596ea2dcd37d16c55414fdbe164972f01ce514d8bf0cabb5485d01cfc8bcbaab

Resubmissions

15/08/2026, 23:23

260815-3dj8wawthz

09/07/2026, 03:20

260709-dvv92acs4p

09/07/2026, 03:09

260709-dnv1pab19l8

Sharing

Copy URL Twitter E-mail

General

Target
Create - Above the Horizon.zip
Size 18.5MB
Sample260709-dnv1pab19l
SHA256 596ea2dcd37d16c55414fdbe164972f01ce514d8bf0cabb5485d01cfc8bcbaab
MD5 50c59dd0af6c65ce8f7e895d212bc26b
SHA1 f03ce7fd8d7b8caa3094b49b6d635e1b651c8771
SHA512 6283020d2d15b6065a53924d0823b2859968e647b2e31327e9c1f829aa5041d7178281781d27577c7f4bf9754d05b3d19fdea54597febbc19698e43d2d360894
SSDEEP 393216:vsQAPadPidhv/pkuFpQjV01PvKGCEjeK/zvnKI1f+DWNVN:v/APPhv/pr+R2vy4eKT+6bN
TLSH
T1F4173318E1E78BF4F46B4634E4565223E86041CEFF21E36BA374C35C3A6E7892654F92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  modlist.html
- Size 20KB
- SHA256 3e2a04e8e2d99afa94b246f80d1abdf23d47c7ed263dca31c6bf6510440d3c1b
- MD5 c582a7d16d54cb803e6070ad13f11f99
- SHA1 45a14f252f0925f01192bb2d2e1e44c581d6e132
- SHA512 b95ee04804e04a22a577b248ca184faf427e3ee7b952c4fc49c196f271e59f7c73ab6cd0e795051d554f301041e79f8f78b30be1db3ca00f026e86fa9a381cb5
- SSDEEP 384:js9U3EwWIVmjuvfcnuoO2GGm4u2IZXgaTJ9wTVb7H:js9U3EjamjuvfFoO2Gr4u2IZwaF9wxH
- TLSH
  T1F39233B79DAFA91A7B6ED1BDA4307B1DC52391F35A0C4AE7B0A20C477BC01D308155AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  overrides/config/crash_assistant/scripts/log_analysis/example.jexl
- Size 3KB
- SHA256 adde7e5e42b9d716f14a9bc49797999a21a0ee05cc67e71410a232f830115b3b
- MD5 cef0690ca119861569662f5587100dbb
- SHA1 e492d6b210af660f57e4ace58fb84c18230d1c9e
- SHA512 503ebb6b2a8ebf150d529087a9e6e7a70580f61adbdcb814c923aab066fd1c61d44bca928ada472dfc6499372724a9e0cf0d47f471a5450529af9273e67b3986
- TLSH
  T1FE71A51FE709632E4CA509E41B5D55D3C7A581271235CAF3F89E871C1F422BB01766F6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  overrides/config/crash_assistant/scripts/startup/example.jexl
- Size 4KB
- SHA256 346378f04a9e7319cdcb405fad82d6e7f1b36b39e0e4129c00a226b49f41cf37
- MD5 b783fb48246a944f0faf2f79c5d8db42
- SHA1 ef0a9386e87bc61457902ec5b2953a6ab4254d6e
- SHA512 6c6bcec06aa1b70a93dccd01feb3f9b1586133d243b666ae6b5f1179b4948e968e2d9d359daabb77649069ff54635ac90299fe4732352dede7213aac5a576154
- SSDEEP 96:4C5W56ynzlQi1zy2QUEzesE8QB1bB5BM6wcjsk66rimHhlhkjX+rw:3W5PzlQazy2Q/zzpQBDM6wZk6Yi+H2+0
- TLSH
  T1549143157E6A1E8B6CAB84D66CBC805346726213F71CEF2575EDE00EC39459E833A1E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  data/stellarity/function/init.mcfunction
- Size 13KB
- SHA256 04f85705e72d23a73e5d5ffa3a8428ba67c40469ef7b389a7f4375f482f88ede
- MD5 a41817407c771aa2e17a6990707628be
- SHA1 37d49847deeb684ce214668e6239d34d54774006
- SHA512 35da8d423b9840ef8175c1d9123f3cd678ed30c9198870a05400da247bf7353ff3212cf4d7e1ec50b81c5a7d6f71fd262e355c41f3a0fd4cdb6eca9a54634060
- SSDEEP 192:wJJ17PNgXfwWw8aeq7A6BWsUMsKl3EVUczsYd+e6Uxs7hWQ7DGyhtDxy:4PCXL8BGMG
- TLSH
  T1B1523204EA17F86B882E89BEF8F51197AA428FE0484335763578C6DBE405C53D62F1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  data/stellarity/function/mobs/dragon/butcher/kill.mcfunction
- Size 2KB
- SHA256 44f637d7f4533669c3c3bd0ef09ead67773f7e78fc6c4b26a92b6b0b9fad72f4
- MD5 0dd704da3a01ce239e5540f048f19786
- SHA1 f57dc722b1302aafdc759c332bb08a52fad0d020
- SHA512 6ecc978a246405302985eb28ebf2c7d02b9d4f268c1a27e399631d28f705fc28d747a30a4e27e97516d5e49b07481c0507ae18232b7bcc14811a497d03175568
- TLSH
  T11B41A242D9A0D3EC34DBF7C5EBE458C7A7B296043B136061B309A0D9398FD5C81A5BC1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  data/stellarity/function/mobs/dragon/crystal/update_bossbar.mcfunction
- Size 530B
- SHA256 04e2d4f6f5211157fddd5531ffb746186cfaefca435eb431e540623637a33ed7
- MD5 2703e56bdb149373785dd2283b933623
- SHA1 5b623f4ef0d6c07960a451d8194c33b64b05827e
