64bf664a701dfb99b837f0a4eeb438b1a105d0f0b8a5d76575026edb9f0fa0ae

Sharing

Copy URL Twitter E-mail

General

Target
Sandbox.v2025.12.18.zip
Size 58.7MB
Sample260709-nxeeeahw2m
SHA256 64bf664a701dfb99b837f0a4eeb438b1a105d0f0b8a5d76575026edb9f0fa0ae
MD5 8cfea72d7535d866e5280a75b812c529
SHA1 41feaecd1b5113ec44f597d122404eb3c6f6ec51
SHA512 23d44226043a8fcde48c9f2fa2756f7d915f5d8302404e5c5639636e567dff996d7b2046b5eeaa75c7da0ab0ba9bb7250aaa40e651abcf922184c19894547420
SSDEEP 1572864:3mrBkhlkxPM+pltnjCqdfB1HwpTRevAsDDMXYxbWRiXYiRgf:5Tu0InWqdfH0eYsDQohr2
TLSH
T167D7330276CC466DCFCB5873DAEBFC0D5E8A412B525845A7B35CEC460A677A30AF4E24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Sandbox.v2025.12.18.zip
- Size 58.7MB
- SHA256 64bf664a701dfb99b837f0a4eeb438b1a105d0f0b8a5d76575026edb9f0fa0ae
- MD5 8cfea72d7535d866e5280a75b812c529
- SHA1 41feaecd1b5113ec44f597d122404eb3c6f6ec51
- SHA512 23d44226043a8fcde48c9f2fa2756f7d915f5d8302404e5c5639636e567dff996d7b2046b5eeaa75c7da0ab0ba9bb7250aaa40e651abcf922184c19894547420
- SSDEEP 1572864:3mrBkhlkxPM+pltnjCqdfB1HwpTRevAsDDMXYxbWRiXYiRgf:5Tu0InWqdfH0eYsDQohr2
- TLSH
  T167D7330276CC466DCFCB5873DAEBFC0D5E8A412B525845A7B35CEC460A677A30AF4E24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/steam_gen.png
- Size 6KB
- SHA256 d9cde28cfe6c9a5515c65e3379fc1bae6f1ab0b7db89cc0e46f2817488bf1e15
- MD5 d3eb11d864c489b06ec1afd503ee7e0f
- SHA1 3cc699315c53a2a432536db4a406a899dff47780
- SHA512 8a5fdc5ed951eae24b02ca7f92379f3f39d20e5eded6edc7d96f8595144ea4a7c7144025f1a5184c72a5ddfadd1f87a78a430986b36438a86f8ac5e2e0aa5779
- SSDEEP 96:wn081ZZHvIbf3VVsdtkCXLjGDz3Auzu8X8QYKpexQVp/rrvicoX0BQCz8EYhAePx:y0OcD3QbTuXAuzuQyxQpvldKCja1
- TLSH
  T1A2D18D14B9DE656B0483AC9CE4308D659FFA40747A1204F8BA1B82EA3A15E07E01AD5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/synth.png
- Size 1KB
- SHA256 713619aa946d4bd1805a7a3d21d8c3cee4cd34f8cc585a52ede830d885b16a9a
- MD5 1cca6556dcde4179cc64cda2b2fb2418
- SHA1 19165a041840721dd7c7c14b4e49bfe001fc9632
- SHA512 4f25cfcf7652011cd70ab53f5601e6744267dcb9bee69cef547a71003dbc30049fb44df446cdb9ff9cfa6b4bdc39db30331161ba91780fdc5b57b47d50b03ce5
- TLSH
  T1A73186CD304DBD4FCEA839EA876D43D6A6A5867D0DE6911886405C232E593260D7A89C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/tap.png
- Size 2KB
- SHA256 f04f11958039b5c9f50b5557c102d9fdda7a43e9b2a4bc149004edb23d026459
- MD5 eae63bb7ca748ad093ba53ad1a4bbfd6
- SHA1 e3e78e4a27f4d91166b1d41befd3fb329d979ef4
- SHA512 5eec5388167c92fdd4f88e0a871dc340357c6e5bd3cb13579541252350cc403f9bce641a524de40eb4a4ae427404a5060988db6fc8b50b4f292a6d8462ec765b
- TLSH
  T1D8511C99D4F31620C0414974437E8AF34C6D230F04D9A4A894A1A812EFAE7F4368B896
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/taptoggle.png
- Size 2KB
- SHA256 018ac9bf8336703deaad12a9a8e35937c08a646cda3728e075bf381726196706
- MD5 c88d06d148512932dc2bc567834669ed
