4bacf521f0cc01558ed47b9715cece23ed840cc60db08c2d19812133c1558c71

Analysis

max time kernel
598s
max time network
436s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/07/2026, 15:32

Target
Ginzo Stealer/packages/Stub.System.Data.SQLite.Core.NetFramework.1.0.115.5/build/net46/Stub.System.D.targets
Size 5KB
Sample260706-sy2zbac13p
SHA256 4bacf521f0cc01558ed47b9715cece23ed840cc60db08c2d19812133c1558c71
MD5 92726ab5b36a58e7547da79877ce1aa8
SHA1 b0a123ccb55bb1066f8f79d18265a6a65742c170
SHA512 cd53b944e527893c912deaff095361dcc296b5154e21aa692dd142e5ffc6a81b8ff88ae15c4d02637c67f10ed4cd38357adb57906527db4ce734947d8ee9c7f5
SSDEEP 48:rQdk9km/xD2YT8Vn3X0XlXNPn19Ap8xQz/sJEZzz/+/V0zhtlTRX6Uc29L:ke9jjWGZj9V8v3KinXU29L
TLSH
T174C1CF5489DB6D6571B471323BB028C9DB3002ABE5212CCABD9CB959AFBF6100067BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2120	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Ginzo Stealer\packages\Stub.System.Data.SQLite.Core.NetFramework.1.0.115.5\build\net46\Stub.System.D.targets"
1⤵
- Modifies registry class
PID:2268

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact