e21fb92a34cea23f35e36bb0d4ded8a8c79ab0940c51908cce8288108fae31e3

Resubmissions

19/06/2026, 23:43

260619-3q126adt3t8

19/06/2026, 23:40

260619-3pbe4sdt2t3

19/06/2026, 23:37

260619-3ma2kab13m8

Sharing

Copy URL Twitter E-mail

General

Target
TBS 1.0.0.mrpack
Size 88KB
Sample260619-3ma2kab13m
SHA256 e21fb92a34cea23f35e36bb0d4ded8a8c79ab0940c51908cce8288108fae31e3
MD5 6740609353cf16e6441d55176016c2f5
SHA1 2a9ccfd7587db23815f1fe274ad2844401ce1157
SHA512 f669c34fb8752797695642fda59817c391d5a922bdc2b1636799b73df7485244a1a3852436509072485771517423c7e42f19ce0212bb5c054b733e8e4a77793e
SSDEEP 1536:bjjn04y3baYKfWAkPUfqi0NQA1+uzetQRedSHCV0DsYRTHSQ7c:rn0DeYKnjfhuJ+6eWtCKdRTo
TLSH
T18493BF3EC48DB817C0B38CB4EBA46A625E6643CAF9227547377F611764EA44B0F963D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  TBS 1.0.0.mrpack
- Size 88KB
- SHA256 e21fb92a34cea23f35e36bb0d4ded8a8c79ab0940c51908cce8288108fae31e3
- MD5 6740609353cf16e6441d55176016c2f5
- SHA1 2a9ccfd7587db23815f1fe274ad2844401ce1157
- SHA512 f669c34fb8752797695642fda59817c391d5a922bdc2b1636799b73df7485244a1a3852436509072485771517423c7e42f19ce0212bb5c054b733e8e4a77793e
- SSDEEP 1536:bjjn04y3baYKfWAkPUfqi0NQA1+uzetQRedSHCV0DsYRTHSQ7c:rn0DeYKnjfhuJ+6eWtCKdRTo
- TLSH
  T18493BF3EC48DB817C0B38CB4EBA46A625E6643CAF9227547377F611764EA44B0F963D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  modrinth.index.json
- Size 3KB
- SHA256 615a0394db538bb7110c280fb666e2e1fc8014bccf1e8556a230eaece67f555a
- MD5 4841f16b7b29db18443a8d64137109d0
- SHA1 83a27a4d979d14aa4f886e14b31e331166eddbf5
- SHA512 4af150dca77f30448c72e221a04c87fdf161b1abbe9bdaa77cf9fee6b354e72eeba23a22b538ddd082317893ceaaeae4fe0947b153078aa51b3b08b1869b3b7d
- TLSH
  T1A67145A9C6B48DA316C1B6B5EC1F51426321DB5F0EAD3C1A76CC808C4F2F61E722D5B4
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  overrides/config/e4mc/e4mc.toml
- Size 1KB
- SHA256 d3236414d0fd31bbc7d361a6b7e239685b7791ae4d2ff4fc554a9bed286a340e
- MD5 c0f759087897b555e2b214a45379b367
- SHA1 f0ca8e010d15a954260fc905c2f9a1b9fb50e1c4
- SHA512 126c1070ff9b4074c942ebbe9dd486fa1bdc426043ce7bc0298fee1cbd9de3dc8b39466abcf4391d27cca1e8f8da683ec50e3a36bed290fd8e90bb3d4fc09c3b
- TLSH
  T1A821971233C67674463E4AD3C587F426B432CB5CE9233C21E4E412A9116CA2B105FAE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  overrides/config/fml.toml
- Size 1KB
- SHA256 cc59fb1039726fda3ab1eb69b06d9b9aebb7496604ea579cfb735bc5377e7825
- MD5 61a62e6a2b5b00f324065233e76b9a64
- SHA1 9fca24533100755c12e7d1a82f8c524d0a163ff6
- SHA512 872f51529c0a75ebfb9f9163bccbf4171c0177f1b21de6c987ab11d9edbb2def2c727ed625c558689d5bcbe68ac1e69460969d3bc3686a33845a4486811f342b
- TLSH
  T1F831425502F0B23FCC701241B9975329CF93C7664A0FB89519E9741C2BCD95F82D6DD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  overrides/config/fzzy_config/keybinds.toml
- Size 6KB
- SHA256 26ac5810c9b5dc5c1968827357f0a58c58ac2b6f7b082630960228e16585062f
- MD5 db29914636f6e1455464345f8e91d353
- SHA1 f808afa706d9a4934612b20e1efd513416a0e8f1
- SHA512 d895dbe570376791c8e854f077d6f6dfa822a3a32609dbfdb2b2ffa7a5b4f39d737680e710efd0a01bf873e9b82f0c7dadd9b0537ee36c89bd67c5e6a645e8f5
