662641fec31b845419774f301b2ac2712a961e2a6e2b294526dce43d4fe3966d

Resubmissions

06/07/2026, 17:37

260706-v7mbbsat6x10

06/07/2026, 17:37

260706-v7ld2aat6s

06/07/2026, 17:34

260706-v5mjbaat3110

Sharing

Copy URL Twitter E-mail

General

Target
Sh3eytat 2.6.7.zip
Size 22.4MB
Sample260706-v5mjbaat31
SHA256 662641fec31b845419774f301b2ac2712a961e2a6e2b294526dce43d4fe3966d
MD5 1c4759c27e9fd9d36e249a6f4c75bd31
SHA1 08d5bd01c89593bc244ac76410a81c53a3c32e9c
SHA512 22ffe6ec7bbcb04d2feae0404ed854c6a844d3fccb8cf014aa16c12e02e71db7f348420cb43d09e282ae2d526ac6d757a206c7a7907577da875ad4de4d4e5e25
SSDEEP 393216:bf5c94VFA3BJ465ZHuxFB1IRafU61+vRvusW5sPVOhjKLKrwhF0FlcrY1:bxc4VFAb465gzg81+4KLKrRcK
TLSH
T1DE37333ECA99B09CCBEFD6F55C5E30AB2995D9F0465A1B2782353B0560CC04ECACB746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  DiscordRPC.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  EntityFramework.SqlServer.dll
- Size 577KB
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- TLSH
  T187C4F715B3E45E24C3BB4230583A701CEAB582F3627D0694F95EA3DF6FBA91115A3723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  EntityFramework.dll
- Size 4.8MB
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- TLSH
  T1EA362942F3E81F2AE1FF067AA435604A5AF5FC6A1352D65E381CB1AD1F227005A63737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  FastColoredTextBox.dll
- Size 333KB
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH
  T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  GMap.NET.Core.dll
- Size 304KB
- SHA256 059d01aa50c69092c7e5c80b2ff7086d090396b9c88bee3249a73a22c989e449
- MD5 3bd6862017e4174535003bb9324ec9f0
- SHA1 fe1de87c7e8c12803f5431bb58ebd69d8d81a30d
- SHA512 2288bae87066a4444afffca49ec8b69ababdf0030993d0c2feb67d903d3956846fb8bf0a9ef4e07122777952393fce7a299d1574a9040ee8b9f49cc85015fa6f
- SSDEEP 6144:IFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwkPz:8j7zki6vGyJPb9VP0H
- TLSH
  T1EA644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  GMap.NET.WindowsForms.dll
- Size 154KB
- SHA256 fe7210f210803eba226b6c3072b96a7aec6301694c540624b38bd98656bfed01
- MD5 3d8c5ada957655aca14089c2052c6339
- SHA1 bc7d491607130163fc7b0f141aaa8a2166558eba
- SHA512 6cd291b25bcec1b9fe6d0b8658381cae8248f4cf3aa3cefc5756cb1d481698e42091cdcdac332030a28597f99d884b96471a23309f49394554f1eed70abffafa
- SSDEEP 3072:mPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJaA9S5DBRS9LXf+6qbugizczq:IccbGucgK9vd3UrS9jf+6qq
- TLSH
  T189F39DA273948D7FC66F47BDA0A140C12736FA02F692D39D1D9170BC4D93B146B227AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  IconExtractor.dll
- Size 10KB
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH
  T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Ionic.Zip.dll
- Size 451KB
- SHA256 3b3e541682e48f3fd2872f85a06278da2f3e7877ee956da89b90d732a1eaa0bd
- MD5 6ded8fcbf5f1d9e422b327ca51625e24
- SHA1 8a1140cebc39f6994eef7e8de4627fb7b72a2dd9
- SHA512 bda3a65133b7b1e2765c7d07c7da5103292b3c4c2f0673640428b3e7e8637b11539f06c330ab5d0ba6e2274bd2dcd2c50312be6579e75c4008ff5ae7dae34ce4
- SSDEEP 6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
- TLSH
