999fcc565644823f13853ca05094ca49091266a86686dda21916ed9ee4d55b90

Resubmissions

28/06/2026, 17:51

260628-wfggfaax5w1

28/06/2026, 17:50

260628-weq99aax4y8

28/06/2026, 17:45

260628-wb5ngaaw7x8

Sharing

Copy URL Twitter E-mail

General

Target
Saga STQ.rar
Size 12.7MB
Sample260628-weq99aax4y
SHA256 999fcc565644823f13853ca05094ca49091266a86686dda21916ed9ee4d55b90
MD5 99f33ae0a44a8b501b543dcf4bdfbda1
SHA1 44323681ea1824cb503c26d2d4bf978166285272
SHA512 647fd36ebbb513ee7224ef127c98c73101cfeea5c2f44646d34525dad657a1f3d46d48ef6effc2a560eb40b120c81656fc15c19ee99dedb5374e15ee675a593f
SSDEEP 393216:7KeO3lbpWxmHEU8NS5Kzo9oLqlK4o4rS+1bt:7zO3h2mkU+Sgz6fX
TLSH
T1B5D6336AF46349D7CC8CD60AEFD0E683F376CA26864D689D5F4C43314DE904CF42AA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Saga STQ.rar
- Size 12.7MB
- SHA256 999fcc565644823f13853ca05094ca49091266a86686dda21916ed9ee4d55b90
- MD5 99f33ae0a44a8b501b543dcf4bdfbda1
- SHA1 44323681ea1824cb503c26d2d4bf978166285272
- SHA512 647fd36ebbb513ee7224ef127c98c73101cfeea5c2f44646d34525dad657a1f3d46d48ef6effc2a560eb40b120c81656fc15c19ee99dedb5374e15ee675a593f
- SSDEEP 393216:7KeO3lbpWxmHEU8NS5Kzo9oLqlK4o4rS+1bt:7zO3h2mkU+Sgz6fX
- TLSH
  T1B5D6336AF46349D7CC8CD60AEFD0E683F376CA26864D689D5F4C43314DE904CF42AA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Saga STQ/followalit.mp3
- Size 130KB
- SHA256 a8ee900933bf0c14005d0035dfbf9a60c92dd0ca3164e6734b1d791fb05179df
- MD5 f293124a68db8fcd7667cc51cd087129
- SHA1 9cd7503200e723d4d652387d94bf4c6676c30aa1
- SHA512 f38c374128db847866fb01729a6b4ef1cb714f23d4b83935cb8ce60006f07e6ec46053cddff1c175a4d73fa25218afbcb8a0067ad251a0164adc298be5d86d34
- SSDEEP 3072:QrEcZ6kuYDdc/0KtpdZlpZLwA0fN0z4SRvO50pOOPy/0:26qD2cK7dZzGYXpfB
- TLSH
  T100D312110FD8F207E497AA7B17C0271812912D771EB1D7E6779A33C18AA23B85F68753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Saga STQ/video_1.mov
- Size 3.0MB
- SHA256 6e6b9302581c52ad23dcf6c7defca801e5afb5f497750e73b39fe273c730b03c
- MD5 ae7aa61f6614ac4ce4e9d24f8d489fe6
- SHA1 bfcc792f789a0a72e4d96f817ebb274f6bd12b4a
- SHA512 9547e83611eb11b50e08be245c995dac19734e0f71c836da72c9e8f0f9e039de1a9a50dd222d52fd73caa1f7550a00d7aac447b9933978cdfefd3a9c7c2f97f1
- SSDEEP 98304:uk+g6YrQ+Cr4WjZPe43d3y59j8VOKxx4e5V41:TXv8+cpxRyNKTjXK
- TLSH
  T186E5334537242A8AC9C48B3E630227BC153FA185CF6AF9F6172F75759ED04BC98E9063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Saga STQ/video_11.mov
- Size 2.1MB
- SHA256 e060d4415354428fc7f190e93c7d7b94bf2d6aed1e6fcd49e667500c7a421c9a
- MD5 04c93c055606678028aacbd5a2f8b52c
- SHA1 0e28345005def34b870eb681c87a6c6fc03a457e
- SHA512 dbf1d629267292d5cca72ee1aa69bc230344dc98b6458f8f384d4d78463d21dd95ff8d98b7cb216a2818f9b7699526449d065b0b56d34dc176c7d77541dfea99
- SSDEEP 49152:UDCFCjQS8P/htR7KAg7BQG6JRIcasMiG7gULDU0334hOE:wCFCx8Ppj7K96vJqcaR9Lw5hOE
- TLSH
  T13AA5333D6B94DE01D2A9AE70E323A77D5329D7B3CF59665B00EB38C01D82235FA6C815
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Saga STQ/video_2.mov
- Size 1.6MB
- SHA256 125fc43d9f332ef54efc0e6fd3b754829b860bb8c4b3cd5a5e6e8a70e709b80d
- MD5 16c5bd79979b18ac39a999cd63d6cf0e
- SHA1 20e7605aa7fbac19cec3a6857b03d524e28424fe
