b49f4aa38437bf1f62ecc80ff46bd2d556c60d0f8ebab05efebf91f641b301d0

Resubmissions

22/06/2026, 06:41

260622-hfr2aaav5w

22/06/2026, 06:34

260622-hbychaav4s8

Sharing

Copy URL Twitter E-mail

General

Target
Baldi want Fruit Gummy REVAMPED Mod Menu.zip
Size 82.8MB
Sample260622-hbychaav4s
SHA256 b49f4aa38437bf1f62ecc80ff46bd2d556c60d0f8ebab05efebf91f641b301d0
MD5 068d9a3fd5bbb926e792ea8757de1ef7
SHA1 ad3a6bff47978739fcb63da14fb2d9be8106b7ee
SHA512 348016594c7d0868f02e05633ec92bec1c38f0dcb19e44893c9508372008409820482671778faa0acac01b9dfffb89ecc3cfeb7ece71b469ac27b86b1cfa7898
SSDEEP 1572864:CNhtJxP048WIJewAsmucak7vJ21ma7+FSAyTCoNTf8CNkwIDltruhjZ27jwetJhM:CNh31P8ewALuPkkMQ+FSAX078CNkwIDY
TLSH
T1EB183303A23FCD0BF75279F526714A77DFC4D57683C934F00B2A6218486B292936AD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Baldi want Fruit Gummy REVAMPED Mod Menu.zip
- Size 82.8MB
- SHA256 b49f4aa38437bf1f62ecc80ff46bd2d556c60d0f8ebab05efebf91f641b301d0
- MD5 068d9a3fd5bbb926e792ea8757de1ef7
- SHA1 ad3a6bff47978739fcb63da14fb2d9be8106b7ee
- SHA512 348016594c7d0868f02e05633ec92bec1c38f0dcb19e44893c9508372008409820482671778faa0acac01b9dfffb89ecc3cfeb7ece71b469ac27b86b1cfa7898
- SSDEEP 1572864:CNhtJxP048WIJewAsmucak7vJ21ma7+FSAyTCoNTf8CNkwIDltruhjZ27jwetJhM:CNh31P8ewALuPkkMQ+FSAX078CNkwIDY
- TLSH
  T1EB183303A23FCD0BF75279F526714A77DFC4D57683C934F00B2A6218486B292936AD9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.IMGUIModule.dll
- Size 143KB
- SHA256 db0b2f27579278c13d30912f09b6fe400126e8f5e075ce2ae440c222192d397c
- MD5 7a032f1d996b83734ca0fa25287a6b71
- SHA1 aaa2db3837b04e321a22127ea11b2113c60ae7ca
- SHA512 57ae746e8cc7b7c64680ade7ec1ae93ce6ce35c77238a6cb743deaf3635d8634a377f73c718dfa1b57ca826fafa75bc717ab658e30abdd12fb1cfd6c0cebfd26
- SSDEEP 3072:5gzdFwd9EzmnAVIRIfNuzZPTLjI40G2ZJz:6zdFE9Ezmnya7d/jI4QJ
- TLSH
  T1F1E3073817FA4A67DAAE033DE0D11004A7F0E01B5157E7CA58B960FC2D6B3E9E5462DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.IMGUIModule.xml
- Size 283KB
- SHA256 2a07c70f84c51519799579d61836df06c694c2ed745a1dc1eee8e2cbf26e89ca
- MD5 f1b9be29373c77e60b8113ab52412ad6
- SHA1 22c6d76ef4957a72d4400fb85e628901646259ae
- SHA512 abe8f27328d7256489dffa969415174864aa133aef0e5d82ff3ba6a7ac613e5db2a7bf861e3f92635cf650ad6fd846bcf9eae0aa642e4f8e4bd06e1460fb5209
- SSDEEP 1536:GsH0404LEQ+rBPDN8HzDREm1ZbAMG4pG4AG4EG42G4pG41HnN+IH0D5euGrTXHcR:h040XPDN8HzDREm1ZbApHnN+QU
- TLSH
  T1DB54233056E31E21CA4712559CBDB2D0BE11093B732EAA9132DF3D51EF6DAE2987BD40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.ImageConversionModule.dll
- Size 9KB
- SHA256 af7d658ad21ac3382180ae45e9524d03c9df31440b65b208fbd5490d7ae56948
- MD5 d1ffa10f61eaa59868869ec7d8770a91
- SHA1 b3c5b9671a113475aa2419ad1cad08cbefcb1f5a
- SHA512 70a83c6af8c0951a85aaa63e52fe2e7ca5e336883a64c9a976f0c3e2952ab57560bd3cc537d18ff7c3331eba65bd44583408ca04cb601293dd7c3dd2b3893ae8
- SSDEEP 96:CLZzwjicdVvjXHFYOW1K5pKaLcjOb7ZMcPxcs1JP0go:uYNvrXHVW1KDDcjOHZ/xcsLo
- TLSH
  T14B12F0F17789259BEC4A1FF3903993803A90D427CF72E715468E62A4B47E1ED7E217A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.ImageConversionModule.xml