- SSDEEP 192:zOlLFHlLFjlLFzlLFflLFLlLFrlLFLlLFmlLFElLFxIlLF94lLFAlLF/lLFPRlLS:zIFdFhFRF1FJFpFJFgFSFx+FwF2FVF7S
- TLSH
  T1F2D16D56500FBE236D8E6B577732F46AE71444104DDAB4EEF2BC10742980E6DA0DB5CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  overrides/config/neoforge-client.toml
- Size 578B
- SHA256 d58d93e2c429410d0abf25507d1679f732e1023b03bb52414348efcf5cf3ddb0
- MD5 7f81c16ea3d467da83df18250f772149
- SHA1 b51515abb0c65a891514baffb4c78d2357ecd1ed
- SHA512 3b2cddc1c8a2b7b8dd29a716d58b998dbd028ddcad35275eeac0a7100540dab4170975d0b420af2e3152cff5b509977fee15eca1decdff2e899c287963efff51
- TLSH
  T19AF0E1B62C20366A10434853D6DB60FE5A31F97285272574DCCCE14C7A44D2C933B87B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  overrides/config/neoforge-common.toml
- Size 772B
- SHA256 fe878a2717a145cd890621eac5b3be1e1fd656f7ff9abc6e8d53f670d37474c4
- MD5 914110a675baa858ef6725e3f56e513c
- SHA1 6b10e4debbf06a33453f4e0ffb80281ff0752f9f
- SHA512 2f20bd2e5c2aaabe29d9d0d0ada162f91138faaa2a3f5da75023aff16a4fda63af8bc2f7a093cfd6bdc31873a6de8f33a9534f9f8fa31d8c05dc67a89541c7d3
- TLSH
  T17A016177518363D865024B83E18E62FA5794C0ECC7530F79BC4CC01A674AC1A137A467
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  overrides/config/neoforge-server.toml
- Size 1KB
- SHA256 b1e3b38d612295f8d9dfa0fbdb538a992b7a1a3b7a766c491b4e9fdf3823396f
- MD5 5fad417d8fbff12e98bf3bbaa3782864
- SHA1 536538f1f29efb49318318113530bd4fd74c235b
- SHA512 164c8ef51cb19ef4e8421378fa20d56a803b07b2cfb8d5d36b44e32c17bb4bc097ceaee1c2e363bcd8059e2fe710fca2bf3d14500879aaa35c4f98e0fc3ff2e5
- TLSH
  T11D21C12BE78EB67913B2911D2705ECFEF300567D92021A71E42602253605ADC52BEEE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  overrides/config/plasmovoice/.crowdin/de_de.json
- Size 8KB
- SHA256 1fe30625fb96f11e1513d848a04bc4fbad707f4ad0ba61849a388a9e7a33ca9d
- MD5 cb8838ceada0cc1ac72d33c3359eb883
- SHA1 9dbbe34f84e9d012d51f60c0a8435b260fbdc1ad
- SHA512 6b205f22d3890a099626772e8228bc82aa1ccdc55d94b1db38cc831b615ab4a553c6bcb85145e3933c92b3d8eea18191db6f1abf57e781ccefd9c498615340c9
- SSDEEP 192:oQAFSNiEXn2nTq7aNpjhIg6C+kUmF6IKXzI2AHhA:KFSEVFhViA6
- TLSH
  T13602994F665F342D8EE782821C46C9FA32F981C4E18F229EA1FFC36E09DB551C246765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  overrides/config/plasmovoice/.crowdin/es_es.json
- Size 8KB
- SHA256 bcd62f8b59b77ed388231cbd6cd479f58aa82309788ba2a26410cb21e514adfa
- MD5 ebe33e9b2d8f8f2d4519edb2e4394e40
- SHA1 b96432c33123aace28c9915579f2b7e5c841cbea
- SHA512 3039bb3fff8f782178bd0e5692a473c068d759e7da5f389893d7ba122768057b0b9a8a565cb15060df5974fb63fa2de118cf492dc081fa1ab0a893642dab79ad
- SSDEEP 192:c5dP/eqWzMZ4SV8reXPzxrQa4JiiHvbgT5:gdneq4AVdPVr1iiiPbw
- TLSH
  T10912881F165E38299DE792822C07C9B761F481C0E09F52DFA0FFC36E58DA654C386B96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  overrides/config/plasmovoice/.crowdin/fr_fr.json
- Size 8KB
- SHA256 6c2e91b1a964e5dd4511702fd554ac8094c4f862ab4679b7dbd54af18c128db0
- MD5 f3a517b45d6920f327020408fd9751fd
- SHA1 ce0e6afc2309001b897ce9ae95e331325c7a48ed
- SHA512 734a4f5ea20b05fbfe1733d00b0e3c6f80959cb0bcf397bb54433f1975ad07f082aebee1a8cefd2fa087e7e3bd8fd553bbbe7534f71071841ffc231470e78992
