020a1a30d739f4abdca531c6296dabbc508bc35ca5b112122a173982071aec10

Resubmissions

08/07/2026, 07:10

260708-hzc2gact7t

08/07/2026, 07:00

260708-hs393sds3j8

Sharing

Copy URL Twitter E-mail

General

Target
dw_build_3.zip
Size 42.1MB
Sample260708-hs393sds3j
SHA256 020a1a30d739f4abdca531c6296dabbc508bc35ca5b112122a173982071aec10
MD5 b3ed1606be86418ffb5715e493160a82
SHA1 31c5c20bd74c43ac49e188f210b86492cccc9360
SHA512 20440bd55d8b1577e81e156d89efcac27364cfb3b3c7a79bccc0f3c1a952cbb208887664ba1c795a6c15640654016f2cb2b460a8051dd4c8d6f8d0fc967eaec4
SSDEEP 786432:3USo6niEtd78sbVIvrKzqloBZm91fppfYJDqGsS3SmjFO4pkKnNwCRV:3RnnvHw0IvrGiaW1fppAlquSUO4pkqNj
TLSH
T1AEA73373DF6D581AD04374BB8D30C2BAB29A947C8EE545133C9A5792DB1F18299F3E02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.Core.Runtime.dll
- Size 1.1MB
- SHA256 4bf3170a079cabd9837567451c3374a27dae8f37111c608c680868b71567708e
- MD5 4f08ab698c0408fac1827285a50ba307
- SHA1 d1a2819c64e6d2e6c7786dffe5c45ad8d7f17985
- SHA512 f30cbb368f8866d83a6ab69e123f8742c63b772595e10d305a2b85c8d59a260e6e5bfee2503bf171a68eb74c97bd086bfa970a21735a03fe8e46d772b0378846
- SSDEEP 12288:1v2yMIN2NeOmhcf2VKEo6rDIe52CMauGzbW42S3Hypn8C+rH9eRd5AQJd:1I70hn0CUGzbW4XCCwRd5AQz
- TLSH
  T16D356D2277D86E66EAAF1B3BE0720E190772FC2216BBE74F5B90954D2CA33405D09753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.Core.ShaderLibrary.dll
- Size 4KB
- SHA256 71f88a4326606ac5ab8277cd6591d37895d3374598ab08ee4a0fd65cd3bdb6dd
- MD5 c144be8e5e9abff91fa0ed6f49eba34d
- SHA1 0c3196570a41ade72ff553b051dbc21df2442d34
- SHA512 13ccf08e1e3c112d15015fcc2543b978ce5603d611dcc75dc4578dc577594d951e0bde41768ce9de7f8c072d109b5c927fcf5baf3dc2a813fab1f8ba5042b70b
- SSDEEP 96:pVckX7zl23a8JI4T80kxkDjXiacRawpSp:0csq864T8JuDriO
- TLSH
  T1B0916206A7E857B3F4E707715EF3075A2BB4F8119DA28B5E1988056A6C322144E32FF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.GPUDriven.Runtime.dll
- Size 274KB
- SHA256 2923505a3246376c6a2bc025d11b97abca730e72e3fdcc8bca1d9b220796b9df
- MD5 ea70365d361f34b71885ac7c46b4f7df
- SHA1 9c81660c952b706e6be924f2e50716740115bbf5
- SHA512 12e469d4e6daf55ff909104b65221cef5b4e53868ec4187a92beb4e19d96f35aa5438cd1904070df9103b135bd2e73e2748a7427fe1eeb081ad5e035397dd058
- SSDEEP 6144:/k85X4GhJ66VkVYsZacHwexSHRJGmZP88:/k82GhJ6AkVTUHO
- TLSH
  T102545C7027D54F16F98F0B39E0B05C875667A41AC8BEE3CC998C88ED3DC6B846A54397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.ShaderGraph.ShaderGraphLibrary.dll
