eed5b309f49fb6d81e8584859b6d641e5ca98140e29c3fb09343b2b199a609af

Resubmissions

10/07/2026, 19:54

260710-ym23tsgs5r8

10/07/2026, 19:29

260710-x7j73sas717

Sharing

Copy URL Twitter E-mail

General

Target
Garrys_Mod_2006_Free_Download_-_GameDriv_Archive_x86_503304.zip
Size 754.2MB
Sample260710-ym23tsgs5r
SHA256 eed5b309f49fb6d81e8584859b6d641e5ca98140e29c3fb09343b2b199a609af
MD5 223e91f949fa7f26d576e8b3741f1db8
SHA1 4061b7fe63e6292ab8c1cf456522e5af44ea3b87
SHA512 3baa7d03f1ad2c655c29548fe33317d57570991e3bb19b357172e84ac99bfc516a299b26927f3224f6ab41b65938ca2efa0623fe0c1566479ea235982af39f52
SSDEEP 786432:Y8p/o/PYz5SQH0TZVih5X0vmNF6rzAFDL3:Y8WgND0TriPk+NiMFDD
TLSH
T125893305CD3CE7D2FB9736B8B8E0915BD52F51B532DDD298796831F4AD8AB002F28819
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  data/python-packages/sys_config/__init__.py
- Size 1KB
- SHA256 de29b942221ece11d4ad63c8da00848a54175ed6825f68788f321315f5fe3796
- MD5 3cbdc8ce57e151a4e01bfd057461af73
- SHA1 ce551048e022944796c25d167e2697becfd74a73
- SHA512 b6346161a167997f618e763fb1612618ff92664f15643381477efe85af0ce77913b0caed9183cf1cfec1c3f9caf81b8f00d8179cf30eaa686fc460d0376d1826
- TLSH
  T1E71190D3834C1DDDF3575A4B499B1B5AC1A56C5AAAACCDCC2AFCD2C99200276E083430
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  data/python-packages/sys_config/access_internet.py
- Size 1KB
- SHA256 3a9c35116c04baf41003225584b975fa48b154432b59145e3a5b413b9e86f9fa
- MD5 798c683d37d3a2944436575acd6fc6d2
- SHA1 70458408bf779bf8a907288a37007d286c55dd8a
- SHA512 1a80eb943ff437663937a24327c956fbd535ea524e7738db8f4f0b7dcf71f92160e3c8da4728b5cc6e05da3bf7c3275c3aa86c1b4c069f17f023f766aed76368
- TLSH
  T1CA21E6D7D74EA846F322834B0C8BB30690496CD22A6CC95CB6FDC80D6751EF266D74B1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  data/python-packages/sys_config/sys_check.py
- Size 6KB
- SHA256 5f881b961a1d1903f71f586f1555a1ca8eb431884d97f56f70f12c09aa325bac
- MD5 8827833f389bb92a6a204db0a62d8a58
- SHA1 f8c5911fd9fbb60ff0ad523551a4e3f35e3589ef
- SHA512 8079675f4b464a0bea11536d883943b3086c181e54f15d1dad26dd85287fb29c8030b90517aa536bb6cabe7c886bdb5b4348e6f3ea2270140b5dba3972bcc979
- SSDEEP 96:OD0vKMLbIU/jNi5yT4rOTwLykVljLHpIDYNFfr2FaFfayK2rqFmTb7Sav0Vd2iKQ:OD0xIU7CXIPDMHR+asVd2iKLJqwO3
- TLSH
  T141D1FDA25E1BB810D34B85290DC3E74663682E83128CD96C7DECD4197F50AB29BF3DB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  data/python-packages/sys_config/sys_file.py
- Size 17KB
- SHA256 c8c674961d9cffa90760647ddaf780f3f0d20aeda95fd9835cf869d2f77b327b
- MD5 859aad5b8250de63f0f4a1b1c10dd25b
- SHA1 e3d2639cfacc21b6358934b5c1c4d714fddb639f
- SHA512 f122b4bbae466431afb8833600e399826d5ed8cf0d75fd14b2b76d40a7831afeac70822c44692b6b9ab87ca243eb64526640a1fadf363f0f3b5a08361222cd9f
- SSDEEP 192:n5KBZVE1xnAHrsuW19qZCCiG56vYW5WsoozHvy4IlMQxfG:aOkr8qJMQxfG
- TLSH
  T1277297D38B4CA9A5F322430F189BB78140A57C97162CC96C76FCC84EAB81EFB11D64B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  data/python-packages/sys_config/sys_spec.py
- Size 22KB
- SHA256 3a04a1926491c153f2324b831007ee45a8c4df8386cfaded1779f3724173af05
