Overview
overview
5Static
static
5out/0Harmony.dll
windows10-2004-x64
1out/0Harmony.dll
windows11-21h2-x64
1out/VersionCheck.dll
windows10-2004-x64
1out/VersionCheck.dll
windows11-21h2-x64
1out/cheat.dll
windows10-2004-x64
1out/cheat.dll
windows11-21h2-x64
1out/loader.exe
windows10-2004-x64
5out/loader.exe
windows11-21h2-x64
5out/smi/Sh...or.dll
windows10-2004-x64
1out/smi/Sh...or.dll
windows11-21h2-x64
1out/smi/smi.exe
windows10-2004-x64
1out/smi/smi.exe
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
out/0Harmony.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
out/0Harmony.dll
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
out/VersionCheck.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
out/VersionCheck.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
out/cheat.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
out/cheat.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
out/loader.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
out/loader.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
out/smi/SharpMonoInjector.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
out/smi/SharpMonoInjector.dll
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
out/smi/smi.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
out/smi/smi.exe
Resource
win11-20260130-en
General
- Target out/loader.exe
- Size 47KB
- Sample260509-phr8dsgv3y
- SHA256 dae6f100c6a4179cabbfd2865a37ca6cf8b765970f16d99f4fc92ce69783ba23
- MD5 630958eb38545edbbdbb5bbf345c3bdc
- SHA1 68a6739e2f5a08e3864a0657246c8f7e92cb8728
- SHA512 4b0bdd780004c9cc62649d68ba0888fa8c03d8e9e1fc144ceae63642fdab2b2b4e14f763c2b2ac1e12d0ac5a4d85b74f0b40ea6854f73adf626d42b9c019c0bb
- SSDEEP 768:gAkcAsXLwLPc14EXwnFMl37XaVUbdbz01wz3ZJB:yrbc14EUE4Gdbz8m/B
- TLSH T13423FD9C766072DFC85BC472CEA81C64AA6074BB931BD243E45726ED9A0C99BCF150F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral7/memory/4544-2-0x0000016797DD0000-0x0000016797DE0000-memory.dmp ConfuserEx - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4544 loader.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4544 loader.exe