Overview
overview
4Static
static
3Bin/citize...ler.js
windows10-2004-x64
Bin/citize...ler.js
windows11-ltsc_2024-x64
3Bin/citize...nit.js
windows10-2004-x64
3Bin/citize...nit.js
windows11-ltsc_2024-x64
3Bin/citize...ole.js
windows10-2004-x64
3Bin/citize...ole.js
windows11-ltsc_2024-x64
3Bin/citize...er2.js
windows10-2004-x64
3Bin/citize...er2.js
windows11-ltsc_2024-x64
3Bin/citize...x.d.js
windows10-2004-x64
3Bin/citize...x.d.js
windows11-ltsc_2024-x64
3Bin/citize...ain.js
windows10-2004-x64
3Bin/citize...ain.js
windows11-ltsc_2024-x64
3Bin/citize...ack.js
windows10-2004-x64
3Bin/citize...ack.js
windows11-ltsc_2024-x64
3Bin/citize...lob.js
windows10-2004-x64
3Bin/citize...lob.js
windows11-ltsc_2024-x64
3Bin/citize....d.vbs
windows10-2004-x64
1Bin/citize....d.vbs
windows11-ltsc_2024-x64
1Bin/citize...ver.js
windows10-2004-x64
3Bin/citize...ver.js
windows11-ltsc_2024-x64
3Bin/citize...mer.js
windows10-2004-x64
3Bin/citize...mer.js
windows11-ltsc_2024-x64
3Bin/citize...hat.js
windows10-2004-x64
3Bin/citize...hat.js
windows11-ltsc_2024-x64
3Bin/citize...800.js
windows10-2004-x64
3Bin/citize...800.js
windows11-ltsc_2024-x64
3Bin/citize...800.js
windows10-2004-x64
3Bin/citize...800.js
windows11-ltsc_2024-x64
3Bin/citize...x.html
windows10-2004-x64
3Bin/citize...x.html
windows11-ltsc_2024-x64
4Bin/citize...ils.js
windows10-2004-x64
3Bin/citize...ils.js
windows11-ltsc_2024-x64
3General
- Target FiveVault_Release dumper.zip
- Size 110.7MB
- Sample260703-2d2x9agy91
- SHA256 155a22ee0c69e92ff223cfed8fa6979fd509a741b26794630cb75bf59825c10f
- MD5 fe41203f0834b4c940221533e9dcdd50
- SHA1 71ba96f1c02b4eeb0878fb8656828f649a724c28
- SHA512 8667ff20aad2220da776d30fa88938928792cf8e030fa6945193e80df10d85c85f7ec044a7702e2849347b79cc80624b28726a1aa44fd40d803c55f792cdc582
- SSDEEP 3145728:DtXT2W3s5UQXCB5S8/jS67bU6jvRS2dAIxy91uM:RXiW3s58s8/jSt6AsAx1Z
- TLSH T10648339BCD764A5FED2F903195B10ECB876DD16FA5A3C4345281074BC8F7AE16E2B028
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Bin/citizen/scripting/lua/scheduler.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral2
Sample
Bin/citizen/scripting/lua/scheduler.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral3
Sample
Bin/citizen/scripting/resource_init.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral4
Sample
Bin/citizen/scripting/resource_init.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral5
Sample
Bin/citizen/scripting/v8/console.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral6
Sample
Bin/citizen/scripting/v8/console.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral7
Sample
Bin/citizen/scripting/v8/eventemitter2.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral8
Sample
Bin/citizen/scripting/v8/eventemitter2.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral9