- MD5 31b11329bc312cf75d8f13beab7d8748
- SHA1 c0559116da53d94003fc23c1160b3dc8c949c67f
- SHA512 6f2f1942382039cd1be12e2d01d78fda55ca9e27d5bc0545748f64682f712fbd8d7eda9564e380722c6de0db4b6bbdd4456918e20e5d1bad8494c6784e1fc6b5
- SSDEEP 96:r2hgwb+HSHO/EOFoWG0iLMOKX7ZIQ2uIXZZgFBNhL3xLzAAQ4FUnJjYQLFNtDIt8:+9dFiDB+IlWuR92FgZFKtgbQ/olOQhLY
- TLSH
  T15BA267C3834D9AA5F326431B189BB34A90856CD7521CD9AC7AFDC80E6B81DF765E30B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  lib/py3-windows-x86_64/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  lib/py3-windows-x86_64/libEGL.dll
- Size 436KB
- SHA256 b20c1e14e42da55c13dad3c23a5060ca086eaf5b18b12ef5c60cd7e80276a9f2
- MD5 1090bf4c5495697a1416cd77481cf7d0
- SHA1 94452eed4fa88dcb0a5b3c503a12f3a3b5f23ee8
- SHA512 d205dd98260d033300afe3f2a1c0c06f3bfbf158067fc3290e10ddf6f51eb80b57af56fb0e75a56b82dc3ec49190c5d2c296aa548b64e39b4b004f60a7da89a6
- SSDEEP 6144:CrHQz/GL44uCWgSqTpyGRxyB5EdpmMB6cm+p4HRw0FlA1Qu4P:uudhGDyB5Xa4HRw0FlCQ
- TLSH
  T182947C29B2A448A9D036C038CA174A72DB31B89A0F75F7DF12E5D2692F773D45B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  lib/py3-windows-x86_64/libGLESv2.dll
- Size 6.3MB
- SHA256 2d171e91e1fe7205b76dd69ba9f7ddce7910283a5a5111c09c84f5db8c795a74
- MD5 7dde909bd5c7538ac46064741a8da6c0
- SHA1 46b50003be83eab7e0c48ebbd9260b5b021e70eb
- SHA512 a057586a0b566c5470a6508e27764f9662ceaf3b08244c3db3d1e07789e87a30a43f1daad0274a4e3d00b641d3f9f90e9c073a5f7db3fa6d1de7f45c33adc092
- SSDEEP 98304:1DACC5v8sHfvlfkvghk3xlkihzsfFUQOJt6c:CvxkvgfyoiQOR
- TLSH
  T1BD665917F2A281E9C009C135574B9632EB31BC851734BADF2294F6692FB27E06B3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  lib/py3-windows-x86_64/libpython3.9.dll
- Size 8.3MB
- SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
- MD5 32d079f77a2383e262b4a512931fb120
- SHA1 19902535da3cb79c093f59fd597444a96f143761
- SHA512 b1bca949aa2f7b735a9e8e5d4fed3e698f3ce77edb804ec56d0f66d3faffb9d1f82a55bfdfa5393ea5d64cd8379ce9a59a298fa486d21e4ea5f29340d4cde65b
- SSDEEP 98304:Dt85Qi40yDueXVj4ka+Pjd2wSY6XO7dPlMBLa2THxM/UZpMBAOd3+opm9g0vHF6:B8r4pr4OjZR/XBA63+opm9g0vHF
- TLSH
  T160967C23B19150EDD93AC13192975233BBB5BC501B21BBDB2154B7702F72B911FAEB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  lib/py3-windows-x86_64/librenpython.dll
- Size 18.2MB
- SHA256 29d7304930809804502f331e47d06b72f07b3a1569eb29e0a12dbc71932915d6
- MD5 773d30682db91d99eed3b6f6a3591fe6
- SHA1 1be09711350cc40dc258d893ca3c0500c71f92cf
- SHA512 b0893ee4d82b5efe59d8a8ff9690579b106da608d04d161093ce4757e0eea62b5e16d84bbf3a422012801cec3c45a570907bab6d33ae5516facb9e57e3940322
- SSDEEP 196608:Vg6lprLkZark54oIFe/IFtRRcYoB/xEOAoP3i:W6lprLkZarkCoaeQzcYoBxEki
- TLSH
  T146176C4BF05268A8C586D174CE2BEB22BB65784C457279DF329457B03F71BC0AB29F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  lib/py3-windows-x86_64/libwinpthread-1.dll
- Size 344KB
- SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
- MD5 da67da022bbc1bb9409e3328c1cb64e1
- SHA1 e1fd29f4256d7066f05d113cb8e96e1aebaa38e7
