2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6

Resubmissions

03/07/2026, 20:31

260703-za8khsfx7z

28/06/2026, 01:41

260628-b37a6aey4j8

28/06/2026, 01:13

260628-bk7h7sex7q8

Sharing

Copy URL Twitter E-mail

General

Target
OpXOyuApWKTlFzrV.zip
Size 24.4MB
Sample260628-b37a6aey4j
SHA256 2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6
MD5 2bfb8be4d04d2bc234a5492745045f3a
SHA1 22ad5ca3f8834c7bbd8e2517d43c514e78adbfa3
SHA512 a86f89d154984997ea9047a9c2cfd0c38003640443163fe8ab8559c04b17ea04aa376b5da3e5a99563201f364719e0488168095f614d51b105353c5289a35b97
SSDEEP 786432:kwy47xWLcV+Yr6yTBR7iN5/4rZrURRzd4F3L3ihF:6tw+YVTDu5/4trURRzd4F3LyhF
TLSH
T1F04733EF8C2253C3F7576BF0D95B9F8D8A2D324AC3A033A689E07245B555A601DB03D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OpXOyuApWKTlFzrV.zip
- Size 24.4MB
- SHA256 2f9eff4232df130b7d9e64f95c080e32c7d5bff772d32c0bdf4885cf06e84ea6
- MD5 2bfb8be4d04d2bc234a5492745045f3a
- SHA1 22ad5ca3f8834c7bbd8e2517d43c514e78adbfa3
- SHA512 a86f89d154984997ea9047a9c2cfd0c38003640443163fe8ab8559c04b17ea04aa376b5da3e5a99563201f364719e0488168095f614d51b105353c5289a35b97
- SSDEEP 786432:kwy47xWLcV+Yr6yTBR7iN5/4rZrURRzd4F3L3ihF:6tw+YVTDu5/4trURRzd4F3LyhF
- TLSH
  T1F04733EF8C2253C3F7576BF0D95B9F8D8A2D324AC3A033A689E07245B555A601DB03D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Potassium.exe
- Size 74.9MB
- SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
- MD5 eeb010dec5e5c64d818ab2a9eda690e8
- SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
- SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
- SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
- TLSH
  T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4
- Target
  WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH
  T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  autoexec.lnk
- Size 2KB
- SHA256 efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4
- MD5 fb5ebf1ae11a1059b54a7c1cc769ead1
- SHA1 0d4b9b9c8aa8833f2a4c91f595c915f82926a2c7
- SHA512 d66e93ebcb0b496c38b1c9b3468125240530b568de9993cc3c8454aa0be96353ed09337d193195b71e9a0c4c2ae280f36f29f5cebea6df05801e48c8ea269c01
- TLSH
  T1834115035FE60521D3BFCCB91EBB340A8A677262BB4109094114D68E1C71D17ED2AB1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral6 behavioral7
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/params/DataModelServices.js
- Size 47KB
- SHA256 2f06d60e90c8a526f12ef0e450f77beaefda0225b79eec62b66950da28c856b3
- MD5 f9099d16ded8fb819dc0d27d078eab07
- SHA1 175b3d3f9502642d6cd153c24a5f4968b77d3550
- SHA512 a2332a87969edc8f967693b9486cad8ff28f2b761b42a06d0140d050e245b0605418df44c4e416b0e9f9b7e268fb7b75b52f1b8c5863460c934e16ff8afffafa
- SSDEEP 768:MQ0ImE5gYuucKA9oqY3oUwmsdgoOaoR0bUCwTY9oBWWU30yOjypc4r8VImCnELC3:oXtebf7MJ
- TLSH
  T1D02318F7F3CC38A76D438246AA3ADB402D2ED538E93670B9B7DC761950C8D181757A0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/params/DrawingTypes.js
- Size 4KB
- SHA256 12d1a59f76c3608cd3fdbecb04c5ab72902e7a9b75ae40eda196d3d129f54301
- MD5 b585bc0a29aa91042126d74ceeeed7d2
- SHA1 8a758132b6f6853a63cc4af8f133392ccfc8464a
- SHA512 49fb90a83d25ef6b3edd8ffc342a884d61cd3c45b114f34e3969697ddbf8f831864f6f04b6ad49ff418587663e74a1946eb416746fb0697aa2a6329be740eac5