- SHA1 6ecf3d842a55766aa187f20e4951b901b8710101
- SHA512 906748c54a6508abb181b34d66659b617e5b3bf9d5e9b4b73a19058b4f3b5741cc68bfcdabdfa3de3e00e723ac968d16a8e7418a4f38fcf2aa673d935338fcd1
- TLSH
  T1C2514D2C42FFD682F4E8D98698C1B46CB4D22DF971104940ED59D2F32EDF41C558C326
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/temp_sensor.png
- Size 3KB
- SHA256 6761bb811cdbfa397fe27821c7beae17479cdd6cfb627bfdcc32c6624a0f7feb
- MD5 fda24621f6dbc13be75921b357bedb72
- SHA1 b74c5f07be0bd9264e69888767e6b20453cea965
- SHA512 de02cebd57532322b1c38425af6af5553a448898e3b23fd1973e7a2295c00bbe1290cfdf727340bf6f6179c6dd192f17b7dcf96c984845944f0b9acd371ac820
- TLSH
  T1DC614CEF17C5F67F9715B391135E441AD5E0DA814B2AC387202CD410AECA9767C1ED1E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/termites.png
- Size 3KB
- SHA256 4f6689fb237609e1df41a8b585b2ef34a0811c98068519734a7f53d49f1a72a9
- MD5 bf472ba12122dc5ecf42f95f4fdb9b2e
- SHA1 4f5842cf0013a962f9461d1250b1771b041de51d
- SHA512 7073790e8c090516fd8137de08784fb66ce04e5e780e7d99c57c91ccd12866ff14ac8cd412389228f2c9af8956a5ea5a9a58a5392157be5f457c31c8fa31b9df
- TLSH
  T195513C21A905A22C1DEEAF77CAD61114B9E427F61C6616ABE15D1F39200F0A6F1B8243
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/tesla.png
- Size 4KB
- SHA256 e450ae4b09640cdc8ac14ac1a5901e649081ea6677af7a7d820b8b1ea81facad
- MD5 a750617565c23588c5930ff5a6aca140
- SHA1 055c51d43e26720703615da2fb533097faf00b2f
- SHA512 a3e06284ee62ad5e7f08a1544971c36cd1af4ddf0e718fa210b4e85ca9f2f00c70c5304c7b50ad6ed7f7467f9a5a3be3c10c061751c35fb52e4b3d35cede4e26
- SSDEEP 96:D2ffvf/q8ttPFXmc7OjkzlUmFHw+hJxEyGhwXQSUERxR+Lk6pUZJ:+fnztPFXmbgyqHDPohwZUERz+Lk6pUZJ
- TLSH
  T1D4915C9113BA4536F00695A585D903EC6E9E9D320416812727FC2C6DFD47E784AA21F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/thermite.png
- Size 2KB
- SHA256 392b403e3f6173e7dc04fc9d196213c6da6b46fe86b32ae7748878afe3c3ad3b
- MD5 3f292de2c6883cbb1941b6c516a7ba51
- SHA1 70d9a1d1e76eb81fc4d4e933c62f00c53339405e
- SHA512 95af2fad13f0c32ea409971e4c61cd59181c3596a416894fad136e55dab144c40f67835b261cf90ecf564e46e5a2a585d132910b7000e09bf641949f95a1806a
- TLSH
  T12B5129C719836C0C7E6262269A5D6CD0FDF044902F72C335968C38BB87BD18A996715A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/toggle.png
- Size 1KB
- SHA256 d5bf4a11b995eebd6d52e2c1276fbbd421797330db3752f363c89298d6cb8cda
- MD5 e5740295125787037fa9baa24f1481e4
- SHA1 3d45077c1d0576bb22d9ddfe6383354c8db8358f
- SHA512 237cf606a4039fc8ccc7ba124b9e77ae09c942c1be2ae444f21f08e1e696ccc35e48f94afb393a4c9d1a050328897a36703830a97a3dbf37423d5eade650e683
- TLSH
  T1AD3195F016D1982168E54F019C7908E4B666715A8C771FA1EB350F2923F63B378465CB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/uranium.png
- Size 5KB
- SHA256 56ecfd233c0445f0d6e200ffdcb455fbb1fb70067a39be033c34a19ef735457c
- MD5 df0129a4a0c4a524ba999434dbde43ee