Sample
Bin/citizen/scripting/v8/index.d.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral10
Sample
Bin/citizen/scripting/v8/index.d.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral11
Sample
Bin/citizen/scripting/v8/main.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral12
Sample
Bin/citizen/scripting/v8/main.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral13
Sample
Bin/citizen/scripting/v8/msgpack.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral14
Sample
Bin/citizen/scripting/v8/msgpack.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral15
Sample
Bin/citizen/scripting/v8/natives_blob.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral16
Sample
Bin/citizen/scripting/v8/natives_blob.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral17
Sample
Bin/citizen/scripting/v8/natives_server.d.vbs
Resource
win10v2004-20260513-es
Behavioral task
behavioral18
Sample
Bin/citizen/scripting/v8/natives_server.d.vbs
Resource
win11ltsc2024-20260630-es
Behavioral task
behavioral19
Sample
Bin/citizen/scripting/v8/natives_server.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral20
Sample
Bin/citizen/scripting/v8/natives_server.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral21
Sample
Bin/citizen/scripting/v8/timer.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral22
Sample
Bin/citizen/scripting/v8/timer.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral23
Sample
Bin/citizen/system_resources/chat/cl_chat.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral24
Sample
Bin/citizen/system_resources/chat/cl_chat.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral25
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral26
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral27
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral28
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win11ltsc2024-20260629-es
Behavioral task
behavioral29
Sample
Bin/citizen/system_resources/monitor/panel/index.html
Resource
win10v2004-20260513-es
Behavioral task
behavioral30
Sample
Bin/citizen/system_resources/monitor/panel/index.html
Resource
win11ltsc2024-20260630-es
Behavioral task
behavioral31
Sample
Bin/citizen/system_resources/monitor/resource/menu/vendor/freecam/utils.js
Resource
win10v2004-20260513-es
Behavioral task
behavioral32
Sample
Bin/citizen/system_resources/monitor/resource/menu/vendor/freecam/utils.js
Resource
win11ltsc2024-20260629-es
Malware Config
Targets
-
- Target Bin/citizen/scripting/lua/scheduler.lua
- Size 22KB
- SHA256 9b4043c0bbe0fbade2a79a65e9f5739b0d55245ab1defaf05ce507b63b354def
- MD5 3e8de11518c3d0c535eb5a70756f8451
- SHA1 68f906898a68bcbc9b85fded76620c5f6e230ad9
- SHA512 b4c6032925dfb3058134a6cc659342d8b1892e11b7d6e5ad163446ed4e364d6192e592df2946c4c85168f107f570ca17fa4521600923dae81499714e5c3b8e7a
