5c2e5038a7cfc4ec0492ff4c60d5595695a73cd7b0b8dc500101f6fed324abc8

Resubmissions

30/05/2026, 01:20

260530-bp6sgacx3t

30/05/2026, 01:16

260530-bmvbnaex4j8

Sharing

Copy URL Twitter E-mail

General

Target
Syntex Hwid Spoofer.zip
Size 8.2MB
Sample260530-bmvbnaex4j
SHA256 5c2e5038a7cfc4ec0492ff4c60d5595695a73cd7b0b8dc500101f6fed324abc8
MD5 76f493ad3368d1688b09d422d76039a2
SHA1 45669b8bae062f3b4188519a76026ff75fe3b3be
SHA512 4f96785a02aecd5258bd3776783fe4e81be6499a7c10a828c841d23c5120877f5d90b7cb4ff92c0dc48003a8a42f90d2d9f04cdb9e3044d679f3ea7b0eb1bb96
SSDEEP 196608:QsAgilaDIhAQAuI7fuKW56EDb4s2hquFIOq9PBPXKXj:lAgilacZ+WhDbF2hqyIOgV6T
TLSH
T17D8633C381AC9F12B88D57F758ACBDD1D5E294B247FECA12CE788E6C055150F48A09FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Syntex Hwid Spoofer.zip
- Size 8.2MB
- SHA256 5c2e5038a7cfc4ec0492ff4c60d5595695a73cd7b0b8dc500101f6fed324abc8
- MD5 76f493ad3368d1688b09d422d76039a2
- SHA1 45669b8bae062f3b4188519a76026ff75fe3b3be
- SHA512 4f96785a02aecd5258bd3776783fe4e81be6499a7c10a828c841d23c5120877f5d90b7cb4ff92c0dc48003a8a42f90d2d9f04cdb9e3044d679f3ea7b0eb1bb96
- SSDEEP 196608:QsAgilaDIhAQAuI7fuKW56EDb4s2hquFIOq9PBPXKXj:lAgilacZ+WhDbF2hqyIOgV6T
- TLSH
  T17D8633C381AC9F12B88D57F758ACBDD1D5E294B247FECA12CE788E6C055150F48A09FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Syntex Hwid Spoofer/Instructions.txt
- Size 321B
- SHA256 49561f348fd1a781f5c7e3d21d3651233c8ec3265fe473b3a8f6087b6b9285c5
- MD5 30c8556c8b9e6ccdf182eab895e9f414
- SHA1 465918e77cac0b8c4d5854b74e5e8862c080ca6b
- SHA512 29a94bddace10ba96523401864807508bd84e71b3342a17a9c0480d725190ff3a61c9472b2d640db84cf3fba38a32bca43a473914002d8a285c01ef452ef6dc9
- TLSH
  T189E026A4237FB33814B4CA15203F52536E13D826011F14685498502CABBAF83933EDB9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Syntex Hwid Spoofer/ScriptHelper.deps.json
- Size 44KB
- SHA256 6ced04afd565960cc447f48149d4b07761109997995e5b377a5d8d052a783a8d
- MD5 39f226bf8e421c0ef3f80aa896ed2a52
- SHA1 99fba814a9ed93c6c5cd46bc53b8fc4172ffedad
- SHA512 3e3ffbeacefe1ee32a9faca8620bed543bd6f2bc32837344c57f663a29f909a93aecf95af77ef828d9ff7f87da772e7bdabc8674a738b0382f79b920d9759b61
- SSDEEP 768:+spXVEsIhKPMEPrT3XCGjDyiEc6BHa21Fe8kFN92uwtEeCJyDSLRMVYD:lXVEsIhKPMEPrT3XCGjDyiEc6BHa21F2
- TLSH
  T17013F416C9900DBB05765BD6283886D8FA65032F3181A81EB87C641EDF7FBBB1059F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Syntex Hwid Spoofer/ScriptHelper.dll
- Size 30KB
- SHA256 2a30425e79d0adb80a385c14e7f5cab489a01846f859d3e8267937f5397e72f1
- MD5 3bacb96782d8cb38978a4eda8aa9c74f
- SHA1 671659122fa90f0e9c289c8a44bdf8238a9be5b6
- SHA512 7cdc66d0a92391ba0f4d9426390feb936cb203bb8ae212ec78780edad721dddc0b58e51337d13a05d56f7aa6cfbf3659cc57276ddfa3b5e66f9a665d180e6080
- SSDEEP 384:skkJppeFmGPNWFY0zFq1eeRCZETTiMCoOzdjzGVBkEPeB0jZdeZ1SCzYcHe2v5:h4Ue6TPeB0aNzYcHe05
- TLSH