- Size 4KB
- SHA256 13dc19e94cbd8dd4d62bb550e97c32bbf4d9ec66b53e241096c50f0ef6565ed6
- MD5 3a0ecea2ecf16a8c1ff090b27e8706fb
- SHA1 5e4b8305083f89da1f54416e543efc6921ee0324
- SHA512 29ce574b6f440e9f7583a65f32e13d6959d20c477bae0e66fc08de782b75d630c71d6c403726b5896cfd5c87e12d04c3ea27c895e84a79d0171a74f3444b20b9
- SSDEEP 48:6F+l8bRzB9aW5bq2pYJgFHRZ+IMN1qYJQwwjEKhkxksnQLrasjXNulmOLsbOkq:PMHbq2rBKJIw6E0kxksQXJjwIwsb
- TLSH
  T1FA915157A7D81726F4F703344EB34BA65BB4F4108E939B6E1984566A6C313144D72FB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.Universal.2D.Runtime.dll
- Size 207KB
- SHA256 8bf76666ce739dc94d28230666ef5041d5fe006b2ab53150fed0d119b01bcc9e
- MD5 a00afcc372ebc2e4d059a131b9dd9d73
- SHA1 bb15659b12139ef7a16acd27aa89738a3215fbb7
- SHA512 c9ff097f3d6f2146c6bddf7a2d46aab5c227fc94ee0b8c89ca029c6c20f11c05a07f62732187ad5e79d1caddec0d173f9933afd85849a703146f9e74c09936ca
- SSDEEP 3072:wMAmyonhTa9BZ760JTd53cw6TTgMr4kvJWJW6a2AHuGU5HObTxOf1uDDr7OlH2:w55/2Tgo4MWJW6aA5Hyxkl
- TLSH
  T12D246C205A995D27DD9F0B7F90681845D732A22BE6DFE3CA5D8024F9385F7C09E483A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.Universal.Config.Runtime.dll
- Size 5KB
- SHA256 25e18d8eecd0feea6863ca45a987c59995c9f51e8357afbcabd73f8486fa5d48
- MD5 04de3886d65d38407defeccaac5b38cc
- SHA1 d9525bbd42b9cdaab45931ad9a1aa72a2daf27ee
- SHA512 34eab5ae06a63228a0c492245c66498d7d6c29fed6fd82d61993dc8d20451e89aab2959fc05ab7dd69c4dbdef0549d82f5463ad0476be75577b3fb0949772028
- SSDEEP 96:7ht8SYeuY2aNo8KoYyZJfrEP0kxk3myXYvhMmX0HrqV:NrNulj8KYJfrEPJuzYcq
- TLSH
  T1DDC19566AFD81773FCE387725C7643A11774FA128DA79B6FA6C0101ABC250444A62F74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.Universal.Runtime.dll
- Size 755KB
- SHA256 9c476478563d3c8ffb663db59903f2129f232523963bc01cd8b4ba9fe234e6e2
- MD5 ffa96d70f6053a6be86d2b6ea628859a
- SHA1 3511543fec2d6e57a9ece2e5b39e1b3d46502d8e
- SHA512 5f13a20419ec20745a86e3d0e7217b76463d126f44bb3a91a2cd41b368854e8cf0961f53c56c1f2c2b8ffc3ee28ccfeddf3bd250fee534ff9f126b90dde8fe2b
- SSDEEP 12288:IsF8A2esQrRrlCDgm/6lzIeUbPSWJbi32Gi+f:B2esQrRpn0SWJWi
- TLSH
  T1B1F45D212BE43A27EEEF1FB6A4740D2457B2F95765BBE78E0A40D09D2CD67409E04327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.RenderPipelines.Universal.Shaders.dll
- Size 4KB
- SHA256 8f5e0fb8524303e784846431052a5f2e5f7f23dda0e98ed737698302d1965e27
- MD5 89ef52aa152e37e4327f385e0755cf51
