2c0d18772e1e20e385845746c0da2bb2b728ace7cc89d496faf309c0e61ac474

Sharing

Copy URL Twitter E-mail

General

Target
Traduccion Tyberos_v1.9-20260705T042847Z-3-001.zip
Size 14.7MB
Sample260705-e4nf8ahv7x
SHA256 2c0d18772e1e20e385845746c0da2bb2b728ace7cc89d496faf309c0e61ac474
MD5 b8984b244f836aaaf617f14b894d02ad
SHA1 ac1c6a920ff666088b28cade8a13da7d4f0d6256
SHA512 96cea52a2d247e7c2beaf820e951221716a739544236577702db9c387675a6ad1816030ebdb2e82ca6d4b29105ddc3667138430c580ac3ee7acb50ea88dead88
SSDEEP 393216:1RH83b41EJ+Yx/hq9GSHxmtsVlfGzVElisc768C2tZzWi1h5E4Ow2:XH83bmEJNzq9/Y6lezVE4VPCRi1iw2
TLSH
T1C9F62386D77680B3F8DE103932220A0704622C77B2A5DD59D1E3B9AF2767F322D74E65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Traduccion Tyberos_v1.9-20260705T042847Z-3-001.zip
- Size 14.7MB
- SHA256 2c0d18772e1e20e385845746c0da2bb2b728ace7cc89d496faf309c0e61ac474
- MD5 b8984b244f836aaaf617f14b894d02ad
- SHA1 ac1c6a920ff666088b28cade8a13da7d4f0d6256
- SHA512 96cea52a2d247e7c2beaf820e951221716a739544236577702db9c387675a6ad1816030ebdb2e82ca6d4b29105ddc3667138430c580ac3ee7acb50ea88dead88
- SSDEEP 393216:1RH83b41EJ+Yx/hq9GSHxmtsVlfGzVElisc768C2tZzWi1h5E4Ow2:XH83bmEJNzq9/Y6lezVE4VPCRi1iw2
- TLSH
  T1C9F62386D77680B3F8DE103932220A0704622C77B2A5DD59D1E3B9AF2767F322D74E65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/Dialogue.txt
- Size 1.0MB
- SHA256 bd360eadaabcf9c3372e5b737a172872824e3266480ec621eaaba8395d3bc4f7
- MD5 3741ba885d29b5af077042b4eb1beeca
- SHA1 643852dd770b8f27b79cdbad5b3e8f6a104592a0
- SHA512 561424acfceaa5cae89e056b61f0b367aa6bb758fa4f5ef7f7b7618f0ce8dbc42f51ad3d0f850dda2e967743374e388cf15a5ba9aaf783e914afde2c5013bd5a
- SSDEEP 12288:vh2dPk/j8vnZOlNKDSDbopbUUJsgwwpw8N8gaxIokFSCrJ3cMH9Oz5ke:SLZuYSHknwwr8FxXk4CrJMGje
- TLSH
  T12035A52F5AC3354522B197958C83EA73BE09BD447938DE657A2F210E30D2C4963BE4BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/backup_20250420211411/Dialogue.txt
- Size 1.0MB
- SHA256 2d876f2a76eb4940968c2e5c5dfc452ca538812cd69f3cb020ebf39efa2c0bb3
- MD5 649f52078cc4d6c1ce403bcdc8f6d178
- SHA1 4b6e2de99c9b447c178ed3197ea84aa4ee297c67
- SHA512 b65f85b842abe283142a5ca94d276056b746dd0348a98cbf3f4e3b44bea849c97dc95a278e2f9c298868022d963d4bb8c8080ec15fd63ef05ebc780f50755d77
- SSDEEP 12288:vh2dPk/j8vnZOlNKDSDbopbUUbsgwwpw8N8gaxIokFSCrJ3cMH9Oz5ke:SLZuYSHkJwwr8FxXk4CrJMGje
- TLSH
  T12235A52F5AC3354522B197958C83EA73BE09BD447938DE657A2F210E30D2C4963BE4BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/0225d01841bb7841.png
