Overview
overview
8Static
static
3Nowy folder.rar
windows10-2004-x64
1Nowy folder.rar
windows11-21h2-x64
1Nowy folde...76.exe
windows10-2004-x64
8Nowy folde...76.exe
windows11-21h2-x64
8Nowy folder/Grape.dll
windows10-2004-x64
1Nowy folder/Grape.dll
windows11-21h2-x64
1Nowy folde...v2.dll
windows10-2004-x64
1Nowy folde...v2.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
159s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 14:05
Behavioral task
behavioral1
Sample
Nowy folder.rar
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
Nowy folder.rar
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
Nowy folder/CheatEngine76.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
Nowy folder/CheatEngine76.exe
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
Nowy folder/Grape.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
Nowy folder/Grape.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
Nowy folder/newest_xenv2.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
Nowy folder/newest_xenv2.dll
Resource
win11-20260130-en
General
- Target Nowy folder.rar
- Size 42.0MB
- Sample260511-rd5n2aft2k
- SHA256 702e1e9c6a7ba4bd7e669b734253805ed1af555ca52a3741142535ef9a2ba5ab
- MD5 4d7f0ca61252c998ca7db173d76f00d3
- SHA1 95824758c2db002dbd97c64bae759082467eba2e
- SHA512 591780f58ffe0c13615a6ead92c6d139e7fa122ee35b096f1ecc0bd5ce79fde56d65e6c78a99cf0c78eb22fd0d624960b04763fbb9386d60f82e1eeb01f655be
- SSDEEP 786432:qCCLni1IbAmzgrga5L79c7xc4TfJGzD25+B9fE/TvK3duf65MOW:HzIb3Msa5h0xcIIm52MbvKMi5Y
- TLSH T1D6A733B07FE9FAC5094B8CE550D1B6ECB110202F5B48A55E508361B1ACFADD25EAC7F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1112 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1112 7zFM.exe Token: 35 1112 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1112 7zFM.exe