- SHA1 13373eb77adfae81d038a0bb29ccc7ee5f7b888d
- SHA512 7e0087bb69bc0cb717edfc48343e5ae1fd2dba6ca4037a2052253f7c009066e7a8d3f6a80c16fd9258b33fa10fc6aec54825ce7b29fb7cb42014a26928963e31
- SSDEEP 48:63+llkijgCM6jovrXW2QkDh+IMN1qYJQgLEj8KhkxkBmyLrxWjIG2svulgRTq:htjigEa2QnJIQm80kxkBpXUUSGuR
- TLSH
  T135917213A7D45773F8E707325EF30B656BB4F8228E42936E29841566AC352488D31FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.Scripting.dll
- Size 66KB
- SHA256 25c5fa79ec3fd29565b183fb514812dcc0d2b4c7e9e2a3c2b4a6608a91496b87
- MD5 ebdfc8c48ded38d27a15597bb1c378fc
- SHA1 982e843539bfac21c1251d76abe492f503c505dc
- SHA512 f6bf775847efcb74e6470f52ff2551f3dafdd02f357ecbacc60800e9fc82b971478548b34a5e116c9447b3f3c7e009e6f4dcc48b947a57dfbf8be584fca4775c
- SSDEEP 768:ZfknpXvmF8Rf1lcg/JPnfHPXn1u/F2VQTC6/IWNXxlpBEnQHa96chlyMvUqtElr4:ZchPLFP/1uuQTjAWTlAkwYwjA76
- TLSH
  T12C637C1527E44B17CAAE6F75BCF050960FB2F886A536D3CEAE88E5964D037C04A61373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.SurfaceCache.Runtime.dll
- Size 4KB
- SHA256 97ce605942c01799421a054d15eeeea0479314b26aad49a6dcc43af606e0212c
- MD5 e9585d7590f868c61f63c5db6998d5f2
- SHA1 3f0f49159da71e852696d8ce1529d168b7a0ff05
- SHA512 9d2dae07bf7968197d33492ccbb6530f18f64c9851ac9690fe3fad3952a20cc71b7c720d594e118d362475d1a54d55e0dc0f5007d1ebc2cae91d7307f5d13ebe
- TLSH
  T1F58173639BE8476BF1B703758EF3871232B0F8129AA2D7AB14C4452EAC157600E72F70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.TextMeshPro.dll
- Size 439KB
- SHA256 0a4249854fa0079745d2c36749ab0c7e4a6c5347de74457c9a3431ffa51a0cc8
- MD5 ee6e5dbcd1af451da0f1fd457bf22af1
- SHA1 c654fa721bcf521eb96e1a1a870ae8710fc491a8
- SHA512 257e7e089ed8f77cc3e47d335fbd94ce86919d23b09c6f1e07a82a7aefbf6cdfc8d57dc87bf581abe4c4dc040b7041acdb0f30caee2999e8d0bbda3b1f4f9292
- SSDEEP 6144:Qjp0KPjAHD1Tofokx3r3/a0AMKO8apvylPqjZwDUUb/l6qyFcV:4ZAHDCDa9apKsNBI
- TLSH
  T120A429507295863BE55E8FB6A43B083273B291F1F18EE78F644460E828667D38453EDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.Timeline.dll
- Size 131KB
- SHA256 7f1b0cbf5dc0c4063d8725e1e36d5ec15b5f467c738948d96cc992f9d0c942d1
- MD5 577f415224684766d6a446ee22e3b496
- SHA1 40d34443afd518c7e8e18192da87ac35bbff8759
- SHA512 f67a13aff0e748d6d2fcf86c849e2800a75b334e14672d999a24280274439817d2e4cf21951960db29317bef293f7124d3047978534684ec2719dca4fdaf6f8b
- SSDEEP 3072:r8qiH/Y9+uGcHC3D3L9sQ4fL6kSsY64F06oPQihJa83:+w9+ulHWaj3SLF/oPthJ
- TLSH