- Size 709KB
- SHA256 2e7a06cce4148aa557c8dad5f7bcb5bf1b4ae0dad32cf8d078d653b187307c65
- MD5 2ea64e1661a2bf6cd84daa4444dea388
- SHA1 6814e5bbf3c07f34160070a32dc48e6cbbba7268
- SHA512 168160d7a985c34c4e8f31ac94b6eea802954338e20252d83ba2f91024f89110d6bf20a8227e8fc3a7b1c67cb55d90da36a4a302e548b4826937d2253838978e
- SSDEEP 12288:2XEaAn0HMd8NHYjZzj304H3WmzzGSPqBTMcjlS7oc+98V0xfrao5jvAN:lJ0K+HE1j37XW+qSPqBwcBmoHeVAWo5W
- TLSH
  T1B8F42329E97ED329DD0368F2D89A0F9728676B0303F13634D7D5D58C8118CF92D99AB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/2b700449143c77d5.png
- Size 590KB
- SHA256 ae54218733363fccc94737ba8536e24b46556ab6bb63100eabe593ee291cf7bc
- MD5 963deea19050fc2236be3970fd5cb89a
- SHA1 ae9334a768dbd10daf1ba12e50f66afba8ca41e5
- SHA512 fe8652f46fa01e24a43d0a70ac0a4356715c67be2e46cccd7d4eb266f76912ec3fd4d83a6046166a910f0254b1d7b42aa894f34735d96323611a757876c7dab1
- SSDEEP 12288:UXhyGgtDFjT3gdTHvD+QHipsYEmtAnC2qRM5HuWpIQcO5vDOXsp2y/taZvGk:+RgtD5gdTvDJdYEmtAnC9RMuUIQcU0UY
- TLSH
  T1BDD42216F6B77030C4CBDC32317D798D46805E7379381867F903DBE6F8B68025A69AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/5988afb69af8153b.png
- Size 636KB
- SHA256 61ea6517c0d4aae20b4114ba17e35a6e605baec53389a1173ad98c3ab6453da2
- MD5 24ed269b55bdd11840c0a00e9fc121c6
- SHA1 c4b7072ffb947313552c0d0f36ef65fb5057a9ea
- SHA512 56eb343d040e21a63b4682a4d38389bd1f23b6e5bf41e548dc1b4c66693a08e7e1544db383a3c651d5b5218bda71cfed20f02859677f635b2b87345e3b1fdaae
- SSDEEP 12288:/Oqyy+aZueCieASq8+HQmjgUTDLUw/SfBZLAE4V5p00jmUvJTkeg:/OqOAueCieA7VH/jPDZSfBZLAE4p0fUk
- TLSH
  T139D423D56AB6C37DCB22117340E95E0BAE04B082CD581D60CCA6BBDE3F56C999A4F347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/7acab711346866ac.png
- Size 675KB
- SHA256 5595f0b7653fdc1cdb9774f3bc1616de1490b4b977c75ac13ceb88bed1a8519c
- MD5 a61685e51e84cbcc581a13683b8fda75
- SHA1 5a6b07f2ca686d19c7069be1d0984b9ee38527b1
- SHA512 3a208b24fc480d39663098db622b30964e7db93a348acb919f31f4fe1992a9ecac9f1cda98132a60c6102e2753358a94874922ffafe7ee9cf6774b014b67e083
- SSDEEP 12288:qr+fs/O/sYpojhRJzRc30OytGca2vfVZdCvC5zEfBfxUF42YApdkSbr2ppzqPgi9:A+fsOLpojhRJ1tOGaufVsCmfBfiO2fq4
- TLSH
  T134E42359C2BBE1F2CE83C47184515EA61C87BF48ABF51539F9CEED1F5A58D239300A82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/7cb0d46c5adc0a03.png
- Size 474KB
- SHA256 552cbf5af3d136a22cf5ff4558b171d4403a6bae2227bb7250d2eb1ae3ec9711
- MD5 8692120692b584623358f6f519c55d57