  T155A4BE0023DC4A6AE2FE5775D4B782A5C3F2B815793ECB8F9D8464EF191A780D6107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  MetroFramework.Design.dll
- Size 16KB
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- TLSH
  T114723205B2FC423AE7EFC5336BA945503D74A90DA872CA1C1CE80AF959F67424AD1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  MetroFramework.Fonts.dll
- Size 656KB
- SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
- MD5 65ef4b23060128743cef937a43b82aa3
- SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
- SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
- SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH
  T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  MetroFramework.dll
- Size 345KB
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- TLSH
  T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  NAudio.dll
- Size 464KB
- SHA256 8e347abc9301d67dd7493a0fbbe5cc1f912900c204a84220cc8cdf0e0b8df0de
- MD5 2e68aeb46e26a29ffe74cf97b94cbaf0
- SHA1 9384fa2946f744be3b47e131df14cbc0632052d2
- SHA512 39e56b0dd316e9a927ffeff486969f2a472f9b262b6a131afa60c34baa01784cde9cc6944f1a46ee73f3cc7135cb0049cc5a4bdfa419fab37667829522f6e7c9
- SSDEEP 6144:igY2UEI+85kQDHzER++2a4cSuEsHTyRwl0AYTA7qkpRMUwbX/1rFXF:TY/HXQl40HHdS4qYWN1F
- TLSH
  T175A47D2233E4582BE4AF5776E8F40D2B47B2F5463976EBCF65446A6D1C837424E00BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Newtonsoft.Json.dll
- Size 685KB
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- TLSH
  T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Plugins/AutoRun.dll
- Size 13KB
- SHA256 6d12c5fdf3b4173d9e844ae5d37c049199823d20530d76d18d7b282a96a147b2
- MD5 6ac90a8f5efb39b40fce34a168804d41
- SHA1 015fbc2935284ade5137683a0ba032a31d776f77
- SHA512 bcd3dbcb3443413a1028646731e602a918a98afdf5daed61a0bbba8ba86b4d50e5d922cb5ef62f614b7b4ec1f18580ce0add1d98653bd0a7afde1e5f3ab2f23a
- SSDEEP 192:NN/wWMx25CPSXp61Cx+lqMPiiOd8BP5P2i2LPzicr8wp3cFPZLt+QoP:NNP/5AE61Cx5MP+YP5P2i2L+I2Lt+QI
- TLSH
  T1E252E909BBE08A26D96D8B7B44B257144333EA83AD93DB5B0BD8509A6A173C4CF14FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Plugins/AutoTask.dll
- Size 95KB
- SHA256 c6b04c5d6663a952b9a548936ec3c505905c82ed6479961a1753fb031a1656cd
- MD5 4cf1872f764b48691f7a1699c0de8448
- SHA1 1576883f83d5c2fc1f35b5387e077eb3de620bb7
- SHA512 429cf7c1078625481709485cbc4f7cd8119dd08091e6552c725f505cff0c3bc27997ad76191cb6fcb39b3f849c785719dd785c24bf3bc02d62f51aceee873bbf
- SSDEEP 1536:XpLLddrrRW8yyQQSScDB33ZZXXVK5vc7IrZdbWDNv6piPUiR+IpQpB+rmT71s/ws:XpLLddrrRW8yyQQSScDB33ZZXXVKpc7F
- TLSH
  T1C393595177B8C667D1AE92F1A1B647548B70C202B217F3DA5EF814FC2C637804AA26DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Plugins/Botkiller.dll
- Size 315KB
- SHA256 dee8b676a5f2123bf790247fd928d4e3b4a86bbfa39c46466a82c0a3b00ee348
- MD5 6503aaabf113f6653a0f7d8ca4ecc3db
- SHA1 639f8e7f7acab346b311168f82eb547faec54d96
- SHA512 28d8c53bb48faf2e414c84f233c3b7502cd4b667b6b38853b15cac2fe5d91cd523bb1ded95bfa3a590178fc89081973bfb50b2ea49f3fd30c37f517c5e454200
- SSDEEP 6144:xHMa+mcuWyizvpWP+pP0uKnXJMTAhTqv35j/6NCnM:X+lx7pWmpIJMTAhTIjS8M
- TLSH
  T171644C516BE8C53AF6FF5776E0B202104BB4F146D566EB0E68C820F91E63305A9523BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32