- SHA512 988280fa17002c3d4ca624265e54b9b7a47418d5de785327a27c320810812f97c6a46d87be82bbc74c5873949ac5db261578d6b9d29c895d232b700ecace23cb
- SSDEEP 49152:2I5Z7+hL/psI8Lco7kyS4sy1RtsuEruPUWgGYA:2E8yDLDX1RW6cA
- TLSH
  T1F27533A1E4C9109BC559AA7CDA2F0E8D61FDF140E4DE70CFF2CD5C899978588E78C286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware discovery
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Saga STQ/video_3.mov
- Size 427KB
- SHA256 b179402e9fdb82e437c4123da32727cfba410ca92a455ea1bfc4eb4b3bcc941e
- MD5 a943230212a7eeb9aaa352b774e353d6
- SHA1 d455fa0400c0327651a81dcedc7153455e8a13d6
- SHA512 d09cddebefa5118a3904773e8aca370d70b91bfe912409f49439dd086c11dbd51b7fc4359035e10a48609b560ccb7c07b399f0863d2bf8d57fd210fd12e7d4ec
- SSDEEP 12288:i1wzBrG4Pi0PJf3u+Twzite/o8vUVSY8Mapuh:iKdrEUU9We/o8cE15uh
- TLSH
  T1D69423EF2B400E16CA4D18F5C25BD335443DE6C2CC8FA4953AF23BA91A6DABD9C36055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Saga STQ/video_4.mov
- Size 1.2MB
- SHA256 8049dde5f135eb1f5d8149c1279ff74de4899b2550ef0c044423c9188ba723b0
- MD5 78bd23333ef4c4987aeedb6b025ec68a
- SHA1 b52e7d6b389c4cc9c742c59e3f52efbdcba7c34c
- SHA512 e44132b286d1fb62a75a7fc4574c2d554df314cdc5707631aca530cc38c2d7a2ce5aceb6d85b9f2a633a0fa933620e9871b1855352ea7a7f4927577a9ac6fe7e
- SSDEEP 24576:HZ4o6NAUYEV8041Cy10bhZ2i1tI95LrB3xTer6K6Aw:HH6tYEVH4d0bhYAeLt3ErLw
- TLSH
  T1C455339A775AAFF8F6400876872B931214FFC96ADF162D05C2C7D0EDAE102A84815DF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Saga STQ/video_6.mov
- Size 712KB
- SHA256 83c75d60c6a3399592ca7a5299566158801b4b4ea39a946098b8eaa1a1e13e53
- MD5 03bd00be610e935ff14a221e04bd4dc4
- SHA1 88d6a43d5e69a3360e6c28cd596502213767852c
- SHA512 48e816c80157eb9c5f992e19eedd9746e5f053e8d6dd3e7fa355877b20da9b2d6417d2ae1f45bf21f92d21f76984398566415150dcd3ae870443b6a2e311523e
- SSDEEP 12288:tjQSwAWfLDOw3vZgSO+er/RYPPLOiFZLwLQqRBi2WYbG8vFNIf5FBQwI3tp0QTx3:t/wnjDxWSJer/RYPPiiFZ7qRBtWY/v84
- TLSH
  T176F43348724893C4E1201BF38AB08AE9BD5DF659FC8658E046EB3DF3BC6797639D9014
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Saga STQ/video_7.mov
- Size 1.3MB
- SHA256 40756adf70056026815101f2a119763cbab7f12b4564d2afe4c8de0ffe276ea6
- MD5 60b137142b0f1c3d62c045ae422de164
- SHA1 d46d2c66756eda4b781458d0efc52f102e76afbb
- SHA512 2b249bf240a4ab61732890c93dc2143d06a2ac1d744a01c0cd2008056db917d673b9f2a0675d10ac3a5afa8bb0ae38c3c9117b871256b0bd333c2598bad20444
- SSDEEP 24576:utbo1bYnbdH7JXCF7R4yQR5mQAoGMR1OWWWJ/jCZCb8:utbRmFPQRwQAfMRQWWkbCz
- TLSH
  T1AA5533D42F0D0BEAE64AA2701753E7BC1BDCC088DF461159C5FBA098DDA45762C7A0F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Saga STQ/video_8.mov
- Size 2.3MB
- SHA256 9631e2c972d3c8e316334a0ff99a7448d2dcb1a2998506b23cd43a5c1bfb3ff5
- MD5 caf2a5df2e6f46e9caf9d05d4d3f4b37
- SHA1 ae96748518d1737bb78d41aeaaf48b0b08c8ad80
- SHA512 4b4b93b8f67d369ae8fcd478644f5adc5bd85f79f964570fd31399028decb553c25e14bd11a0a352514e67ea770df3ec633d281ecde41a8f11530959bbe8d0e7
- SSDEEP 49152:y2KmNK/m0CO0hOhd6c6WvKDSdeVWANi71zpC5jcVdfP8wbh:yO2mZEP6eUS48AN0r8WDbh
- TLSH
  T157B533C606679BA0D8749076DFAF1FBE318F6BA7EE1CB34150EFA46129864306601773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20