- SSDEEP 384:eVJqoFnzU0QEwSlhDOVBl3VJoPTwZCdJyzJduHkTVzyAuAaoSr/z6eN3rVM5iGL8:IJqoFnzU0QEdha7l3VJoPFJyzbacV+AI
- TLSH T199A2A85FF24F51528EA171A6C73F9681A83EE677143D1295F4C04FA524106ACC2EBEEC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
- Target Bin/citizen/scripting/resource_init.lua
- Size 900B
- SHA256 af4e2b9133fe8e7491a3e9f729d370f348a63a721504cec7975a495136cbd1ab
- MD5 c73cf6a0b205f1f0577388630f2c32f7
- SHA1 460384d6cb91856bd35b404a0bd573ae66ec7c08
- SHA512 76c0e2428617c1f92bc01a0e19ce34464d4b36b166ea65d2e4bb89dac89f4a1a2d861f8e2aec28ca75800fed2e66f63b4dd5cd23c6c0ded3158f26e18822f180
- TLSH T18F11A651370E2091AEF3C026C8AFD02DDB5AC42732649050F9E049923F7C6AF8281E9D
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/console.js
- Size 10KB
- SHA256 4b23830b9fb3ca1cfacfbaf99db4656256efc077c0794662c8a7a79779c0aa59
- MD5 b462e16119895d06546909b14cc1c295
- SHA1 7e479be3624eda71cc11b86b9bb60eac35e4a424
- SHA512 83dd287f7d86a45932cc166c1fcee224bd07e595f562ad21866e40bbafc38c753cf211063ddec7ad21cb93f2958d24875b1fc1e7f05ef83624de25d916c7d2c0
- SSDEEP 192:3zI9hK8zEO83NAubhYUImjFAlCEYRDjEMk/:3sdc35hkmjFAl1T
- TLSH T18232EE495FAB1414C0B373ADAE139009EF7A5637100A679AB9AC81E42F71C10C6A6FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/eventemitter2.js
- Size 22KB
- SHA256 43d978620a09e0cd591703ae557d300bff4d2a96fb24acc5ea97faf010be58f6
- MD5 92e1bfe9fb85ed9a1901b0bd53552c12
- SHA1 7c78ab97449158fddd72743aa86337cf62e4adc5
- SHA512 3819e98ab0f4c5d13f44da3d7b54f377b8aaf20ba1a5236f4b3389acd9bb05e0de5ccb9efdd0b2c39723fdefb8ed108458f1385d57d10f6fe05a35eb22da1310
- SSDEEP 384:JERHH0BYR3tWw15f6eLOljg5LrmRumQeRRv/wRG/Hd:ytR3F5SAOK5LrmYmQeRRv/wRGl
- TLSH T19AA21D8C5A0E557682B2B77FAF6B924AF7308227000146903E8C97F41F75C5882E2FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/index.d.ts
- Size 5KB
- SHA256 790d112e4ee81cce653df1bb408de6d41f198636f825c679a937ad78fb83658a
- MD5 090d3435f703078034ccb9ecee1d232a
- SHA1 983d73611b844adb089f74149f9d1a7601a4a995
- SHA512 fb471b917180f7c90aed769d7cf6074924343181a981ef486642befc535151edf895895b5cbb6122c27f5aa2f83963dd6a63712613a193b3faf83487fdcc1da0
- SSDEEP 96:MBgKgJgAg7gmgVg1gYgeg3gYs2811uUHUg3racAWB9V9doGBZeMcfJz8Y1YVYttZ:0z6X2pwkj9wfsIcAWB9V9ddBIPWgaiKS
- TLSH T142C1EF06B7523A758C79923BE54F210ADC753156186900EDFCEE57A20F738EC42939BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/main.js
- Size 23KB
- SHA256 03249a44e90e0370fba314f5b39e899d61597dd565db44491090f49ad0d0c156
- MD5 636ff3dc5fe86448b89af6da5f3e7775
- SHA1 5e7ababa76d7fdbac4425c007e29d0077dd0665d
- SHA512 bcd4f8764cab682e270cfed993d1c4a934644a4b29df4d8fa6fb22d8d8798b5216e3851b83b0061134cd7f27ccf6260e313b4d599dfac7518d167aa8d222fa29
