e3ef0510c51150ddb3ef5d206d71e1d3e783a6e0af1960374166c57eac9b9d25

Resubmissions

08/07/2026, 23:31

260708-3h44vaav2r8

08/07/2026, 23:31

260708-3hxd1abt7z8

Sharing

Copy URL Twitter E-mail

General

Target
Netryx-Astra-V2-Geolocation-Tool-main.zip
Size 6.3MB
Sample260708-3h44vaav2r
SHA256 e3ef0510c51150ddb3ef5d206d71e1d3e783a6e0af1960374166c57eac9b9d25
MD5 13f1efcc958756c7a718ac11833816e7
SHA1 5dce954626a1bf99d6457f7ab5232cba5b17104e
SHA512 c38cf80fcc8f7e5aff554093b0ab2ec7fbcb32a70256bf546dc4580137b35ef8e33452e5e0c7885aab115aab7b382fe69c1cfb7ad316d7325598c9128a27b7f3
SSDEEP 196608:cQ3TvstcJWbz02jhx74UW2otOx+57+y4X7ywTil2R9cap+:3jvaPz02v7VW2oAxw7zU7yJW+aM
TLSH
T12A6633729F234C6FAAD240D6165D7C1EB05C4B547CA9D82EBF2076889D08BDF29F580E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Netryx-Astra-V2-Geolocation-Tool-main/mast3r_utils.py
- Size 5KB
- SHA256 1b6b7f1668b4187ba3fd7ae2a9fcb60ebb2dd9fc5860d095fd42a3735117e20a
- MD5 56754663d5eeec8b7d06e82f55297f94
- SHA1 b833d6827ebf2485aeb39d15b194706cbab78d7c
- SHA512 e061811816d520c3687bac50a35b50cba60516d874bbefa77d34fca76054c9cd90c1d8128c191a8d7f1fd39f991770a1f99cade89d8016367a64f65ccae39e4c
- SSDEEP 96:ZS9x/udsfyT9/LAO6881d8i1WpGyJql2zlSlo4RRzmvX7XiWAs8QCvZ3Mu52YVB/:ZW+T5azQNqE14R1mvX7XiWAs8thMu52k
- TLSH
  T158C164A6B86A34141A47E2C8ABDF45ECBAFBD8D336C14A24F58CC14C9F146F4426625B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/megaloc_mode.py
- Size 10KB
- SHA256 906fcaecc4bb86781eb75eec072d1080c0f6a693b4f384f5fadab11b6b326e8e
- MD5 a0759f5b1da03ffafe08023b482ae997
- SHA1 62acef1e31ddc5070f3b0c8ce81f1bdd7912e360
- SHA512 7af9af3eca324267e2a2540aacc04b78066530b5b74ddb0d68e390290dcbb38030ad24c602a10bb8cf4b37fdd68573b7cf7cfe28e83bce22229d9f7c057baa56
- SSDEEP 192:rIVC2HBixXDIxXWZ6zePecDm6MgsbJ7eQu2mdVB2Qe4HJHPO2W1+CXGqJi:rIVCzx0553cC6SN9BxX2L
- TLSH
  T1D92265F7985B442B4703E86A899FB24B2A1F55830E4D0995B2FD20806FD987163F7FE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/megaloc_utils.py
- Size 11KB
- SHA256 9287a713d8877d116a491f16bc4bf26ddc378e9f5ece0636c4237929f5d0e4ed
- MD5 40990b1586708160cc87828964cd54cb
- SHA1 30764db3af195215fbb91a2846189b29d0ffd110
- SHA512 926288a937a9a77808d452b27bc7c0d061e4f8b8acd4eebcd9b29318b4a2f7010c667c87fecdbd91773b703a206523cf7c0d745290cec2b3ee704e4fb1f2224a
- SSDEEP 192:ereudaQN1kTnZgCbsSTnXzh2AjlXDDBTDCRHsG8mAK/nxga/t/OIVsSWnVtklRvb:ueudaQN1kTnSCbLBjlXDDBTDCMTKZJUM
- TLSH
  T1BE42B9B6AC623C183257C45CFF6B9452EA2E7A8336440A20B19C21582FCCF75913F779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/netryx_hub.py
