e1b56b7c2f9a8f768616db5e861cb4bd323e8003d561e0ddd240a3914f1a7bb1

Resubmissions

01/07/2026, 03:57

260701-ehyp3ady8n8

01/07/2026, 03:53

260701-eftckafx9t6

Sharing

Copy URL Twitter E-mail

General

Target
meccha.rar
Size 69.1MB
Sample260701-eftckafx9t
SHA256 e1b56b7c2f9a8f768616db5e861cb4bd323e8003d561e0ddd240a3914f1a7bb1
MD5 a2c562b9709e710769b5f238e908a8f3
SHA1 cecab9c49828c050cc3a941fddf8da437b087fdb
SHA512 48a12c8332214b0ca9ea630ddc0c8d33718ee6150d7182be2449d09b3b60c51a6e0f19f6f79b95a6d63b074dfb7f24b4e6508d3842ea542fb28f7b3f67d67019
SSDEEP 1572864:6rD8efgKutPh6eX/kcF22Tv7iFatexjZu+KEounoUAPVBG5xprIOUfTH:6+6WkcF2KuUtIjZR4yYfTH
TLSH
T106F7334B2C47A42DD848A35F952D088325CC5DEBABA8232CE57436C4BF71C5906F9F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Targets

- Target
  meccha.rar
- Size 69.1MB
- SHA256 e1b56b7c2f9a8f768616db5e861cb4bd323e8003d561e0ddd240a3914f1a7bb1
- MD5 a2c562b9709e710769b5f238e908a8f3
- SHA1 cecab9c49828c050cc3a941fddf8da437b087fdb
- SHA512 48a12c8332214b0ca9ea630ddc0c8d33718ee6150d7182be2449d09b3b60c51a6e0f19f6f79b95a6d63b074dfb7f24b4e6508d3842ea542fb28f7b3f67d67019
- SSDEEP 1572864:6rD8efgKutPh6eX/kcF22Tv7iFatexjZu+KEounoUAPVBG5xprIOUfTH:6+6WkcF2KuUtIjZR4yYfTH
- TLSH
  T106F7334B2C47A42DD848A35F952D088325CC5DEBABA8232CE57436C4BF71C5906F9F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  meccha/EOSSDK-Win64-Shipping.dll
- Size 8.2MB
- SHA256 b73f5e43ebf4579f17411ec26d3824adf4ff09636a4cef3cd0712c83f5eee70c
- MD5 8163e2257993d4f3257998efb1b3b522
- SHA1 d70ad0c9bfff7d4558fc2312e080264dec644854
- SHA512 54e29c70b13e0bbf2ca90a1177dbf6cdb71c3564153aba744d77e4194e6abcbe1a482acf1f50b3373487dfbb6f5b353e793e3260367aa17ad887efd767b8dc4a
- SSDEEP 196608:XLzsxxKR8LqmrsdgwLBIlPWbtpjnSXPDqClbq7KtK1o:bW1G5FIIb/jSXPxOKD
- TLSH
  T1368612E524D640BDD053CB30E2493FF8E5997AAA5D7A942F7FC214022A71DD2C9A1F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  meccha/EOSSDK-Win64-Shipping.of
- Size 18.5MB
- SHA256 9821beb84ed841d2e9bd412ad55b7982cf1fcb64edbf0fd3ef7ccac38632fff7
- MD5 db899f4d83ebc488d0f87c8c965670b0
- SHA1 2eee08cff7e123f316f3cd4d616f9ea699441f68
- SHA512 5843643a165c4a1e18b89f69d3937ad4b328e636cb55415106d7417bc46973fecffe09a3d88f2b97e722c698ff28c6b98871f79f2a7075191dc9289eca0a590a
- SSDEEP 196608:fkw3xyCMO1bhZR4eTa+d8xCCTCentNUtR:N3aMR4eTa+d8M2CWtiR
- TLSH
  T14917394272F40094D4BAC2BD8E67D912DB71399A1B31E6CF06A0999A1F77FF099BD310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  meccha/OnlineFix.ini
- Size 648B
- SHA256 f3396767978d24f77e95b179dcc4afa073689a0d86b3e0491fde74e4ad355760
- MD5 5b3e0cff313418be4c96c1631dd53ea7
- SHA1 bc9ac4dfee843439b2bacad08938b3aa38f26f61
- SHA512 8c868662d7a49921e5c73beec57a92e4b3396a84cd0912536cfdcf03d31aa13016a20342376fae1f135248eccdbb31baae7dba6d0034b679769df8bf7a11791b
- TLSH