- Size 2KB
- SHA256 54b0d5ce28a76609154a2808427c1196edf24f81bc1f4da9e53503159883a300
- MD5 ac8a39780ddd334e313a71f71274a039
- SHA1 9243d81e63aab1baafdfa611f40f6ab55fe03a4b
- SHA512 9a2281f71834a66b9421212586e244c8efd812aab91c38fe043082d83d1686e5f89497eea37a5f21b3acddc4b7865e4c1aa1a8a9d343775124020b6ab33e26e9
- TLSH
  T15E513678ABF2CA11CE0703451DA9B080AF591C173649E6D235DE7E16FFE96C260BBE40
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.InputModule.dll
- Size 11KB
- SHA256 bf5b521a981a599a1aa0811320365851fa853f615b095c031db41cad3e495d6f
- MD5 aecb601907259a821ddabbde1480b09f
- SHA1 4226b24f6015f3b2496a270f0b333fc1b9e0567f
- SHA512 378d003395f574c1b3b62e93d880f4fb1463e6ff4bff7d55e9ff61941945a1ef773eb0ebfc4343c58cd87a509be105aace5bf0ff395ee0c32739fae5ec799099
- SSDEEP 192:RJIS+JuBNjpdV8oeVTu/UDcjOHZ/xcsWT1:8RJuldPeVa/McjOHZ/xcx
- TLSH
  T110321FF17689255BDC4A2F37947953807A90C017CF32E3D5468E22A4B83E1EEBE217A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.InputModule.xml
- Size 168B
- SHA256 0fa7453f46fe0847961c7bc82f9fb54819061f6f44e0806e04c01412fc54eda6
- MD5 b3400fa8aae78c06ffd4c73aba069c15
- SHA1 6646aff8422c4b25816d7529ea3c99bad88aff28
- SHA512 9c240a4181f11ea4b82ee7d10d229e7e22a32a6388eef234357a3f7bb5522ed7dbf7d33cd44c2b552cb443e73f2159c4c4482b6544761e551e55c3d5fef770f3
- TLSH
  T10DC08C60E1E8912B9F0226095BB2E8086F14FB27A4E06434B45D6D42FF68046228B631
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.JSONSerializeModule.dll
- Size 10KB
- SHA256 6768b2a82345f15362055b9f4df7f4e0e34dcea33289dd2f3f3287374a2a8f44
- MD5 41d8cbcb127e64039a79612514f83a9d
- SHA1 2d85a034f5c3a79c1d9fe9f55bad590eb2dcf39b
- SHA512 1ed0bf009cffaeddcff122a8fbf12e8fbb8a386f62ad19210d93caee42a0c30dc950c9e8ca8020066af2e5ef0b667c723366a0e90f8e92880e8981583b4a6130
- SSDEEP 96:Zrr70wkKH4VQiF1f2lIowL+mx1H0072TpKaLcjOb7ZMcPxcsR2Q20S7:ZrlH4VQiTIIXLVF72NDcjOHZ/xcsS7
- TLSH
  T1C422DDF176C9265FEC4A2F338439938039A0D427CF32D319468E22A5B07E1ED7E217A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.JSONSerializeModule.xml
- Size 2KB
- SHA256 e793b6ebbf5625cad590a2dc91b5846d1bdf3fd1af7a8877763965f56c344f05
- MD5 4c6da14a9f14e02dcfa7f053ab95a4d1
- SHA1 003d65cfd5c9a91c1d9c8f3b4724d6895d622905
- SHA512 60f00ff1cbdd5796b0b18bc80cb2e73522345755e6ae0a82258e83e1db8c8db64eb1a6f9e10d25b7a9b42daa1c030df6d61088c6c8531698e5ec753a0d480ef5
- TLSH
  T16E517474B6E38A22890F05161DAAB080BF590D233616698375CCFEE4FF19EA3647FD15
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.LocalizationModule.dll
- Size 9KB
- SHA256 b742c5cb8c80ffebe6434a6385c12c375ccf273b032cc32e180a274934ae0dd9
- MD5 2253bae1fea49d34e04e94e2b248ad90
- SHA1 8700fcf1e4895ba89f9a7c521501f079afd2f168
- SHA512 3510970d388fec9b83d278462b5354df09ed22715b13352408e9c58fa04f53edd1a408cc55017f1ffa573b1265df257ff9d48a203c94984724beb1c8fb3afb74
- SSDEEP 96:O+ZGPWjvQdPI10ThxrouZKaLcjOb7ZMcPxcspBQXo0TQT:jjjvQC0TNZDcjOHZ/xcsAfQT
- TLSH
  T12912A8F27689215BEC495F73D43993803991C42BCAF3D71D468E62A4B03E0EE7E217A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.LocalizationModule.xml
- Size 1KB
- SHA256 29f7bdb76ee59a1b456fe62b5b4bb1f0141c0f6f0e63ae2fd4405798e884a5eb
