropped DLL

Checks computer location settings

Loads dropped DLL

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32