- SHA1 748d21e784724e06a4d7d89b0bbf196e5f8d5d8d
- SHA512 a74870b23ddc075e5e0f03bbc5aa5b43da82e49072f68cd94fb55896e3ea1f7f6eb5e930bc33b42e4b023513fab1b74d252026e84510f0a6ad32e5f57c6fb852
- SSDEEP 12288:dcljIs8WWZrs0TZeu18KbsoP3qGJTE/S3ch:WlE5x1OZoaGJQ/S3S
- TLSH
  T12CA4236B04AF07C7E035C07E422A9B6E5143014AAF24069799CAEA17715E137EAFCDDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/8029b50924d441ef.png
- Size 807KB
- SHA256 eee5deda0bb3a9b06750e291e8c13e2276e515b37c70b39c28e2062f8cb93f82
- MD5 17f703b442ddc17a817c06e5ae596519
- SHA1 172c9a98fcb62f3af87847b4c25313f919fedf2a
- SHA512 b74e2c94d5fe9afced3edb3c5ea38f7bb21ba3716ff3cf3606ee353dc5f51f860bf8810cf8f736109414849d18e33dcb061764e7e84b8e7ef26ab72b9631d939
- SSDEEP 24576:NL9ar17WnbSQIacKXa8cSAjtrsHEsLmtZrANSQtPQ:NZk1CnbrlesHEsztPQ
- TLSH
  T1CA0533A7DD6DE62FEE1F3A702A58F87794C474800122A291F1F1CE486D117AF6C2C1DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/b3012b40acba6cdb.png
- Size 755KB
- SHA256 4c2b3830df213e9386ecce889ca91da77f6bec65fa0de2e0f02de6b2996cb8b6
- MD5 bd40b9072e8002db5f242ce7e6d2a3bf
- SHA1 4350eb09d12fb567e10c862e1824f0e36a045c75
- SHA512 1d069e17811d92418d6f63958707da5fd0e7d1c59082626de3950fc61327dea0911c86de2951a7988bcfa679c74743cf9d4a4b98a9e5014710cc71bdad7051f9
- SSDEEP 12288:wMqAjowU6EXCGubT1kC9RQf4Bsg1+/x6U/WULt7dNwEMa6TM/mYfQeU2F7RiFk2X:bjowrG+2C9Rng/x6U/WUv2jZTM/mVe3w
- TLSH
  T130F42390C9F88835D9260136E7770422E27D94BEE744148BF79ED1CACA5F81A2EC5F8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/bc71f43265e7a5aa.png
- Size 237KB
- SHA256 109a4ddd9a349c88beab465a615d69cb199ee808fb269b7c975433080b7ca823
- MD5 079f90a100f01ad695c32ffbebc6627e
- SHA1 b68391ec376b265d0e1b149bb2aec4b0efdba5ad
- SHA512 56560fb7be491cd5e157f28eb6cb3e629ee4d4be364752eafebcaf5cdbe782cdf9add07ccd5e320e906475451581906e6714ae27a9d827b2bef5cc383a7abf07
- SSDEEP 6144:fQZZFTO12vKU0OVeFRUxYCURXnao6T91+NHA/pS:YZZFTZvKUz4T0o6T9oAQ
- TLSH
  T1B93423095E361499F06695B35E91C1E1FA98C07B423842F9290BED6D0BFBB1DD39D2C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/c47a9c4ef24acf60.png
- Size 298KB
- SHA256 1033edc8d5029455d9613375fe3d4f7762fbc49907080f2196f2172dad3e42c8
- MD5 0074311209681cc095d031d201518e32
- SHA1 f60a55e142a4a8a4a105c4c29acb9906b44ef75e
- SHA512 becf8707a84f5b2908bba7a6d740e64ed1be9f1a886bb1b2610cc9a4c2765e2b016ed1e371ce665bb815045bc29457abd7d23006a200ef1c45b72c6e7d09a00f