- SSDEEP 192:wBnM5Tu3+o6Aqg6Oo9R8ZuYH51wUkaeTBU:YnITkfqz9R3Ukaeq
- TLSH
  T13212FC1F264B342D8DE792826C02C5E675F081C4E19F529EA4FFC36E19EB591D3827A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  overrides/config/plasmovoice/.crowdin/he_il.json
- Size 9KB
- SHA256 81af917b226159198f9a76cb9caa4ffa5ba108684106d0a7d7a46a0e756f4a29
- MD5 2f2e21189a6f11d39a33b7b66a111b5c
- SHA1 27fbec3263443459086ed7556fb7dc463eba65b4
- SHA512 4a35d75f57afc560b64e01648dd1f6ebe37eda34c2f41c2fbf2a92858e368266e9b9f0133dfa2c75015329f0abf982219ce1b5706be45b52c8b90cf9d6bb970d
- SSDEEP 192:EXaRtrFVuPLbwQFQvaMztAFEzH1uXbN9W:AaRtrFVuPLb/2vaKtAFT9W
- TLSH
  T1DB127D8E65EA70198DB295C20E51E5A62FF189F0D58F26CED36F832D5CF7081EA43364
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  overrides/config/plasmovoice/.crowdin/ja_jp.json
- Size 9KB
- SHA256 0db355eb21a7795e9e57bb94ae925a28efdbdec49b0704476dcf9c9dc2ed5566
- MD5 5ccf0895426e7fca281ca28d13dccc31
- SHA1 5bf821028b49c9396d3766f34d39e557abfd5536
- SHA512 e41e137544480a275c9ecc94c88cfc88b0b17c9eb0cc6b67418bdfa28ca323be2d4d07244d02d69d33e7ae2b66b899b7983ddf32a30c4cb72f59722587b5d99b
- SSDEEP 96:Fw/SRlWJ6G+L8s3ye8Lkf0q+lEVcNILhFcPAPHPvwynuyfI9E66rx+bv8u+9E:FASg6Go7hMevIrWc1w+bvR
- TLSH
  T10612BA1F538F74298DE2C2620C0AA1E631F58D99E59F23EB51BFC32959EA64CD2407B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  overrides/config/plasmovoice/.crowdin/ko_kr.json
- Size 8KB
- SHA256 8e0d47316caee0b490f6bedabb5532da30567094b6438deead1f3f0f85e66346
- MD5 ab87eb710206cd3eef9e1ba03f88bd57
- SHA1 c75949dcf2d5e543028e3e5da6e7e6782a528e0b
- SHA512 3ae15063dd34d838c8ac993fc05be29f16c38e6eeeaaf35efb53871d55e71662ee4ee84c2e83b4c0f499eb7946d023cfcd27cb34c2deed23e90efbf666cbb44a
- SSDEEP 96:sfDceWCDzKv0mazSToc+KxZ/SptmQ7DQt8R8CR8mQcuu1uPDPUPm7odcui7oaEDt:sLco3msPKq0RLSPdc97p+uBi8k
- TLSH
  T10712989E215F346C4DE782426C06D5F621F181D1E38F02DFA5EFCF5E89DA681C2817AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  overrides/config/plasmovoice/.crowdin/pl_pl.json
- Size 8KB
- SHA256 62a43c9f3d46b1e1630b1988ee07413139da25a57dc49265b8cc9450cbae0cfb
- MD5 6a09569fa006d3f01bc00333838df100
- SHA1 c0d0daedffbb23aa03c45171fa6a38eb47d81f70
- SHA512 719c9cfe6edfcee1f5f943d42ce7f17800c65b91cada7bc6b908d2573b72d22dc049836bfc6864b1ac22339e209a74d72c5c62859a1eb98c0e594f013f233b10
- SSDEEP 96:s8fvf/HqsQ8FwU4uF58uCPMOjME03PLamgBDEoeG5ie6zPJP3PIb1dX13pEYpuyS:sYXo8SU4uWmPkpQeIFfO1l13v5sX
- TLSH
  T11A02B91F156B342E8EE385825C0B89B621F581C5D28F179FA5FFC32E09DB280D3963A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  overrides/config/plasmovoice/.crowdin/pt_br.json
- Size 8KB
- SHA256 b0e75ebd3798bdbe416ffb3ea3ac0bda766e3bcf92864821bab5a1f34e434a18
- MD5 97bd0d3f6c281f960cf448c4346563fc
- SHA1 ed7f5e2c77800a714130a1b4b1cb61d51ba7996f
- SHA512 3d645f364ab8cdeae0b83abbcdcafa732ef1c9b1e1baae26569d62ce1acd62f6582653ada5a089b9d6663e2a805bbaf04c7014f291cf8edd0dc5e711ca9ad6a8
- SSDEEP 96:cil4FVIgCwk+tL2BfQe2Cid8+vFCy/PoP4PAtHJ0P+Stg/pRKwjp93bXRPRAvaNA:cil4nrDefii+vFJWmaMmBEcbXVRAp
- TLSH
  T14612F01F168F381D8DE783822C0789A326F482C4E48F86DFA4FFCB6A55DA580D746756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32