6e4ae65993e3fbd86d9338130903111fe9691c192b7bb9b082ea6feecb893285

Target
NULLSCAPE DESKTOP ENEMIES-20260626T083724Z-3-001.zip
Size 32.2MB
Sample260626-klpt8aax6l
SHA256 6e4ae65993e3fbd86d9338130903111fe9691c192b7bb9b082ea6feecb893285
MD5 b89e3c73ca26904ab855507510e3bfc5
SHA1 b8f319082c2a4eb27fc5ee715e9146c9f272a364
SHA512 40ef3c31ce74068a8effb7300f7679df358040dab98c596ff3c30ac5787fff5b78d8d3bd65a087b0fcd9c44918ee07c86974f1355a6ca5c284a5f52deac0fa17
SSDEEP 786432:DBQk7ILnTDnPPmR3h3BcVkbQMJciUf3Ef6dGHPQ:D17Ir3PPohbATPPdGvQ
TLSH
T1C57733D020A7D25CC92DA27BD2F7EBC7EEBD90C4CB5D9DBA500863D848971933A46D90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NULLSCAPE DESKTOP ENEMIES-20260626T083724Z-3-001.zip
- Size 32.2MB
- SHA256 6e4ae65993e3fbd86d9338130903111fe9691c192b7bb9b082ea6feecb893285
- MD5 b89e3c73ca26904ab855507510e3bfc5
- SHA1 b8f319082c2a4eb27fc5ee715e9146c9f272a364
- SHA512 40ef3c31ce74068a8effb7300f7679df358040dab98c596ff3c30ac5787fff5b78d8d3bd65a087b0fcd9c44918ee07c86974f1355a6ca5c284a5f52deac0fa17
- SSDEEP 786432:DBQk7ILnTDnPPmR3h3BcVkbQMJciUf3Ef6dGHPQ:D17Ir3PPohbATPPdGvQ
- TLSH
  T1C57733D020A7D25CC92DA27BD2F7EBC7EEBD90C4CB5D9DBA500863D848971933A46D90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NULLSCAPE DESKTOP ENEMIES/BellPetRelease.zip
- Size 3.8MB
- SHA256 bed8f30c3fd4fd1eafd3aa62cbf4391ab49dd8d35523204ebb5d271c05f7b3ec
- MD5 36cda3be76dd6fe4b8be9b9fb4cef11f
- SHA1 4bdb694af2d49052b7ef6464d4c2b02ac11cb4d8
- SHA512 c6e8038d1af98fb47e199dd40663a7968dbc8f1bac2d3dff278c989fe8962d42e72a67a808e0560026fd9180e8f07a3a7bf9f57384e8c256b5a902d1d03b50b1
- SSDEEP 98304:m24JzIyudY27h2ZPx7LVI+F3QBS6+fJgGnzd:xyIdd5h8xvt3j6+fqGZ
- TLSH
  T1B31633055CB999BDEA2EC1BBC74A5EF7EFB75094438C5E8EE808520806A36C35B0F5D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  BellPetRelease/BellPet.exe
- Size 1.2MB
- SHA256 08df66ca92a11cebfdeef0e050fc190633cacb96f36da403755478d728198bc7
- MD5 ada2e7668e407da4b2d7ebda71d8a51f
- SHA1 a47b91f42966e31242fda746abef3c8fac364c88
- SHA512 fdba1cbf40764255733347442f687bfc06da432b5faea72eb21f9f39be13810574af824cdbf346f3ad756eb84a80245fe5c48bbbe3b5f328ae40546729827ade
- SSDEEP 24576:02ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBIA7X:pToMKvPQvOi8AmQNsrlLaLD
- TLSH
  T178459F0773E7C1E9DE7BC1F9C9614226EB31B8640B389ADB2590452EDF63AD04E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  BellPetRelease/gong/gong1.png
- Size 9KB