- SSDEEP 96:vmUqiAOR8XlAKYZwxX2LSuYD2TvXBSoY2EPuXuKKYBgZXpKYZy/5XtBmzQY20/+0:vmUJAOm1AlyYS7wRSsEWeK1qZdSdBmzx
- TLSH
  T16391019FF2CD30864BD2858A543DDD026F1CDCBAC6237F29F9DA1E145A8C119638DB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/params/InstanceClasses.js
- Size 72KB
- SHA256 ea34d9e29984c31632c97210a20db208c33e42776194786f2de827c2997f5623
- MD5 c4dece2fc34dfe766d3a6f7acc983cb9
- SHA1 1e3ad38c7780a50cfda5fa985ff58b83a3b54aa2
- SHA512 7647c23cd9edaa5bb4fa0ad60d749ed4bdaf0186539eea098247c5fc8bed7ec8493ecaf40079c7d48f68cdf6c8b400ed0af34e77b386de2af69b9017115b10e3
- SSDEEP 768:CMgzQgTkgBEgn4gyygHkgKkgZsgnMg0Ug+Igoegc8gb8gG4gAQg2wgKkgp8gBsgy:r3joaQTWy5Tq
- TLSH
  T1C17379F7F78C34172D47C286A639EF00393FD534E93215B9B6BCB625A0C8A21265B51B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  bin/monaco/vs/basic-languages/lua/autocompletes/snippets.js
- Size 1KB
- SHA256 9b8838acacd8610567b65dbb65981586cb4e23ba1ab8623bc285dda454b813b9
- MD5 309e194818904be8d5cd8f824eea0849
- SHA1 27854c536a3c2a2bf99364a5971bb0e0b9269d78
- SHA512 403e44e99ca35d0ee2c908e9e926ba1c93c7938f9134cf4722940143d1e665a796e359013682a4223d5087b38ffb07f4f00a8986f13377d1e13cfd93946d717d
- TLSH
  T10531CF8F728F9CDF819C039E41BEE7E6105CE1FEC262062EB208572555C4628653F319
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  bin/monaco/vs/basic-languages/lua/lua.js
- Size 24KB
- SHA256 258096840ce493b64c2a5c09849e40a26ad5b83df76e4c718017d76e1e286b3f
- MD5 cc50a736c28b5af2cea9455133485a9a
- SHA1 7cc2989a071e30cdb051a7aa0821e10f3bb35954
- SHA512 bb82d9ea68388065f83ed0e257fa5833024ba6156ce88b7b72261f1b83942a673eae33be93b57469e69f2f9553fb4e70e99f335e9dd32ece9889861f20260a79
- SSDEEP 768:FOjvlD94KFDOvvEEMhOIb5EMhtnUEW1rEmAAtWUnWTEOIiY6Unw5t9JTC:UjtD94wDOvvEEMhOIb5EMhtnUEW1rEmV
- TLSH
  T16EB25F199DC251245692E36B8BEF9004A4688513EC19F8B0BAAD83549F4DD0CD3FFBBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  bin/monaco/vs/basic-languages/lua/snippets.js
- Size 12KB
- SHA256 943ce614749f67dffe97b2afb88f3c76fd91545c4100a0e649d45e9fc9b98a03
- MD5 89930ae7aaf2478333dbc14e4c93d8b9
- SHA1 10b2fbd6703f3ab213dc386a3380b67722ca84cb
- SHA512 10b23981e8b8144e8e184aecd0995a6b96ce6e5df8ee8658c376d850884aba75914ce29e3d1ef76fa22eccda07aed313f78edf922b6a2f32d3fccdd5de34d0b6
- SSDEEP 384:IJEyCxCeOq51h9iH/G08mBsI1y7QFo8PRugvsziH9E0gJM7FFvS/S5E8E/ufg+8/:IWyCxC3I78fd86pQ7QFo8PRugvsziH9S
- TLSH
  T1C652EDDFB79E50AB44DB8B1AB13EC1D1192DC0BCD4759578BD98D8140A8887813BBBCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  bin/monaco/vs/basic-languages/monaco.contribution.js
- Size 28KB
- SHA256 42e79ec54895ee725c4f793b79fc5ca3c997a0193645060233277e524a7a34a4
- MD5 3161b5db765e3bb316c23a5e32871f82
- SHA1 a96b95d4c63186d7243fd4e32ed4566a613afd4a
- SHA512 ae9d181d2908261376f6afd2282e134bc38fc2f5a896337bc41fd7f06460c74b67b66b726dc39d53f743a7e8c99fc4c8911c1e9902f8db4bcb9dfd85ab9072a4
- SSDEEP 192:hhrM409fKYTxXTUTSTBjTYT9NlTOTgTQTCT/TUTjTNTbTnTxTTT7YAHTwTbTFsTw:hynJYA41wpuzVniHQ
- TLSH
  T1DED2248D5D8587DB1BC2B0F4A81B9C05E5A2902670093C5FAB91FE9F74AA3CCE173C59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  bin/monaco/vs/editor/editor.main.css
- Size 68KB
- SHA256 85b305d49bae83ae9fb7d5d1c84d93989e3dc252db38a7dc07b7d349902a89ce
- MD5 deb0a19013648d19143c4e9981c87f02