- SHA512 adac9905eb39e2533a896c712d762565dc1cc3e164f578f61eae71c8c5dfb3cf4e83c0963a9f6d24fd8ce7a7dc17ef4378c4a00b0ddcf875678dd6ed7c911c71
- TLSH
  T1B1F02456AE0EA03C18AE1E8EF8A82442033B8810092D7AF4EAEC039BC09CD14D20CD04
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  data/stellarity/function/mobs/dragon/death/finish.mcfunction
- Size 2KB
- SHA256 29ef73e11cbfbe39a7c22fd309dfdd792a00fa873e7f840a75ac23a6e3e2709c
- MD5 ef59b8a47e20d70546c80ffed4dc3b38
- SHA1 1fc227a75091fd6d5adca72d101788d07458b011
- SHA512 9b09113cfe100cfa69d55bb63a36dc1734666e80eb3dec73838fec969351fdd0d69cc93794a18c195bf9e978d95577b83ead65f9ae6148a0a0e43a108a32b61e
- TLSH
  T14A5172D2E326E23C09AE7ADEFC0722575713E9709401C668F24755BAE21CC8C4315DBC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  data/stellarity/function/mobs/dragon/invulnerability/apply.mcfunction
- Size 347B
- SHA256 72c8efa3a6abe40b0fbf9a9aeeba68be51bf6c48987c0c0e2627cca52ad2a842
- MD5 ad21caebb52575e1f19eb8751666d7f9
- SHA1 7f71f33bb7efd9e6de590a9076c91b0904daaa2c
- SHA512 e69f30e2f1a319ff7219bf320d85bf7ccfdae545c51ff9ec555be1c97be62e41dead43041182656d1407da87560a8730c72d31674c54333c97490dda7e7c4ada
- TLSH
  T152E0C001DF91F16C82CFACFCDC710A092925E837492D0FF9310C09E3D6049E46254E19
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  data/stellarity/function/mobs/dragon/invulnerability/remove.mcfunction
- Size 316B
- SHA256 fef37b5e1a752a3aa103ef8632b91f800062653ece4596cb84bb7ffc312625c7
- MD5 61202bb7fc1975739ac8dd88c74fc411
- SHA1 705481eb8f197057a9f64b47814063a62f808179
- SHA512 edcf50dd9d3c4f429452e4907a9a164a51eb67358c991752597c634e675635a5af777d06452cb284b70c8ca20bd673342f3f343da12f3a8f0fe5c6b367583782
- TLSH
  T16CE02611DF96A66C02CFACAC8D351A06A629A837452C4BF4711D18F286088D9B188D19
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  data/stellarity/function/mobs/dragon/main.mcfunction
- Size 5KB
- SHA256 d9e18ab3601375c73ec4e4231dd7eec2405deee0d4a99f60053c30bd5106f98f
- MD5 536e748c3225d2588bc2103408d3974a
- SHA1 64065052128ef9821a277f369fe2916f2ae070be
- SHA512 715a05291f456686d212d19e268ee65eb8475264ab8b35afb41b05a0ec30f233e31fac495d99f4af7328306315ec806ea30c9e3e8749ca23cb8915b23ab66e99
- SSDEEP 96:OXVkBsvS55ZjbejvsRsOZyaniZ5i5QNNw2CCZg0/CujP8EAeylpeV:AkBSSvxbkvKlsNeAxo/eV
- TLSH
  T198C1FFD59715F23C151C1B9FF8CA1057A327CD248A12D234F68E8FABE14CD2D8A158F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  overrides/kubejs/client_scripts/main.js
- Size 116B
- SHA256 3df46f0add819bf2602642215b5c62f0581ffdaaf97e77c80a8c4d966e05adcf
- MD5 e73982f400a2f6ada9426d947536ed65
- SHA1 e6f23e21b25a366f2216fbf7da00ed7d34542f20
- SHA512 67e79beb2ec62c28b56fdd093921439e549a5b8877f14ee740e838b71ce52f9742713482c81964b25e3082daaee71e4dde42751f29de2600d1ad011343f946c0
- TLSH
  T194B012F75D11597B010882879C167D94405FE839B7DAF10069F0001C388075BA64D868
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  overrides/kubejs/server_scripts/main.js
- Size 116B
- SHA256 dae099ae3be7f033c0c190ee8c3b023b42f6b235d9d0591be5926e8435dbd67f
- MD5 ceb7279d74244398c8ca0ff396587b22
- SHA1 6249ded51466cfc7b94ae9796f8c2caec5dac539
- SHA512 048cfc74f3bb05e53c6dd7975ce927588982d7263e6e1d80e52e0ccb61914befcd23e0788b97565c00b1a1a6a1a9586ec1dc4a9e4192ade9bbfbc33154f26637
- TLSH
  T1E1B012F75D12597F0108418B5C263D94561FE83977D9E3006AB040183480B9BA54C868
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  overrides/kubejs/startup_scripts/main.js
- Size 117B
- SHA256 5c4659e7bb368960801ccfce24ac3493fa14aae88a7e17b2a9cdfe1931985ffe
- MD5 bbdeb7792f10d6bb99b7c5678646cde3
- SHA1 05ec115c372985dc9f77dd2513933aa8e90eba61
- SHA512 3c184cf9eda39897c85dcafd483ceb76c30a03a6033b958e5dff2582da5370a2eb18d9860d02a50f27b0ddb6d088a300beb80699fed2246145e95e6736e2986c
- TLSH
  T10CB012F75E51593A0A0841C79C2A3E94400FE83977DDE1006DB02018348075FE54C969
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26