- SSDEEP 6144:sV6r79TTKzdOQPAOc17uVq04VzC9WoaPJFcunkONhu7CGY8V48Lm7:sah2BTPAb7uA1AWoaxnnk8uQuLm7
- TLSH
  T1795422A4AE3D95CCCC80763CE5DC4E6FFB557582283F0D0BD8728B9A4B389582D35889
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/c668c604c02be334.png
- Size 867KB
- SHA256 506e63c9118252f81663e0b089ec16c9a62750c91e796533d0d98be9b42f7211
- MD5 c331e47c8761de9cd08738f049c5f924
- SHA1 e8e0d369c681e4a0183f625d08f58952c9fa8852
- SHA512 e3b5196e5bc53cc3e6efe29a2e23662517a476bcdc3cf1b5cf5dc6a106ec7ba913980cc877c7e363ddda25b91f9d74fda58a3cf6349cbfafa82449f52a0fc035
- SSDEEP 24576:6huXgUcZyiaHfecu6gJbHsAiTeZAjJiGjsvAccW:quwvciYe16gJIAqeZY7iRcW
- TLSH
  T1D61533C387ABC431E54F5C73F7469EB005A27DC89AE452D1D029FAF085A4916CF60FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/ddcc76bcc94cafff.png
- Size 285KB
- SHA256 8acbe6464659930b79ad4f547c3c3ce12ca2072d9260e7a85c7d55f1096b99c1
- MD5 c6019da2c55d18b6ea9105a220185ecd
- SHA1 a6a16a46ec2c386654c838524367a9a131d74331
- SHA512 40d9417ea488b4b1d6dc09331a329c6fd5ee64af0374a490d1c7dfdc8486e9eb482ba24128c9ea11bc7d1e61d8e8e8299ec999a53a45bfa7b48dc705f569b3b7
- SSDEEP 6144:xP6lmFYj4Q219Oe/yCSsC81ee1ZzLHzzNH8YO0eRMNbxxU:17osC+eURLHfB8b3MN4
- TLSH
  T17654225A82FCD6B1D89714F892102F03CCB7B0B156F9E86DD07F48AE141CF15A4AD62B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/f5307397750f3fe3.png
- Size 207KB
- SHA256 96a29afb9aeb0396678d6628e06b32bd83b17c3940b8ce5f0b6308fa73033f05
- MD5 b96204edd3507df420f7133048c53124
- SHA1 d929f4619847f2ba62d5f3cacffe51259be13f09
- SHA512 1c9776f9189a9bd14b011a03c0866840e5d99c2102c5da154eefd51e4b928d7dd5fb5603a3bc58becaeb3da30439baae410e57850231d58b783541a029b982e0
- SSDEEP 3072:/gjxITOhpSR2o/Mjff9eh2bzas1hVNSRziFkvczZvxfUC17oYs2GmptYpY9PSoHD:/zx2oMFTza2sRzG04Zp17Pf1S+bEkYhG
- TLSH
  T1172412DF73682A32E2AB05AF6153481B38E42C4E28E6D5F843D2CD4DF761DB90A41677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/f7aa74a99761a884.png
- Size 124KB
- SHA256 0b1737506b776e9757a5e4580d66607d2b66bcb5193c473ee7b1f6d6c43f6f30
- MD5 1c79976f14d22bf2ca77c697b65ba2ab
- SHA1 21ec6e56dd66962fef645ccc3e5906600357e17e
- SHA512 c79677e0195eb3120f253ecab08d22811f4e07cc6614a8bde03f7ee38e43e2a630dac3f92b874c426f43516149b0c64d51ba643f31edc6ea1b9e41ba78e51e50
- SSDEEP 1536:Ec1BCWhmh3QPgW8t6osX+fjS4ezUsSqFt/jx+0DgQB4zWrc3FaPUHQyCJ+el:EcKWkh3QoXYkezZSM46dYVWUTCJr
- TLSH
  T1C3C3E1EEA1725463A6ED362400631FCC07355BBA30FF625CD693E93306290BBB65A173
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32