  T128E2C71077F94626E7FB8B74697580988677FE673C11CE1D3898008E0A73B568A62F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Syntex Hwid Spoofer/Serial Checker.bat
- Size 1KB
- SHA256 4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5
- MD5 e6aa388e1bdfbb74831d9dac00f87864
- SHA1 1ea3e900bcd914e20968f4ee2a0dbc2642808f74
- SHA512 6733e220796a2edc9261e4ad5e1054ab0854bd22c1ac92b0d00c1bc5b78492b51c9c68758a33d44059eb42efc98df2ec88d41ec358b4e3daac02d5a5cd308a44
- TLSH
  T13F31D511B84409D836D9FB290E3146B330A2489BC5751C4D369F82384F413EC799BF1D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Syntex Hwid Spoofer/Syntex Spoofer.exe
- Size 160KB
- SHA256 f00253ee12cd5b79622d280bfe379cad998c599282c4b3c2da69aade7fcb24ea
- MD5 34fe68a5db51cd903b548918efd389b8
- SHA1 220c7e94ae1332399aa0d091422b65d6be9f2dec
- SHA512 4bc18dffa29d16fc48776762f18d5e2efc0767154f597484a2646a80f22233bf4d5d1e302adb8905133eea97e3e36d91a2ce45ca02efdf49ec5a7b9b5eb80f27
- SSDEEP 3072:u5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCWods096hxpfSo:uBKjK2LFzZNfIULLD0chbZ
- TLSH
  T1FDF3390773A911F8D1BBE23999A24906F7B63826473197CF2350427A0F777E0AE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution costura discovery packer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
behavioral11 behavioral12
- Target
  Syntex Hwid Spoofer/System.Console.dll
- Size 153KB
- SHA256 ff3e09ec8ef8dc096bad8e1e9dcdcaf2367f63509179dcb3e5bc4c6de102b59b
- MD5 71138847373d2be68fd4da8e56552bef
- SHA1 fa9d9f20101f231c20e4d5cc5e05457ceebc2b2a
- SHA512 44a10b1babaff18db7a0cef316badcaeaa8e6f22aa0ecf1bb6a0570e19e4c1b697ccaa8c3cd3b315dbd072e4cad7041375c91c4aab922d67909833074ef6e202
- SSDEEP 3072:f9SMiIGbCwq+p14axXwbK80tmOaYMGr65pfSw:fQj9Rcclmzp
- TLSH
  T15BE36B26A7C00557EFAB86F990E32701C237E8A60B0293CB2545D6B82F47BC77F35595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Syntex Hwid Spoofer/System.Private.CoreLib.dll
- Size 10.1MB
- SHA256 c173a4a6030b6f0b32416623cf798eab45abf2d7dd38565aefa2fe78965452ca
- MD5 762482bd3d55ca4e4e5296a64ecb7d0c
- SHA1 c95b20296bd8004422f655c2bd85eed436d410aa
- SHA512 bbd71857c3140bc0c5d34ea6a44c57bf73c47786229a83cf5aa098ec790719c4ab8457098fcb52b7c8570ae9b7ed5cfa39f535edddae8485b60b8a2b772e94e8
- SSDEEP 98304:pKd1eeIoZQsU+fRIwvUVvJS63bXYPrLAU4n/0v4/PyGvjb:UCoSsU+fRI/VvJSyXcOyGv3
- TLSH
  T14DB69E25E7D85B1BD01EC6BDC463C226C671E8A62313D6DB0018D7982F53BD6A27F263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Syntex Hwid Spoofer/System.Runtime.dll
- Size 41KB
- SHA256 82fa676a897296ac6265e63bb582d03bf7df54e59c83e6bcd08f6f99a3249ba9
- MD5 79d8b0685cf2d323c7cadbd276e435bd
- SHA1 ac74c0958d691b4009f8c8657639e4115a03729c
- SHA512 eeafe9cc578da300dbaa4190a866dfcd3d65ebfeaa0484f6595225d28cd713fab347f7b3f00af1f1ddd02adc83f83a2d03087a77ab374dfc905f1a88b3f74c6f
- SSDEEP 768:U0BV0jdpFKYl5f4bGRi2xVbcVT4pftdhDGE0nkpaNEuLSoQuSivU:UIedGYl5f4bGR3G0BtdRGvkwpL7SP
- TLSH
  T11B130660AE4B5273CE8E9772C8B3A08109F633CF64B7CDBA541E8546298F244D3B3759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Syntex Hwid Spoofer/clrjit.dll
