Overview
overview
6Static
static
5meccha.rar
windows11-21h2-x64
1meccha/EOS...ng.dll
windows11-21h2-x64
3meccha/EOS...ng.dll
windows11-21h2-x64
3meccha/OnlineFix.ini
windows11-21h2-x64
3meccha/Onl...64.dll
windows11-21h2-x64
1meccha/Pen...ng.exe
windows11-21h2-x64
6meccha/Pen...el.exe
windows11-21h2-x64
1meccha/dlllist.txt
windows11-21h2-x64
3meccha/winmm.dll
windows11-21h2-x64
1Analysis
- user interaction
yes - max time kernel
62s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/07/2026, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
meccha.rar
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
meccha/EOSSDK-Win64-Shipping.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
meccha/EOSSDK-Win64-Shipping.dll
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
meccha/OnlineFix.ini
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
meccha/OnlineFix64.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
meccha/PenguinHotel-Win64-Shipping.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
meccha/PenguinHotel.exe
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
meccha/dlllist.txt
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
meccha/winmm.dll
Resource
win11-20260513-en
General
- Target meccha.rar
- Size 69.1MB
- Sample260701-eftckafx9t
- SHA256 e1b56b7c2f9a8f768616db5e861cb4bd323e8003d561e0ddd240a3914f1a7bb1
- MD5 a2c562b9709e710769b5f238e908a8f3
- SHA1 cecab9c49828c050cc3a941fddf8da437b087fdb
- SHA512 48a12c8332214b0ca9ea630ddc0c8d33718ee6150d7182be2449d09b3b60c51a6e0f19f6f79b95a6d63b074dfb7f24b4e6508d3842ea542fb28f7b3f67d67019
- SSDEEP 1572864:6rD8efgKutPh6eX/kcF22Tv7iFatexjZu+KEounoUAPVBG5xprIOUfTH:6+6WkcF2KuUtIjZR4yYfTH
- TLSH T106F7334B2C47A42DD848A35F952D088325CC5DEBABA8232CE57436C4BF71C5906F9F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3656 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3656 7zFM.exe Token: 35 3656 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3656 7zFM.exe