  T1A5D34B741BD4861BCADF0B3EF434025843B5DA17A517F7AA9E95E5E82C633842E423B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.UnifiedRayTracing.Runtime.dll
- Size 99KB
- SHA256 9f6eb1f1e9a983cea55cbbbd97429c0be54a8e0b795372c81cccd4f90c7b39a0
- MD5 5b7505be7978cf7a41b25523b73c3441
- SHA1 59bd73b0294797c9e107d12c43fa492fa41f487a
- SHA512 a39b7354cc313ec338377396b96bd727065b876247524ec931e4d236775be5f75a787d0491cd8cf39be5b3b7d32798a1d4558d55ec9e00d9c840ecf7c87b0945
- SSDEEP 1536:SkcTAhNbEZKfJ6gN/y4vcjQCZ2Obts3ofSyckM1sZBh9DICCoWNa:/sZK44v6Qz+iK1BPDCoWo
- TLSH
  T1A2A35B302AD95E27F5EE4EFF60B40D486336E917143BE7CE1A8828EE24277D19A04757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.VisualScripting.Antlr3.Runtime.dll
- Size 84KB
- SHA256 ed7ce205f66eafe39bbb5d084d42e7fe11cb4b386ff208e5d5110891be0b7b37
- MD5 62a6ef88ac683a13104417515323896b
- SHA1 7007a0b1b0774a57a790c17e0f27ea0a7f4843f9
- SHA512 7f99ded5ad9d394f2b11317a708a98243d100f5feed675243f1c0024ffc148c0609ec60e24a899664e0389adb0cb8fdd15d8d664cae52e4efaea141e659629a8
- SSDEEP 1536:RLXDkne3PaUaB9tj+IB5MWvZ/BC+Cat/3PX45dmhLcR7+FR66CUm+P9:RLXDkne3BspLC639a+TT
- TLSH
  T16C83182627BC8B33C39E52FEF8B000448BF5D5157613EB5F6D80A8E959473429EA532B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.VisualScripting.Core.dll
- Size 615KB
- SHA256 60f35e792033feb99c684dcbd36348895e7d293228680c607bd260c8060437e8
- MD5 44778bc99d355c433ff396be50a5f986
- SHA1 42ef5f70de3a10078f8149345629d4833c1c3615
- SHA512 7621cb620545c34483ab955b677d211552e5178edcab5d2fef34ed5bf50af2a0fc322a3cd52a45f44ab853438b604b4dd55a75238af24913a1634d8a476aa257
- SSDEEP 12288:mr3cqcev86OT4e3pF7dpsKzAQ7HCXNShZvhDqgQiXDfgg2WCibE:mE9TCibE
- TLSH
  T169D42A50E7DC866AEBEF5E7E1C35130E0235F82B54BAFBEA282214E415937D05E14B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  dw_build_3/DingleWingle_Data/Managed/Unity.VisualScripting.DocCodeExamples.dll
- Size 7KB
- SHA256 7c40139978546872b44c8837ac7c4b305535e4384ee64ec65f90f0513557a29e
- MD5 ecd33e587a6aeccf97bc1a16626c14a5
- SHA1 616a4298232da412aa3d63b222b928ca27672024
- SHA512 03d48971ae2fdc9fb1f4d09b0e69f94eeb18a53b6afdb59bcc7dd36c79981d61aad38e84ec95ffcf1055114efd3e1413622ae9082e7ba81b7aeab6a105e99951
- SSDEEP 96:3m8WsUK6cW9NjqjPx2RLtuDzfiyD6PPhkxkQXVwm81fzR:9ijXRLtA7iyDUP+uGO
- TLSH
  T184E1E775EFDC4627D8AB13375EB382151A70F344CDA3DB99148C192A9C303802D69B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32