- SHA256 b097761c5957aabadecfcd9e6f1581474761fb43d04f3f928d6588e1b9c9f9d7
- MD5 533e0316d25c4ed5512221caccdbf21d
- SHA1 2f09df24fc62a56985d64e6868ecc5c78327c8e0
- SHA512 9e138247a3dd631bb7c192dd6d959383cc42d960bb55293dc60feaac838b7a87a852d6f2a3a3e0a6ae53b587f1c3854093cdf3d61c78323f074964f720c42ec6
- SSDEEP 192:TjgALBzVrqCrBilogi9qLtHHJK8c7FlmzfebeyKX4:/gAdzVrqw3/UnbIlmzm1J
- TLSH
  T13512AF96E9B8608FC80470AB37B2D159D63B9480769BC122DAC8C637682A8075C267F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  BellPetRelease/gong/gong10.png
- Size 9KB
- SHA256 319fac676315ac3341f41ede581c06f546972c90cd01ae9fdf9c333bfc69f006
- MD5 555fd3ecb444fa7e7a43da5a602cd1e5
- SHA1 a73d3b44a99edf9c91e96c51e2fda9d089b5de33
- SHA512 0f26620c8ef50839eb323dbb03b4d3d641ab33d8be8f216d780aa76663c615bf572d342f67a0f92c54f1547d443476a64d85c89115557f80cc38cedcfd334c8a
- SSDEEP 192:rzOn1sw+rKitC/hV/waZhbbzRZ8fuX0+AOLZojtJ:2nurKitYwa3R24dYj7
- TLSH
  T13B12BFCB2D96193692D2716455A359AF0F0B4E8EA23A092DE1A84533CF29C93E81174F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  BellPetRelease/gong/gong11.png
- Size 8KB
- SHA256 14e2a892fe51454563c6fda7e9f135cbb013314ba7d878f9724e28134afc8c07
- MD5 b5615dcd8afebb29e4f932f531800798
- SHA1 ac4e7d42f4415517356004d3e7d1b1cd161eb5be
- SHA512 4c7d8a8bc2b7c563dd96b416e3392b8e64b108b20e2e83ec63b58806934547fcca41b245a27423be7079cad03375ea27512d8573c906ebbb2d7f840855770c14
- SSDEEP 192:EGCwexGa0uVAvRg05qjsctsKxQz1zCT3VOb+5UyDw1edSu:zuGa9AvRgYqjlRxY1sFq+OyDoedl
- TLSH
  T17B12BF2956F1675CD5837CBF525EF8CE8343DE2357BE0426F268B1D282391585718380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  BellPetRelease/gong1.wav
- Size 1.3MB
- SHA256 a1a03f6236b6fb8b9b0d7caf0ba2b806ff24893bd2d099c09696c3658cef3312
- MD5 cdf215e394699cef956497c9e70b37a5
- SHA1 bc0c866a0330af8ecc838d6563e887febc85dd61
- SHA512 383e326cf9070435485ec5244505b9cc46b97d6ef25f3b515381e7ee08c1d89ed0d2c2b619cbd16da8afcfeee64b9256be89a0c2eb23e6592293c5d55caa72e8
- SSDEEP 12288:1j40eKPTNU/JOyiy+CbR7JLneWk4PHE5VNZmHxj7axzu0EltHdqfkT919ler:1jagy+CxJjHxHEDNoHxjW5PEk
- TLSH
  T16755D041E101EBC2C0D9A17AA61ADAED57162BCEEF0B67712038E76230D19039EDD7DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  BellPetRelease/gong2.wav
- Size 1.3MB
- SHA256 f2b39a208f7b546ca1f654dcb7d4e14ff61ca40167a1965eeb9576c53e793605
- MD5 371c129e48e39ffa7e81e9eccfe6c98e
- SHA1 e163505195d145d39a144a0dda346a272a951140