- SHA1 0f4f223bae72cbec3f87be273223c11e0a6672e5
- SHA512 456380613f3c73abe04b90f2fb5aa436bccdeb63e206cc63f6301bca85b241b363955d8fb574687c1182cd0a4efc82a9391961b99985f4a8b9483b42ccbeeb42
- SSDEEP 1536:8M3/S2lRD4PfPuPjPAPdjNZBmBkHE0akfPZP/PyM:J8NZBmBkHE0akP
- TLSH
  T1C26384EF26002D2862EB8137A681DFD971F9D473F9224EE9ACBC7B20954E1E50717538
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral22 behavioral23
- Target
  bin/monaco/vs/editor/editor.main.js
- Size 2.4MB
- SHA256 f9ffe3e01f9bf58ab25b37da98eaf5e80f6e37f9347e663bf249d3a6190a28ca
- MD5 d9723831dc0cce5974cb423729e38e5c
- SHA1 a8298c1064526017bf0121795051323dc9ce322f
- SHA512 0e8b6ed339bb44068ca3dede1699d827717382e3c4782e5f53ec941c4986410f0b858bceb643c898e6392ab639649266fb27f5d1ded0bd0d3401d2749aacddf6
- SSDEEP 49152:F5T6aBj6hpnDeB0eXoBB1f5dd5LeZhtic2LLsz+nK9zTGcqS9o7KpSXxKVqeY0XJ:MsF
- TLSH
  T116C52CA63155285343DB50FBA8B60103B2396592B809946CF7BC5CDE269FD8233B7F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  bin/monaco/vs/editor/editor.main.nls.de.js
- Size 76KB
- SHA256 217aad6fe9cc93483f3423bd790c1d840b1aba274439b7c8ec34b5d14811eed7
- MD5 3442df530f13346a214fe2f322cb033d
- SHA1 27d3787aecc0fe9720da1ea7f17c51ba95b98fa4
- SHA512 5f5d26adf313f588480abbbfcb7509e0fed0b52908420a4548adcc1a358c00f366c34529e0ecb10cd9cc64316dcffc7fed93794e07ea3e9171a94f68f58316f6
- SSDEEP 1536:rSrGPsnVxWQ2AhURY5pF7Plzyhvv09/yy37AhkWIIiWjzQo3X3Z5qYYokE9pMpOR:rQtHTPlAv6WjzQo3XD
- TLSH
  T18E73FAB29C8B31675EC62391FB406C6B7B1CD16E7642601D08FFC06A7267AF9C29E471
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  bin/monaco/vs/editor/editor.main.nls.es.js
- Size 76KB
- SHA256 656dc966b4ab36a0d7846217a2434394810357cef5cd3bc8877fab4637c81f53
- MD5 6909aeb1b135c2e7cebfd010ce361337
- SHA1 dcf9c5146c89c0fdfa70e7db0c23cd7047b3b0e0
- SHA512 137c528923ddb5d852a9784b521a57da32932e034c1c8a23b2f5932336b9e076febe5a8c67d50b8062b7faabee5031a1e567db5708b7cb1ab87bc468f59fd9ba
- SSDEEP 1536:tS3YhxH3zNFqZdQM3Zyxgc3PtjGHhCv0qUfOBHTBuVF:t73Kpr6GBCvTUfOBHTBuH
- TLSH
  T1BB73543A47C8476311D302CEF2D3D503D19CF8CA6168E1A7A57BDA5960CCEA8D17BB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  bin/monaco/vs/editor/editor.main.nls.fr.js
- Size 83KB
- SHA256 9b7c1a14b3960b99b678df79ef50713d8b2a61b53a3e40533cf7007653e4f3b8
- MD5 be07ebb97a18651d640b01f71d56ce1e
- SHA1 97aa9ceec575aff5f9d04dcb939785074516a560
- SHA512 bd12807c96dfe43045e853ff47ac7d3c28350309ddbe646945de9ed31b480687233b11fb22515086df90b7346b8759ce658fbcedd17ab47f602b728915018de9
- SSDEEP 1536:3501img/YZbtAW6kyGL7TBP+PkjCpjn634W:35eihYZmW6kyGL52PtpjnO4W
- TLSH
  T14B837547A7C4315125C71AA3FAA14583D86CCD8DB3C8D311FCAB56DD01CA8ECB2DB6A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  bin/monaco/vs/editor/editor.main.nls.it.js
- Size 78KB
- SHA256 5080d040135141347236deabe17e3bb3136eee2db6f5b0bd172bd43ee5ea1cf3
- MD5 2edddc05f7e353a4a762ebc369c2d5da
- SHA1 48da773df82f07050367a9a3315950b34e213d07
- SHA512 c83089e9a04b04c3c32571846aa799650214cafdedc3e538bd5b53e46ca663befcc25c76432261f19492d8bf147cc3873a0919a1ea4d292cae08bbff8eb917dc
- SSDEEP 1536:8Gy/XDfnwyS5y1tpeq2F91J1qn4tmdy3SPZ:8Gy/XDwyS52tpeq2F91J1qn4tmdy2
- TLSH
  T1BD73B93D01C121112DDB13DEE165648EFB76A8CCFD9C316959AC0A1D20CEE98B29F77A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32