- Size 1.4MB
- SHA256 cc9c853642c185b17d18f189c5e80928963bf485b0eeef7714e94339c5858e88
- MD5 c83270c072e51d37928ab8d4d42be464
- SHA1 4c0431bfb73e070180efa4d302e2cba57ba42ff5
- SHA512 37c5addc0583e1afd612fe375057f2ef07be4fc434b25b8eba79c3e10442e4ff1c0957b48cc0dc204f9eaaad13cd017ba6ee110b4f18d0e3ad752a32c8e7ed1b
- SSDEEP 24576:pLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGyqfs:pLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHg2
- TLSH
  T110658C06A3E805F8D4BB9234C5934B1BDBB3B8161371CFDF57A04A56EF237922A1A315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Syntex Hwid Spoofer/coreclr.dll
- Size 4.9MB
- SHA256 58d91f3c88293ac3b9761362c53af32520ca42f8be14244c0bd7a8e6d1c95564
- MD5 6f84d00e152bc64261ac7a0f6d4dc3f5
- SHA1 3f130aee6c3b5684d9d601c55b76f85a1576cc92
- SHA512 29f87baac29aeb092cab368b4c7903d6fdaf36c521efb960535f98c97124aacb4a39bd41304cbb382f1bd8d2ebd368aa144e5dd8d7106cfe264d8d5ae277fa13
- SSDEEP 49152:rRRteSC8CjfXq6EoB/SEsRfoSakEd9c6oWUqCJ0OTVRepih8IdCdTWOVxJYaHmnX:1RqXB/SEAKJspr8wKQXl
- TLSH
  T107369E56B2FD00A8D4BAC078CAD74917FAB178491738EBEF02644A552F27BE1A73D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Syntex Hwid Spoofer/hostfxr.dll
- Size 369KB
- SHA256 e2486fc6dd58db5a55db18547459c0b160ba1b2e824193ae0dee0e9a0673d8d7
- MD5 155e4d45f02a4f7a2a228b44fa4791ef
- SHA1 14cb85f0d506b87bdad63dbec75f5e3206552592
- SHA512 25dfa7fdd5f3508ebe642c55330f81f7ad83d3d7bb20f4a3179e8d49805ce0dcb56f20820319a073a23d582b9b72e3ae2e646b92744d667717ee4d43bfdf6480
- SSDEEP 6144:CGr5uLf+w7dEtiODC3+Gr4iAOs2dEAh2gcmgrW09jcg:Zmf+qdEzD/iAOsVVH97
- TLSH
  T156844B16E2ED056CF1BBE23896B79905E6763C494770D6CF0390456A1F33BE09E79322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Syntex Hwid Spoofer/hostpolicy.dll
- Size 385KB
- SHA256 def634e856fc681088c8833fc43962772d59b47384fe73d5fbfe689245974146
- MD5 12098df5d600e8d952fd43f07fac71e0
- SHA1 0a55613ecef2fdffcd55066400372f25430d8287
- SHA512 31ed39da9c9074f585d6586dd71137083375f2ebdedf91ae33d28374dc9dfc02b766b7456f4735f83c19ab01613441873c43ff15ec159383fe1c986d539d838b
- SSDEEP 6144:ZBGjtN9JhCdJeD1QL3sQy8XyV0l0gzPI37VPzBz3BU89GhOfBE/XodO:ZBGjtNlU/rsQy8XyxzNCOeXn
- TLSH
  T158844B16E2ED056CF1B7F2389AB79902E676384E477096CF03A0516A1F77BD09E79320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Syntex Hwid Spoofer/mscorrc.dll
- Size 143KB
- SHA256 a231d44280d7044fda539b85288fbbadaba4830da421f0f28fd0444a05c2f107
- MD5 5f50c1cf588dd6f882ff5a329390fcd4
- SHA1 99ef8b69d4a299d87f373d24fe4523e4a81954dc
- SHA512 0279acda155406e371997dd7840a23f055097442b08dd666dc93739a1af7041fae7f889e782b119196b6409cd40d55e1556cd9aa2bfea676ab6ffbf1efa4a0a8
- SSDEEP 1536:7ODZms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXX1RGvcpL7Sw:7ODZ/aSKlZ4ZGnwmUS4Sc16cpfSw
- TLSH
  T158E37791A7F95218F6F73B74ADB95AA00E7ABC96FCB9C21D1240805E5D71E408DB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28