Overview
overview
4Static
static
3manifest.json
windows10-2004-x64
3manifest.json
windows11-ltsc_2024-x64
3modlist.html
windows10-2004-x64
3modlist.html
windows11-ltsc_2024-x64
4overrides/...se.jar
windows10-2004-x64
overrides/...se.jar
windows11-ltsc_2024-x64
overrides/....1.jar
windows10-2004-x64
1overrides/....1.jar
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/06/2026, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
manifest.json
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
manifest.json
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral3
Sample
modlist.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
modlist.html
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
overrides/mods/echovoicebeta-10-snapshot-1.0.0-release.jar
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
overrides/mods/echovoicebeta-10-snapshot-1.0.0-release.jar
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral7
Sample
overrides/mods/fabric-api-0.83.1+1.20.1.jar
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
overrides/mods/fabric-api-0.83.1+1.20.1.jar
Resource
win11ltsc2024-20260618-en
General
- Target manifest.json
- Size 458B
- Sample260623-kylnbsby4x
- SHA256 449a1d62f4d583ee90759e0501bdbad827088c0ce51f9cc897e8c67edc6219fb
- MD5 0c72110bca1783352b9365580beaae30
- SHA1 d39b1bec1e16ea7d6b2fb5a2416df252f0f196ab
- SHA512 34e8dd53adb2157e039753c737cea87c23095736caf891e83c24c66eb18ced49acea5987634907a3a20a050f35910039331857c042e925fcdb881639c43f8e3d
- TLSH T106F0E527D9056C77267493BC49B84103F7614F2F00304C0B777D105C2FB27641155B75
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5180 OpenWith.exe