3a4fc26f9f625361f09fb0a6a5f97c9fec60c5ab0f8425b2739e8a9082123c3f

Resubmissions

04/07/2026, 02:23

260704-ct965aew8q8

04/07/2026, 02:21

260704-cs88faat8s

04/07/2026, 02:09

260704-clkaqsat6w

04/07/2026, 01:47

260704-b7y6caev5p8

Sharing

Copy URL Twitter E-mail

General

Target
Occ'x Discord Users.rar
Size 22KB
Sample260704-b7y6caev5p
SHA256 3a4fc26f9f625361f09fb0a6a5f97c9fec60c5ab0f8425b2739e8a9082123c3f
MD5 60286a04cc28672ab82eff913e95405d
SHA1 35e68a9d346e8498280c21bd986a65a8dec1b5ca
SHA512 aced48343c0059a98765a06e6308c1de5e25b7c216006def41362f1424b61edf046c8de43969ef53f26a94929319629946159f134c84655a13e2e831fc0a0a2c
SSDEEP 384:n8Wt8mDB/xkNOTFeZPZFUpBGl4376Dw89F6r7YU0JTOqQ0M6dIAsPVRkLCCq2:EmNxkNOTEPDUpBG/DF+r7uG6IXVRkvq2
TLSH
T1FFA2D0222F901C63763170E457B25BD12236A793E28DC2D6F36885CAFE4B46BED61D31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Occ'x Discord Users.rar
- Size 22KB
- SHA256 3a4fc26f9f625361f09fb0a6a5f97c9fec60c5ab0f8425b2739e8a9082123c3f
- MD5 60286a04cc28672ab82eff913e95405d
- SHA1 35e68a9d346e8498280c21bd986a65a8dec1b5ca
- SHA512 aced48343c0059a98765a06e6308c1de5e25b7c216006def41362f1424b61edf046c8de43969ef53f26a94929319629946159f134c84655a13e2e831fc0a0a2c
- SSDEEP 384:n8Wt8mDB/xkNOTFeZPZFUpBGl4376Dw89F6r7YU0JTOqQ0M6dIAsPVRkLCCq2:EmNxkNOTEPDUpBG/DF+r7uG6IXVRkvq2
- TLSH
  T1FFA2D0222F901C63763170E457B25BD12236A793E28DC2D6F36885CAFE4B46BED61D31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2 behavioral3
- Target
  Occ'x Discord Users/Occ'[email protected]
- Size 9KB
- SHA256 88158eadcbcf6b46ce1832e946d33f108dc5303bd8f548841d4992b4be97aac7
- MD5 4e84d9792f8a232be37c15d253975832
- SHA1 168274dacb2de5f0d0a233dc0be659a2a2d63130
- SHA512 ef8f1034ef918e3b46b81e5ab81679cb73a57c49ea83db84ac38b1062c2cf8d7c00f10fe8fbf383d44f45982ec0a20f0ab75273c532acabfec37cb019d9c8ed8
- SSDEEP 192:MvYEAcnBQFbQLvGNnr/+a6J12PAwKUu6qDHcHfTbNMljK/lUpJawBVQE+:0zBQwaiHoqzc7bNMljKdUucJ+
- TLSH
  T1641284328C120C3386789E1CC9B58D41F264D61BD169196774FC82CC9F7FAA3DEA16AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4 behavioral5 behavioral6
- Target
  Occ'x Discord Users/Run.bat
- Size 816B
- SHA256 34fc4b28351d44f84ed04a4e4234fb2435963e15e47953f98dbbfbac2a13f107
- MD5 69a2138de26323cd9e922e5b0c1b5287
- SHA1 28c7482e9a5f3dd8fa8ab432ceef39328b1bb53f
- SHA512 bfe20ce9ad1e1b658690e16a48564e111d55d7ed03c6538df8fa8815feaa0a0666504cf36c4fad920f5f2da64f5fceb9b16df90ee2334ffe4857c507ffbce2c3
- TLSH
  T1DC01DD2B372690A097584C0EC83644E8FC72AF93D60ABD2420E710701D86B97F75A73B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8 behavioral9
- Target
  Occ'x Discord Users/available_discord.txt
- Size 32KB
- SHA256 4a79ebb3aa56f4de3417901703feb74bb46fdbefb1217af33e3dacb5ef3c832a
- MD5 75a6c7e342bca7b4d81cbc90cf9e183b
- SHA1 6d2980e812c0ef4581b962b7f5ac1d6ce232188c
- SHA512 adb22d530923dd5e3ad439fc75f72f8a71df53617b39f4fdd3cad96ca4e1472e4a5108e4a13a470dba3dca5f758899e4634618f93aace6da400fd6b1e48d1a18
- SSDEEP 768:sGhwkH1LeBEUb3o4wJ+A3I7DDZtwvZirQTEwSHxj3EzPq:sCwkVaxo4wwAq2irQTeRTEu
- TLSH
  T12CE2C75CA88EB3DC455271D68E33A197B384039B2F431613837D0BF57963525BA4BE6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12
- Target
  Occ'x Discord Users/config.ini
- Size 434B
- SHA256 f4bcec3d0ed0753deb60ab6d4d5ced2d51f286e21c2f6a5eb0bb1f984cc10f0a
- MD5 a4c525c2382bcded4a4b9f6a1e19cb8b
- SHA1 9164fbe425f37c8191d61f5dab6d723d0aea7fbb
- SHA512 dd483c5655616c641d69bfd9e8bc92e9a90aba1ba4bd0ae8adbd5e7d5e24cee7738667520d6f5da31925f30dafd3fec83f97dc49a48ab7fe42e82402b5eb0656
- TLSH
  T1E3E0E5F5668A3420C6765E0984D22469D4313CA77907BC11F5923E41E8ABD1363DAA78
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15
- Target
  Occ'x Discord Users/proxies.txt
- Size 236B
- SHA256 ca66de50a731f7c64cdafe278a7c967b2e73b2d0ee8290090df4455c0f72ae9f
- MD5 25d0d2cb3057c2f5d80c066de6e21c70
- SHA1 7cfc162230979788f155baa25d1767d0ef626e8e
- SHA512 8976716a9d20a47ba95cef2e7a525d8361a1fdbd04dcce9ecac3dbe7dbbcdca53057a6f474ff5aed60876939e56a2be0499ac1af87d5db178da960d7e59ce92b
- TLSH
  T14AD0025D60AA9552CC746918B02801562EE1059A9B94254110D5437A9C744A4502D9A5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16 behavioral17 behavioral18