- SSDEEP 384:ToElZCaCTfD8NMLKvC8Ct/tsE9qDTEsX5yuub4rd5C4Waij4X5i6rXuSAzOPb:TooCaCrD8qLKvC8Ct1sE9qDTEAyuubSF
- TLSH T195B294C6735F21EE87E93399403B714E9C7CDAB3392D82FCF89C6A5414A6A19C255C8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/msgpack.js
- Size 51KB
- SHA256 f523afd1902ad1a6975cc0d52bfc2ccf9a0fa92f6a76300019e10e93a393ddd0
- MD5 ecc937ad04f3d534e14777b90bc00162
- SHA1 a0a224bdd5e6a74ca1516dd62982b931c8b20f2d
- SHA512 ac62e933ed2ad2a778ad5a8fee85495fafaad5e41cf3c02be98de2e2a3dd15240319b11d89e9ac76717db71210efd447247b533ec14ad26a0ba264f95490b232
- SSDEEP 768:UyToecRKwKR7ChQ15Qc4VP/613CiqYGUrsVDP73urz/E2hA+2UxwfkK9Kz1dbAKo:Us1bCDcx358rurE+cz
- TLSH T15033C6C4BE95B0199766716540EF194FE13DE928A48D0884F229E8F13CB88EDC677E7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/natives_blob.bin
- Size 2KB
- SHA256 1bd1a8996b1dadffef79c298c17f709838bd678a0933a0d56dc8be8f60db00ec
- MD5 2ffe40c89e31363d5d894fd5429daa0a
- SHA1 a2439c1cc402126094111410c6b7439ec8c5c412
- SHA512 f691498938715df2ce7bcc0a42aa864d632c6d30b323e4e7b16d87fbfb3e3bdb33738adfd04fc17cda6898fc3a6fd92db70f6dbd16d59ce3caf8eb7ce8d5ab8c
- TLSH T14D51DE6BB8E7E47F949138FD704F1D4BE93984E0387DADEA950E9480193701C9239E1D
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/natives_server.d.ts
- Size 149KB
- SHA256 65f77ec5488b3488b142df1944e5840c676f32edb79af52bb16a7d37462fef10
- MD5 8998dd90f0cc0943fba78f25432b3950
- SHA1 6134b14cd9185c6df298ff777d328fbb36d4821a
- SHA512 60688cdabfa5b6730eb173eb33ac632da4d67f47fd82cc8ecb16bc6def6f3cdcd4d7efcbd83f489dce115133fc4b6f0e0dbb674b4a5f3bd737db26e5ad5fa200
- SSDEEP 1536:ZPwjFgzlafffPi+3LR9VyLRnxA5xZEMrPhiGiS2ftfVNCJSfBLnREeorUA88uV9C:fIER2Y9A8zIzF4gtuGl2al6By
- TLSH T140E3959BAF88333169B25262A1BF4048D965A224751131EDFCF4A9142F0FA7F46B7CCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Bin/citizen/scripting/v8/natives_server.js
- Size 164KB
- SHA256 e54be6266af6421d47834ffa0a81e9751dd90914cf18b317b8e44772171dc61f
- MD5 007d1cdd3d841b046e7be4d95696fa9c
- SHA1 ffb9edb3da25fb49d68888c68606b1929d8337f3
- SHA512 28575a45078f67ad5bffc6d7a6bd2418aa8a148437c6a7e11252294b9cb26197fb9e82b144592da3c053c313c4aedeb0665b78f7a707800675d5144a1a3a9bac
- SSDEEP 1536:YOQ4OJ6fjPh+0hV94Xq62J3Q7wRnxI5x8ECrAhiGZp2iHXWNtJSfgbPREkhOUmZi:ENa9Q8RqD+OMYmgZe6PDxcbCN/jBUgg
- TLSH T172F3B5A62DC82325E4736264D26F740DF669F13021CE2198FCE8A5582C1DE7B46BBDCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/scripting/v8/timer.js
- Size 7KB
- SHA256 3c0a089db7b91d37ee7688207ff0e1e0a3e7c74a2c62b563713b1540efec1799
- MD5 0b2d2009f6a36f8a2d7a81b9feea036f
- SHA1 235979f343cccc665ce8f0548bb6502e8eb7d446
- SHA512 9b58522ac22fe2ba10eb02b0d73e3d28271b6a98d45c01c02e6ba2b0d9daf66d1a288b9797ed70b0ee8bb484b6b81aa3593c9c8b498c050f752310d06a4c99a8
- SSDEEP 96:tP+LNLxuXe510zW5Wpbi5Wgn75PDBMgpI6hXYBXZgI6RCtv:0xLx110SWp+WgttzXYBpYCtv