  T1B4F002D83DAF7A78C6A30A3CBDC39C4BA5DDB556B20F1944B4820EC6283ED00516470C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4
- Target
  meccha/OnlineFix64.dll
- Size 13.2MB
- SHA256 27a1c596c4b1de1e6672cb7e7fba2ba3d3124999493ff82a504beb6f6145e88f
- MD5 00813d08c8a0cdf3420bd38fd72c80e8
- SHA1 992119b11b5067959776b18f609c594c6c888bb9
- SHA512 a842617f0fc320fa90661a7b7a7809252a5b935ce4249a79f3fe520565a02db6c55ec80b9eb581aac1b4b29ad5954adf6f29bcf1d3624ddd86a5b8b03ad929bc
- SSDEEP 196608:OrATka029FenZW3Q8YrVNnZv9/F91mWsz0kg4kAHh3Zkghk0XV4YPNOLOOKj:KeLIJ5d9/FjxsGTiJ1hk+HPNTj
- TLSH
  T1D3D6129925D4937CC4408138F5451AF9F0D97C888CFD8826FFC749127AB1DA9C8BABB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  meccha/PenguinHotel-Win64-Shipping.exe
- Size 167.1MB
- SHA256 8f6e26cfe9763dc8a467b642bf13d926373332e434e23fdca4d7f4a93f5cd6b7
- MD5 fae9ef64d9b9c08d64cf04183769fb14
- SHA1 c420540cb8fa7e2a1940a64a1c269f4b592d3c84
- SHA512 f088172b00ed58c6a6a3ace6bf8f9232f08895286d1705c025c9aac8978ca47b945dde87dcb2bd4119e3a7f190ec4ee2f99d72418278b1d871d2d57f5938ed58
- SSDEEP 786432:7kQqVdue6BZYMcQ0sRzTli2eIvsHEqXI90OJl333v/Ax1e9Q9Y8fl:7kQqVdue89cXqTs2eWqfI90UnvC7Tfl
- TLSH
  T1E8887C47B7E504D8F07AC1758A3A5606EBB1387A0720A7DF15B045891F3BFE499BEB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral6
- Target
  meccha/PenguinHotel.exe
- Size 217KB
- SHA256 4584159e0ed79b5303e698e53948de6b804bfdf693c1805620b3e6d67aafdc09
- MD5 6c36642d0c6623abfe08a31beeb95152
- SHA1 9e797051d7330f84975204ddc82a2cf89f821ed7
- SHA512 fb253373ba0c8277a4781b017964c7611edb67e391db81278a63a8df2c46f8342addd23c57d3a58c977355192e8c53ab475a47544460ed35fb1f712415e66a27
- SSDEEP 6144:mvudZJp30u31EwZGIMs2Qpra2WjvsCr5bJ8:mvudzp3hlVZGIM9r5bJ8
- TLSH
  T14B24AF07B2A030F9E577873888615656E773B8314B24DBAF0794867A1F232D1DE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  meccha/dlllist.txt
- Size 15B
- SHA256 fc0befb4aae4b7f0eeb1c398fccea03cc795590e09db6628974520091fcfc516
- MD5 d7fd711e5e5f73da110115ce98beca0b
- SHA1 a04719d38bec9a97b8f098cf29bc863006c43a33
- SHA512 e96b14c280a83d4a0d5eca3ce6af8ea5ef679feaa6b70c2775ace90c4ab54682c74d620a681ae3bc09baa534ae643dc7551b8b650f7d84658f38a8934448af87
- MD5 SHA1 SHA512
Score

3^/10

ransomware
behavioral8
- Target
  meccha/winmm.dll
- Size 490KB
- SHA256 61d071e40fb1136da66bf12213062a47eccadd7556171b97381fbc937e978b0d
- MD5 5587d78c2c051ef9076ad19f42624064
- SHA1 ed11f49303128e9453566d83bee62f1779bd7a28
- SHA512 42fc22d08ee963eed7b42db48e5a396db98fabd72df120ba94e863f122fabda230a79b11d952157c73b8506be647ab7a71993deabf477ec5d72442abbc3042a1
- SSDEEP 6144:eo0EcwoNZhIE/adO00WkCUxgtF9Eaa+slRp0YHLFhNpgcHxbEvyW:j/cwoNNat0JuarlR/HLFh8W1S
- TLSH
  T1A3B48F19A2A842B9E567E07CC9434A07E7B1BC464761D7CF03E09ABB2F277E0563E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9