- SHA512 c75d7c53a700004d7e7378ebdf061fbc67121f1d0b62edfaa841ef068b7e6ff06acafa892955431336552a2e54fa6781da8528f9a9040885c8f1d1d40ee45f7b
- SSDEEP 24576:cWxKUwXBQWjkFXc9UbMgyfbUJ4s83y/Pu82TrSKYSRH:1xKUmBJwFXctgrCs83y/Pu82TrSKYSRH
- TLSH
  T1DC55CA123682E902C4542CFB6D4DDAD9A371B5C69E0B336332419B7F6DFD6938C6DA80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  BellPetRelease/gong3.wav
- Size 1.3MB
- SHA256 b56a732e82227d77debaf54601fb81e46d086efcb681cee527cb5e69cb270dc3
- MD5 d2df8c2443de896398d3c74f4dd4b187
- SHA1 a7ded6ad2723de3075003bba53df77fac6556109
- SHA512 66b6f7d9450a9058884d415d1403fb13f7d5c0d7a0ad83845e7c658b75aac6e11a27838b2860bb38c40b76fa334fa412f552a0bb32c2fb7b3f03c806171b4f70
- SSDEEP 24576:UsLKRtcJ5c5RR3J6gomk0/mFf+xkguT8hiOkeMLgb:U1TcXc5RZJ6tm7uF+kR8hiOkeMLgb
- TLSH
  T1D755CA123682E902C4542CFB6D4DDAD9A371B9C69E4B236332419B3F5DFD6938C6DB80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  BellPetRelease/gong4.wav
- Size 467KB
- SHA256 9835724cbbc81f5fa8faf6be2675224f2fde8e91b22797d8cc85e8dbeea6fd9f
- MD5 f2074e6c55e83968209983655eafe879
- SHA1 554dbf84bd37f861ef8e444e96de5acf85ecf82c
- SHA512 0a0be6f0c1c82f9ea6ec5069bad49b9198d4ebc2d7fa1ed27a2007b945f96d7ab63123adf651e1d7d6a22ba1cf1bf9e76d694fbb45543600e1208d96f047babf
- SSDEEP 12288:DCZ/nZR5Ef/9RCkS2lEPVxaQoUpTmDqa0XsQqU6JN:sNEnny2UpoURmDqa0XpqbJN
- TLSH
  T172A46B527282EA01C4886CFB6D4DDAD89331B9C29E0763233250DB7F6DFD5939C2DA85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  BellPetRelease/idle/idle1.png
- Size 10KB
- SHA256 f9c3e2aac0378e375160f9fa41ea27f521236dac3b8961e28b8f8769f6ad1842
- MD5 9a31a9875c596bd7081351a2b5d85322
- SHA1 dc5f16a422fd7f76603399ecf2d3876212d20577
- SHA512 269122d230c4d507a75b482f41cbfc47f9ad9fedcaf93a34372a97f8f62594c72477978fbf69ba10b87ac0adaeb14e1fa5bc1c6c62b703b847e0b8ac007deeac
- SSDEEP 192:mVKvBmJms7tcpaACGfNa/oCEZljfzc5cHTBZ7McvXEGL+LykWPABYMP7/lmLJ:mkCmsoaACGlaaZ9zc5cHTBSRTLybexZa
- TLSH
  T16922C08E4DF2C5451B83F0FA77470F7BC3179AE42DAA98119B6AA71ED0D6603D01B701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  BellPetRelease/idle/idle10.png
- Size 9KB
- SHA256 727867654d1870886dd741a224341559c9fd854f4f56020027f7228486fc4163
- MD5 4e5bbb9f5a68bf504122f08ec4d16770
- SHA1 47ce08c4043c43f51056087881d8f45461dc55d6
- SHA512 551dc6ee553aa9aaab04350dc0fd60c1e18260cad27a36da4be1c96ef83d637052df50ffcea05542be4e618f519846cd5797a0601a1ed6b76ad8c3f2bb11fb9c
- SSDEEP 192:olafT/3hBk6fIC7Si8Ue+X0STek8W2+tXChOUS2Fv1W9:okfT3hBDeBp+ESi9gXSO3ud4
- TLSH
  T1DF12ADFA00D15B2BE6E4ACB8B15273A6467AF98AB772485EE82DDB14C540DC0001A6F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  BellPetRelease/teleport.wav
- Size 738KB
- SHA256 962da2f2e01164ba3b2228174a3273f29714856a241cc2180ff23762fbbca64e
- MD5 49f1e591a51864db41520a739506e27f
- SHA1 bf0d8d9d7ddcddcb66e364d7101ac8e123a90590
- SHA512 ea07d3409b885b8d722f55afe6b0c96ef462cd3623146fc81ec7f0ae47d033945871876aa53b1b6d81b9cfa3e8f08930642886d768bd52f40152cc7c298b4996
- SSDEEP 12288:LAWri5XcnaSn1ILusMOhYPzspVbDiTz5X3yt+vSFmpNfGGuX8mcXmWH:LAMi1saRfvXbGBytMSwfmX8mcX/H
- TLSH
  T1D7F44C93F4434900CC5A1E3A8D73BF6206327D3ABF6F561A30447E195BB73C25762AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  NULLSCAPE DESKTOP ENEMIES/CadencePetRelease.zip
- Size 16.2MB
- SHA256 5eb9ee2aea2b7b09a4edf839bd96fcff618a406cb566608f3c841ac3eaac2c81
- MD5 b516446adbb932d212461673595a39d0
- SHA1 2823fd4998ae392884298635c90a8b1ef6e6b78a
- SHA512 85be2fdf527f83b602a550e43aaafa6c3dd2cbf7ee5092de4213c4d3f75d35f529e1a9f91021f682a56dab7b1a22829003e394278c1e71c3b5c7816296794994
- SSDEEP 393216:+49q1U+Zwd6Rt6nE8xxv3c5YSmznQz4Hvo8xrTmntXpW:3q1U+FEEUR3cts5gf5A
- TLSH
  T1500733D4214BA6544E3D32F6F3D2F7902C2DDDCB98BD6FB4058925D9A0CB2B461E27A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  CadencePetRelease/CadencePet.exe
- Size 1.4MB
- SHA256 29bca304a3c0ae2a48d8496f89b02a24187e8f24793672517d241ef725b47e43
- MD5 eaca1b60baf1e6375315c6dfa1ddaa92
- SHA1 53e73422d311b7b886685135dbb450c8cb8e3625
- SHA512 cf02d57211333296b952b54958c74db38643fbe9cfc00b7fa863c2cc3ad6234230d66ad6037dc90ef3c6ba93489feba34adb14c590b6909b0e0c27550b83d3cc
- SSDEEP 24576:O2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBzYp04/AQ:/ToMKvPQvOi8AmQNsrlLa92X/5
- TLSH
  T1C0659E0773EAC1E5CA6791F9C5518A36FA31B86917388ADB21D0492FFF63AD04B36710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  CadencePetRelease/CollectHarp.wav
- Size 574KB
- SHA256 81eba15d94d982cf085aaa7c96fbb57e44ccd6b2bf494484abac6d616e5b4967
- MD5 bb7516311610048de502c7e51cbbdb7c
- SHA1 d1d618ee971ebd5334db28eae923189bf1eb086f
- SHA512 316ee79c6c1c05ec97caed7c15f8195ff1a3467326ca0a9aa26c0906b7a44a3a4af3cd1b56ec5caf02699b77ff065c55aa00f8eb291935d5de8e70cce0c3b2dc
- SSDEEP 12288:581al5gonvjwRjvVWtBWwxBv3eOd2GW+p7u7q3uS:584JwiPvd2iWUuS
- TLSH
  T16EC48CD2F141EC91C856047A9926DFFE43173E8A894D97763094FA0B78E14C1AFBC6C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32