- TLSH T197E1DA8E5A67244349B3F37E9F535249FF295233141842B57CBE82A68F3502893D2F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/system_resources/chat/cl_chat.lua
- Size 8KB
- SHA256 e48050489116ef379ebbb9bc1f69522605217017287b66cef4b3c019c130c0f5
- MD5 e07748c7c28d83a991f0105bcaa51f5e
- SHA1 3827028e718c07d879d241fd78449aaf0f7af80e
- SHA512 4f969f664ade001e914ea53ddc3c33eb5d39f124fa6554f71c4c8e823288bc053d6ab796d0dd502ab2eb054edaf24f7e26995186df88b49fd83f9ad13a0bc11f
- SSDEEP 192:yvSGx1IiVxix5tCrO8UNCyj3BHZXkX/c0daNFUF6FlFsbGJ41fzCBXHSfSt+Y2UJ:gxVGbHScEavg6n6GJ4JCZyqX2LAhMWF
- TLSH T19502412714671679EC72A056FE5B6506C61310832A2B1022F4FC58E11F753ECDAF2FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
- Size 1.6MB
- SHA256 ce4d357f416036476b1fab123fe707d765f0aa435aaf70994b45bab3c9b9aa18
- MD5 511500cf140da153444ab87c1820d42b
- SHA1 007d328b99e4ce93e242b6127e239b1d38af1cef
- SHA512 a3f770b43b8399e1a15dc42e4f34d9b436f1062e8ef3de1c2c84aade62c5fbaad2e5d884aa416db642307b00fc1380f3fa1e2f7fe98f54e74664d08519c488a6
- SSDEEP 24576:MTb+VNL4CtwAGP3b+Aswm+O54zbtPgbLLEH5yZ5:MTb+VNL4hAGP3b+Aswm+O54zbKE5yZ5
- TLSH T10D756B88728575B686B744E5407F800BB23A2D54740D80ACF17CD8EE3A7D94AB1B7FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js.map
- Size 7.4MB
- SHA256 ff2f81edc7af28c0f76acdadc79ebbd54d9927177bc1143a5d37625f865a50ad
- MD5 749a3b9c6d573cc677989ba82bdc1c13
- SHA1 530c38ae13c7af932f2452cf0b7118c47a33e628
- SHA512 4f669c4da6072e0360afe6fc50035b2c0d3cbae42ee2428792747088cbdbf3a8921bd7315f22b3f11fe933c1f278f5b7cca066e7f8f0a1357336b29ad92b6583
- SSDEEP 49152:g1PKKptfpnlFQ9D2Y4iU8LzlVDTaWaEp0ohTusqpwoi0gyp5PEZRMKD0VXWnKIjp:g1NFQFD
- TLSH T16C76F8257277D63A5A471FEB56FB0420BE19704835508A103E4CC66EB382F78F9F6CA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Bin/citizen/system_resources/monitor/panel/index.html
- Size 1KB
- SHA256 94222e941196e4f126df5a9928dc6b47d9f075faba78249c787dc160abd03148
- MD5 32645b0fa6f24e19a8b6c8fa78bd4aa7
- SHA1 f68ee4a21a1407ba246758754c3eefeff68aea6b
- SHA512 2914f76e2a2f23e169bc540082ff04a0e046213fdb8c4eb7c10b66f25609d9b6d90108cdfe24cdc2a10278ba9fa1ba4071a59cce12138923009ede330a8c5d7f
- TLSH T1ED3161038EF09C291225856959D2F008EB33864BE7083820F2DE45DF0FD2FD2E8E7698
- MD5 SHA1 SHA512 TLSH
Score4/10 -
- Target Bin/citizen/system_resources/monitor/resource/menu/vendor/freecam/utils.lua
- Size 2KB
- SHA256 ed33b1dfb1e9febf59deef27a4fbd4c0ef33d5df4ac8267007ddd9e6ce984736
- MD5 c0ca4765e0b2e181f031aea30de8de86
- SHA1 ad57a0d0e21f58079b73e2aec278433581c0c9d5
- SHA512 5f8851eb170ba83071509d32ab1e8ecb46488be8ae3217251bbb72e0567ce19e0f7f23a29d7d3ffd5dc5dbe38e746135e9db48664a050a13e245c327e28f187a
- TLSH T1CA41138A264264364792C6F4FA4B9806B56135A3841C466B3D78CDC93F6235DC3FFE24
- MD5 SHA1 SHA512 TLSH
Score3/10