- SHA512 24ba4936ff149f0875b3e4c7e36e80f941130faccd4d6296d68c8af8b0e647c37d0822d477218ab0b3d4b51f24cd1dfa1ace54adfbd175d122036c3a7e787ebf
- SSDEEP 6144:Wo14rtZLc1fPm3YjZxgMOKSjkPDNjYBlplydMofn6cHqq85l:Wo14r/cBPm3Yg8SjoYvplydMofRHqq85
- TLSH
  T1E4744B8BE754DA7ACA1146318CBB0B097337D04067979F5BAB2CD2783D8BBC4DD99608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  lib/py3-windows-x86_64/nvdrs.dll
- Size 14KB
- SHA256 068b0c02c881a5d8587a24929e30d8c596305543ae6da5f264f8230a2e45d300
- MD5 c48d5218e5f97b2064c4002d4b30c435
- SHA1 4ac56e31bfb9c5036d60afd6de46a3f1e41f2ec8
- SHA512 3e54fe5174f121528d175ac691c5d36cee63031823c9e09d603d8955312046f57f452e33ffa4863698597849102f52711c3d8738933c07cba12d1f49e611c44c
- SSDEEP 192:rKFj3Az2SjQ0bnUdPIPKPpCxeELcNiTw/dUfYa2GzEfw9vmQ:rKejQ07KPUKueELcNiM/dyDzCw9vF
- TLSH
  T1D762E7069B5524BEDE4AC17FC2771762FAA0B960076219C70371F2650E71FD42B3D8AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 652f72976536214578a6ef848d7359495e02db58846d15ea3a85e90ef1040dc9
- MD5 d11142598cad7ca67caf7606470bbd00
- SHA1 f6d35808803e2c7eaaa85d2f1f756b06495771aa
- SHA512 87b8533b53f87bd8ce0133cd949b0b5393dc3ce02235b374f73be41cea0fa0697da15bee65ec9cf0b8109b549b85659cee38ffb39df763898f584671ff9e2e1a
- SSDEEP 3072:jOC3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:qcQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T115A3F10AAF5616BED921403FEAA70562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 092c282f21cdedf3d533dfbc3c77401856de863833904fc09a1d3668e8d50181
- MD5 8cd16e17df02782c111ef7475bece461
- SHA1 e368b52a96d656c6635df6717bdfad13572ee746
- SHA512 8029576e56a28b9f1975cb28b093c4896bdeee8b7ffe4596bdd9fa4ab7bc277906c7dd6aa7c33375a1fbbc5182ef009e70d7feee1689d4c7ed6510254cbda4f0
- SSDEEP 3072:yOc3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:TqQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T149A3F10AAF5615BED921403FEAA71562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  lib/python3.9/__future__.pyc
- Size 4KB
- SHA256 791de268946ce6bca07aea7fb44c9ad0172b374bea4b290c38fa6e9c1efd5e44
- MD5 2d68b1f1a4da598a147bc9e375534570
- SHA1 fbf957813a63fd6d7bcc347eb5d4f221ae1e3d62
- SHA512 1c841e412d336bbb1d11d1ce903f1d076af1f9375e74733106ab69e081534948fd1d5ce30949ef139b5e95369fec6badfbfb9f8ca8ba3ef9b54f9a8a3b683709
- SSDEEP 96:Gg1NzUuGd+P2sKNwWwD2j82xnCg8Q/Ks/qN+Bj0ui:L4BRdwD1YCM/KsSN+Bj0ui
- TLSH
  T1BA81860A694549AFFE47F2F2A2C911C14F59C2BD2F94603A365C52443BC3892937B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  lib/python3.9/_bootlocale.pyc
- Size 1KB
- SHA256 9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9
- MD5 b310c1aa498564e607b7323a4c1e5675
- SHA1 9d52941323913140830ccdfdffbcf6916b18d193
- SHA512 1b75a52813a372e7d5fce372b9319c3c8e832754bd18ad6003a8a0f1f106668f01f69c82abd9c0f282439342d406e8a269793ee4139408c5cc9fede8b2486d50
- TLSH
  T12A21024A0B015E4BFD21FBF476C5822446B985790E1FB9591715C27A3D0E25C6E514CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Indirect Command Execution

T1202

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Indirect Command Execution

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32