- Size 27KB
- SHA256 b0ad2a21a03ed6487eb8e5c8810a4e8fc9b392904e2639e33d937e7718a8dc77
- MD5 e261377e4448e376499b0ca0eb7da1f3
- SHA1 00613d38f7fab9285521123684f1b6f837cb5199
- SHA512 5ec4654d740368c46cd562ed8d6da615462c2f25d625a47d1ed8a4cac9764dc881eeccee1af4a021eba1203040c04db97033fc77ec3afb9bd9b83847e156a0eb
- SSDEEP 384:lULb4Y6Qny/tGkrbMvy6kUz2PMFwTWcec2z:luqtGpvy6Fz20B
- TLSH
  T13BC272329C2918957383C56C4D67AD824216BA033E0568147AFCB2E86FCD9B7C1BD7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/run.bat
- Size 82B
- SHA256 11a7c4b396626414e558be7c21f04b8c3d220a780e7dfb4bfc30881f9051889a
- MD5 4708da6324e3ddce5e72b8a4cceb6a16
- SHA1 ec0a94ffaeef14cd404df22ac2c5c84c60d60690
- SHA512 c498ca1e55064f216d9651a66a6be968d4075901c8df2b03c05db37c96a31c62abca10475f5c95ba0738811a411eb943da431c2deac15a1f89648e868ae0816d
- TLSH
  T13FA012012A00602009113817802F21484C4CD0832B0384026C6548152E8D4704D44152
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/setup.bat
- Size 2KB
- SHA256 890c64322766cfe0986d193df4340a5915af0d80421fe2ef5b567328b1376101
- MD5 73972d52685310e481cb251ddde98bad
- SHA1 04039d4157fd9625d0ea6c37678f76ebbeb693f4
- SHA512 51b7bf54843bebc4c7895792f09b44b7108dfab171697f74c72c393223d13870c3cc45ce8d9e925f1d58f633b5bb49ff82b4364335d9e7a64d0e6423792d49e5
- TLSH
  T1A651534E3060F0701B68D5D69E3E5176B7B1E49F25131D44B2EB82585B08FE2B7EE447
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral11 behavioral12
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/setup.sh
- Size 3KB
- SHA256 6f13812e795857630a6040bdfe78a23e6fcf4050f703c842e9886d7b63340c17
- MD5 d390b0802fcaa832fb5dc01f230fc9b3
- SHA1 fdf06c9497e5771613213927b60023acfaace3ff
- SHA512 4bad08591116fafc56c85df0113c50c7a12a699a61056aeb4f87480f44c30cd470a57c29bfcc1f44b512af675f8e5a5198bac8eb3529bd1a487f8503a3b9907c
- TLSH
  T1A6717F7F304061353A065DBE8B7D0C113562B457E901A82812EB60EE9FB01D5FE2EE3B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  Netryx-Astra-V2-Geolocation-Tool-main/test_super.py
- Size 107KB
- SHA256 7b37ce810236b848834a7754222e1743da2f47a95b17225061059929cd4a21a7
- MD5 c7c5d90fd0eb891319746b7d357f56af
- SHA1 283aa6b5c1e7f324caf4a8470659ada96e3e0278
- SHA512 d72b5edf6f066851067a19c3629e4b541ee73ee25ee6c66c197672c075b22b4ab7fea592b0bd65ef1bb95932f828f88e2a05c05146fa27e05a9c26f3becdede4
- SSDEEP 3072:Z779nkNu3Pjg8vQ0Isya4aPzB9K287KhIgf5Fdw+c:95nkNu3PjFvQ0Isj4abvK22X65FS+c
- TLSH
  T10EB3E72668212514E353DC6E89BBAD535B1E8D036A0D1528FDFC92C01FA4672DAF4FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18