- MD5 bbd1c79a5fb0f39f34152cd4f47637bc
- SHA1 28546fe13a9e9a493fc8a494ddf492003c2d9a8a
- SHA512 84d93c67c6e0e43ce76a1e2303ddd9d71e6a2745bfd6ad8e6330b4cd1b08dd6fabb1da8e72c767996b578207046d4d6abce9d4fca82e2bf0e640a1ad6790e83c
- TLSH
  T1D3318876E1F744414C0617324DB9F4C06D204D6B122BAA9634CEAC86EF566CF22BBE44
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.Networking.dll
- Size 254KB
- SHA256 a710387485b32b4cc9bcb660428259c5472d80aee7816bfd5ad4073ba88e52f4
- MD5 dade7201822aab59fe1a6dcfa5cec491
- SHA1 a920ad2ca08696dd9465c221f1bab66f740ca2ec
- SHA512 a275c570ceaec821b9e1156ab22b6fe5794d2d20872a42184a405224d2a0e43f51086256d2d405f5cd415e8ef5c92e9db9c2e5e9ba6800ea8abd1de2a05f8d99
- SSDEEP 6144:R5sOYtOhdNxJetxHUr88BHrLlsTurk4Ng/dV85:DcOhdN/e3HdV
- TLSH
  T17244D71067F98526F6FE27B9E4F450004BB4B952A02BE78D069020FE1E63794D9963FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.ParticleSystemModule.xml
- Size 199KB
- SHA256 a5a24acd3e03fd03430f1c4ba3ff5a687bc06b46b24a75a8377a3a0f10094a6b
- MD5 87f88028d00a64bf4959558ff2fdb134
- SHA1 63e2d473eb88353a38e5d28e5a119f3587c9ee5d
- SHA512 b9dcef3d9b65719d8c66cb2c78f1e416f83722f1181346fc9c45a8fc251315665bf95af46a4a09116c73527dc3157766b702bb5c47f9ba5012dd2ecf7e6bdf2c
- SSDEEP 6144:4He6sRKX3NwexDgdiISPFlj4V18+UI2MYmPNVV:kX3Njfm/V
- TLSH
  T1D8141870A6F29F328C1A07165EE9B4C0BE604C232197957A31CD7D59FF69D8361BBCA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.PerformanceReportingModule.xml
- Size 844B
- SHA256 fc17d21658460cd6d6cb7012d048214a945c73c6f30f35a11f1678a63bf6d9aa
- MD5 1e9a50aa3c1c01f8cebefeef63339351
- SHA1 206531fcb367d3a924a5e2a23858d1518f508629
- SHA512 09ebfcbb018268db2b8edb075d2aa5d005150b3c59b8b61a550e76dd7e35e107e9ee5c4b034b5b1fc8cfc34eba7510bfc2abacb855814e1f6e7c081f2f31f525
- TLSH
  T142016674E1E654578D0612572EF8B880BE581F130453182A74FE3EA2FB6A087518B934
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.Physics2DModule.xml
- Size 195KB
- SHA256 0fc7d13d01886dffcf86a54cf34a08789a6d858e3ceadedee3d7c14ea23f91e2
- MD5 96d8d57d2f8eee8fb598864c214af2b1
- SHA1 86ef62fb03e5e523e5829d42c4f47046f0850b23
- SHA512 7d2a0f8143591a81c450f4f1e9146172236176ee177b68845d87dc9602048b23e41c1684b500bb8a71602526577f6c0fe34e3f34a094b224d471e454ef770d5c
- SSDEEP 768:+vz1Y/3k8bH93NWDLLPMQBjYPRbpHujHNwiDTSTd63mxFqjgWwtlQxMft1M3Ho99:K15gffegT7
- TLSH
  T1DC14EB74B6FA0E118C0602156EA9F4D0FF504C23315AA551B6DE7E58FF2E8E3E5BB884
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  Baldi want Fruit Gummy REVAMPED/BWFG_Data/Managed/UnityEngine.PhysicsModule.xml
- Size 126KB
- SHA256 fd1cd0605c8ee9719600cf4d2626fca07dd4c07c954e51b700c11294f7981963
- MD5 db7491116c7b1544a40e86a2c13bd497
- SHA1 fc7aa999bed6f7f28422bca003572551dbf32b4a
- SHA512 efdc712e49704c92ae770bd934831cbc117ea2d47334a1a8c1371b1003c2b4ac43a36d92f833baa0650a90a681d8b4443db540673049bf9b46f80535b4a77048
- SSDEEP 768:hGcU8oLnLKi4vmcSKwz2BqxGwPSmTkpqe+++OLMsm2Fb8ABmB2Jj4sz4sPePYhes:hDAqU2JcdzwM1bQ0tS
- TLSH
  T1F0C39874A6F20E218D0603165EA8F4C0FE600C23316BA55635CEBE55FF2E9D7A5BBC94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32