- SHA1 7ed667121cda704db7be3ab958b4dc379cb2ab9f
- SHA512 692c99875400cde1ca8d765b81e998fa7ad948e99c472b3572d6bbb35797ebaaf749180c9eea95cbaa1fed31dd1a62e62679934030ba1067bc7f2e3e86b2b715
- SSDEEP 96:3NSKpr5ow0/+9XsIFqXMHD5jTlVTkyA4iCHzvXh8kJrLQf7jfJtK9WhApgSfv8lg:3ki0G9XTFpHNPDlAFCrXbkfJk9gZSX0g
- TLSH
  T12EC17DF47E54A53C018A3EA288CF6F71D046DCD848457F6C01C69485E3F36F8A5A214B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/view.png
- Size 2KB
- SHA256 257d31cba666c8082693963aa7052bfb019f1a94853a98fd47592abff1cb4c4f
- MD5 2af1d5283e72f8c9fdd77f9f67289ea8
- SHA1 b2b520b3c33204d70ee8154c2214f1140abd7bb6
- SHA512 ef7eda4eaadeb76aa5a322359846df21f8fd2681d18f2ab2afc7c181d30fdeab0cd702e2888cc70c4a3c4b6cfeecd4a08541e9dbb1319e82cd81041b56096f4b
- TLSH
  T1755107331162ED9DD22E4C81D0551838AA9F92713CA7E885CB20A8EF7A0E3300FBDF45
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/view_heat.png
- Size 2KB
- SHA256 224f031d80bd831f91f2345594859b04a8f50343ec96f547898fe7a87f7160f1
- MD5 b0ab898542e26c35e9d499b1e1d88030
- SHA1 da68ce7841fe586c5cd6e55ecbb30a75a82effa8
- SHA512 10090bc0acecf5bf6d719c0c12989d6bab6db986fa9cdad303f44cb05cc932323f6ba21d722fed9136b353c404891fc3b41eb40bc980d7383b16edc175f8795f
- TLSH
  T1FA41187280F47AB9158C4049CCFAE078F8AF1C7D7DE7C94E83427AC76980031242B218
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/virus.png
- Size 5KB
- SHA256 b86744d8acbea2496e9deabeacda975a821db8b0d95f6479db95e4d31fbcce1d
- MD5 711d348d03ed69968a2086eb9efc37c2
- SHA1 c381eea9e9eadc24e7cebd4c2d16a21f0bc10247
- SHA512 42d7ebf1408579711a4d5b0029311dfc250edd41c981a012731d931afe19da5cd7e05e7ea2f00f24ef0387a53c1955b1f0bddff233fada3a2323cc009df6e618
- SSDEEP 96:slgtbSQ+uOhcqAAgGam1H0OCUYT6q7pkhXdG2UvSeDQVdBfKWGkfS:s65z+xhc65aO1CUBxhXdRUv3DQVdSkfS
- TLSH
  T133C1BFA33B35BA5994D2813D1F29C8383C11CBD178735113565E9C27548EF158CF5AA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/wall.png
- Size 2KB
- SHA256 6fee31b7020f1fb677a989732c21f1822593ab5e7a48c7813ec1838fd671c76f
- MD5 f9099d43659e77e6b2067f67265e2b6d
- SHA1 c91377fcc2a77620ab0caaab32c65e2f3b7fe541
- SHA512 7cce98e1e8045a90e482e81c0b16166e1f5d69adf2fd2e16214152676daa555b240db626b31f1e8c6c39b1d9f2f24050552922e09a5fd225a16fd4c7e23bebb3
- TLSH
  T16E514ED5056432F67C7AB9C4861CD2F027FA9528DE08CBCA64DCC0D7CB89B964008F1A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Sandbox.v2025.12.18/Sandbox.v2025.12.18/help/images/water.png
- Size 2KB
- SHA256 c4f8620234bb619e3a3f2a925563de405305a69244a6b6101e23851271169959
- MD5 4f3cf920c51bb69227b79cfa3193875a
- SHA1 4e7f9000c1fcd70bda5a31c2b01281eb0888fb4e
- SHA512 d9ef75c117a08cd291860ca96f788a34827b6b2409b8ea9dd7d2f5cbd1d8a409b98fb0c6d5fcfe48114fefc4a3a5d4bcbbf59fe31d5e75ce72f7102970c2e328
- TLSH
  T10341099D4ED34C6B62431CD3E98995CA851F7329B8B0435B4100AA476AA345FCF43516
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32