d821604497e6b7bae7c20c9f49e8698ca65606f581e0719e1b9623542ffcdc40

Resubmissions

30/06/2026, 01:54

260630-cb1vqsct2z

30/06/2026, 01:36

260630-bz9bcacy3l7

Sharing

Copy URL Twitter E-mail

General

Target
DELTARUNE.CAPITULOS.1-5.rar
Size 630.8MB
Sample260630-bz9bcacy3l
SHA256 d821604497e6b7bae7c20c9f49e8698ca65606f581e0719e1b9623542ffcdc40
MD5 ff380dd012f003056da2cbee6a9c88c6
SHA1 13a5966aaf35d4ab3938ccc8710226a9b8f6cda5
SHA512 5adbe3557ec46b17eac3ea309edfe3264387c30cfb1a9c52378fbdaecf7cd8b47fad262626f95c62a30cb157b5d57885f503d07da3f2914d938f93a910a7c739
SSDEEP 12582912:b3/VdsqQWZbDjJdZTDpUI81BzXsYYyAjKkAeerub5JHmdJ:bPVb9UhBrdpSKkMSbk
TLSH
T17669338E70C01E3BF465C47646C37B43FA36867F263617BD0372BB693AE428A9635125
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DELTARUNE.CAPITULOS.1-5/DELTARUNE.Chapter.5/DELTARUNE.exe
- Size 6.8MB
- SHA256 b882cc1879ad8f24c63fa6e4f47a8fef9a01065ee61ad6220beed9932b04e7ed
- MD5 7bf3cccc2e54481ced3a149e1a083684
- SHA1 ddd9992ca1ae2e7eb8f63b4b20c63b430dba4026
- SHA512 9e29c01120c1f145363c1d0e2cdbd764a50dbe875191b98839ea37a7cafaed160a654d88cfbd84b73c5e3e5cc4bea863373d2a3062205f768191fe6ccec843b9
- SSDEEP 196608:nbP4YyBOMDt0q3LM76lz38SmJPcZoOxCeW00q+Ux/agp:HE8S2P5Dhgd
- TLSH
  T108766B8632A4C1DDD167803CC55696FAE2713C41CF5197CB2AA0BF6E3F37AD409BA621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1
- Target
  DELTARUNE.CAPITULOS.1-5/DELTARUNE.Chapter.5/chapter5_windows/execute_program_pipe_x64.dll
- Size 122KB
- SHA256 a594a7205f6a4ccff42cb460dfa08bb54442cb3317c7bdc0fa0437d636359402
- MD5 50c347cf03c0885d26b9118538721218
- SHA1 9bea3f10425abc7d65a55d3edd4714eeabf07abf
- SHA512 ee1e8f7ddb0d29cfd27f882ad9cd418f048b2707f869412d43332a11db18d67cb3041fab174943a1aef14a22e3879efa1d0818f552eb8073f01883528d5b2839
- SSDEEP 3072:PCkZBW7aSOC3SFFatkeLmRn87Q8uiBf7Q1je:aaWDByFatk6IeQ8u
- TLSH
  T1AFC37C5773E000BBD4668339C8A35A06D772B8520A34DBAF43A4535A1F273E19E3EF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  DELTARUNE.CAPITULOS.1-5/DELTARUNE.Chapter.5/chapter5_windows/shader_replace_simple_x64.dll
- Size 150KB
- SHA256 c10210e3cd619774d63947116bd22fb3f60f2d992b21f3ffb0121393e596b124
- MD5 073bf090aedbb91c4e12fa4dcd2ad82e
- SHA1 6f55489aa34e0ec0688f53c7d849e28d368520c7
- SHA512 6b9528272bca7617948f3a578f98b272c4c876f3c0024d469b80b490e54d82d59dd16a7670bc3b5e64a0ec1fb5643fb984bdf0118532da76327682192dbb8296
- SSDEEP 3072:4Uz8MVVIwkYoAVVoAtqV+Qa2wRs3plNPWSfdx6+2U:4+pkYoqVo5na2wY
- TLSH
  T142E33A07B2A540B7D47682388953DF47B7B2F49A076097AF13648A7E9FA33D08D39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DELTARUNE.CAPITULOS.1-5/DELTARUNE.Chapter.5/mus/hip_shop.ogg
- Size 942KB
- SHA256 62acd3d2de7e4ad81e99a2b31e40b90b1b121d93fc0c79ec724a7f1a47892a66
- MD5 3d407240e2758034892ba7b6789e55db
- SHA1 e838b6a21e5aae83a5128dabd95cefe645f44f6a
- SHA512 a7236222b68841738580bf793db341b3f0c968ba47b4ca1043f8380036d1e24aebac9b39d77e983fce6568c3e9e44eabbbd116e62f7d7024ab0406919577fffa
- SSDEEP 24576:asuGjE7Os1s564m7ImX0Jm61SPV0yHVLw7EVzDoHC/BtR:axGjE7OsO6x7Icb6IPVTEAtDoHWzR
- TLSH
  T1242533FEABDB4718D823743DF58C2FC6746EEF1D496986D18DC87E12CA7BA051821842
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  DELTARUNE.CAPITULOS.1-5/DELTARUNE.Chapter.5/mus/kris_piano_shop.ogg
- Size 575KB
- SHA256 289f6bbcd9da8e04f3ce8a4b11302aae96c6dbd9db10881dfc25abc13b1a69e2
- MD5 e85bb1f52b4b5b4192c11a5456d243b3
- SHA1 0d1c25d0d9ab324246df0dd8147e8e2b3f1db91b
- SHA512 a936765ddb3a2ea687323619256db50577c64a31da03c90ff8f2e3dfdabd0f82f88aefb5b96cf2d00bb923f94395c21e09203724188da2bb6ec69e9559c22bcf
- SSDEEP 12288:RBfyYUpNMqgPTCsOLu47VLfalLGvR3bBCi4i/DSZPBBkZl:2YoUOqUIGlbBCitDkBBkZl
- TLSH
  T1BFC4233B9C928D8DD69D13F2EAB72E21BB7B88580FA00346577E4478DD2775D2D18883
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral7
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral8
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral9
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral12
- Target
  DELTARUNE.CAPITULOS.1-5/_Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral13