4329aa1037f8936b08a162f08ffd75d6593f346cffc894a0821e63e3e2ec49af

Sharing

Copy URL Twitter E-mail

General

Target
ArmDot 2026 Latest Version.rar
Size 4.7MB
Sample260711-devcssay2j
SHA256 4329aa1037f8936b08a162f08ffd75d6593f346cffc894a0821e63e3e2ec49af
MD5 f35b58da685069f2d19662c97416159e
SHA1 32df5bbfdd47a77b5669cc8ba8a14876c8ed3c78
SHA512 c2bce26c5e16ddf8302ff9e64224fdf1db84ba94411239e171503a5667f0d9e770710015b5badc1f0bc8b2d1683e6b5d386ccbc60890d94020733d3351c1e1f3
SSDEEP 98304:qSVoxiUzTw6FanssYmXVCYFfFcPA3eqyrRvEzrAvIUB/3GtFx7UY6Aja0:MtI6M/XQsdoA3efNirAAUt3g7UvAW0
TLSH
T17036336683A7982FD80E61CBF65492A63D58F56AD204043D5F471FCFB03F2729B23698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ArmDot 2026 Latest Version.rar
- Size 4.7MB
- SHA256 4329aa1037f8936b08a162f08ffd75d6593f346cffc894a0821e63e3e2ec49af
- MD5 f35b58da685069f2d19662c97416159e
- SHA1 32df5bbfdd47a77b5669cc8ba8a14876c8ed3c78
- SHA512 c2bce26c5e16ddf8302ff9e64224fdf1db84ba94411239e171503a5667f0d9e770710015b5badc1f0bc8b2d1683e6b5d386ccbc60890d94020733d3351c1e1f3
- SSDEEP 98304:qSVoxiUzTw6FanssYmXVCYFfFcPA3eqyrRvEzrAvIUB/3GtFx7UY6Aja0:MtI6M/XQsdoA3efNirAAUt3g7UvAW0
- TLSH
  T17036336683A7982FD80E61CBF65492A63D58F56AD204043D5F471FCFB03F2729B23698
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Api.Keys.dll
- Size 25KB
- SHA256 2c88b6f429f4082561c2917c07e0d9b999665bd55b0be28f7d9461cbcf551061
- MD5 3a6814ace199dbd4d901c7c589818bd0
- SHA1 b426796ede4d6298daca25f4e08fec0860169e83
- SHA512 440fddf4fd267027fe63c60a8fd457940657c2ee6ddfd78865d859bb43039022cb1dc1363237f8929497990a36fc81567f8dd0477e2d77c20bfde4e9732d8327
- SSDEEP 768:P+O917SPRr1pPtZHpWYs6rU2AdKKzCKZiko:Pvj7Y11QYhrUtkvV
- TLSH
  T146C28E0F4FAC5257DF5E0938A4F181022278F2C754E65F9BDE00A23E3E593913B99789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Client.dll
- Size 19KB
- SHA256 198e182d2fddc645212a82b5adc8b52d5713a646382c7872164a09676e63f932
- MD5 5c8309e9eff87de5e833637bdb60e7ff
- SHA1 cc6f87f4095bd5fbaaa5f35ad3d34355786453d6
- SHA512 811f279aeaba85734e653054ccb63fb4aa579483f5f6a99349365c688757e50334ece3891bb452718dd0f8aaa7b21950e14cd203ea1c08f799a5fd670f8e46d6
- SSDEEP 384:XopoloZoQoblaL/joYe/lDK6ki25i8T5Jvg6KzCKjd3gSGBkSE0:Xcw8FOle7oYe/Fl2AJ6KzCKZik6
- TLSH
  T18E926C235B2C933BCF295F79B8E9A2161B78E7C061F6D16BE405E61C3C093606FA851D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Console.Core.dll
- Size 471KB
- SHA256 6cb9200f97ab19f06061c766d9f1c6aa6d032818438c69a66994e63a149789dc
- MD5 b19aeb986f32dc19c807f3c948eba94f
- SHA1 bbaa0296acdc0f27481916283675496ad62ae569
- SHA512 051b9374722b4b51fd60cf8be939a865f6eb1118c5f85e3427719c215196ae32c694dd13a405c30f5f0e6e9d1fd4a8d27ce718b9723cba84e8d7827d48b08dd2
- SSDEEP 12288:B79T3oGhaKcnLJ2XCc+D+G/TBjKVimiQc7l:B79TJaKcnLJ2XCc+D+G/TBOVinQs
- TLSH
  T1B8A488413FABE300E4CCFA7F55E7C8E493E144E38F719146AB6876B52D6381A6782B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Engine.dll
- Size 4.8MB
- SHA256 b24a4b6cafdfac437d82d810ed2124346783ef535a16a50a6df332a7da130840
- MD5 8543b52738c12a239edd91d0085ef5f3
- SHA1 e826dfdf5715175b8b519839a4f6c45d12fbd59b
- SHA512 fd5048b9af7c93d398c9ff83eb54ce4fb8167bf93986df21ed9b51966b00aa3b435c14d22cfec3cc38073880ee7d7358d3bd7b4b2b4c6d58cecdb79b8558b70f
- SSDEEP 49152:lF6mGJ86VHqr0g4ISVU1q/Vbver77A6u9maZhDJkAJxruTvIZMufH:r6vJ86VHqrT4ISVU1q/Vbver77A6uk
- TLSH
  T15D36D600FAD1E716D1FA27B09BF780940BE069A58631F34F2B9A71BDAC735467C46227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Shared.dll
- Size 25KB
- SHA256 38c353562f59024924e59c96cf3017d9f11adf51f65572d58bc2e2990c1d2c16
- MD5 780162e3a892998d01ded888e3196acb
- SHA1 42264edb7c8a121aabd819e9f663edff18ed538b
- SHA512 005109d1f47c6ef48e29b027ec28cc648b96b8003846f781f4f538575c10d205acf3059c390cb36f6306ecae6434feaac483383cfe74946a2e2cf9800b87c326
- SSDEEP 384:HopoloZoQobdsujBpvJ4AwwS5Nwe1Vvzsg6ki25i8TqPfdT2KzCKjd3gSGBkSLJ2:Hcw8FOZjBpvcNtsT2APfd2KzCKZiks2f
- TLSH
  T17EC20902A618C626DD743A7B41F705219BF0ABD36EF2924ED207B13BFC117AA5A4D1CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.chm
- Size 2.3MB
- SHA256 340448d568c223e72a816fa18acecd44d7a63800279c8c0478a231e276f2794d
- MD5 7435765973b3bdb0f0200aadd843536c
- SHA1 415d683c7a17a59c765cab23558cd3e7815e05a3
- SHA512 213bf8dcc66ba9b182df995fbb2ad81e19ab861f5b19abe9608a70ea6a18da4099ad4c85eeb78e97166d0dddb4c829bc594aa1c79bb9a35cb7ae761905c55409
- SSDEEP 49152:ecLuB737hvcOJzPtSll2CZ+tYKCbEho9Gv01JN7Ym7G/h8wZE1nvX:xyJ7iGbtSloCZE5CbEaa01JN7Ym7GaOK
- TLSH
  T1A4B53381F615221BC94ABBF09DCFD5554CF8B86708C5A3BF30AFB4275962260A81E5F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.exe
- Size 1.3MB
- SHA256 fd6ce83e2772aa231bafc2bf0325d8665801ac5a2a7db53bceb48733e732d564
- MD5 82228be8fba9810b62af607df3dcd1a8
- SHA1 aab3de22881679a9e964044eff8d03a7851072cf
- SHA512 5b4140b3baf25c480de4cc53a9733d10176919e8ef43a45328da13d2aaa390c5f2cf9f5410ad502b890fcfe35ee367cd7ea15f3f29b4635cc0a60cb782d92bca
- SSDEEP 24576:yPRQSbTb0rdxB2UQeJ9FjevfZKruQdtT:1SPb0rdxB8eJ9FKvfErtdtT
- TLSH
  T13C55E7006BB9E701C0DDF77797DB859453A040E5BBB2E34FAE19B6E57C22C1A794A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/ArmDotConsole.exe
- Size 43KB
- SHA256 618df22a88e1d4ab6e84140d1a2308e090727cbb7b2ad870b8f71d360fcdd449
- MD5 e7da2a0f3dc3f7e649240bfd3618003d
- SHA1 f7fa39265e0885eb97a5d38b7b1aafaa1bddd81a
- SHA512 8ead67f0fef9504726a9e13bcd6935acba2be966981e789cb1e1f39d806899a3c94327ba4c8118cef7a96ba2d6d3f831079a15ff36d28fec8075ae73b037d9cc
- SSDEEP 768:5cw8FOGcx77MHx6P+V4Tfs+NZP7H1Cl2yMeg12AZjMRKzCKZikIO:VN36YP+CTrNZTH1S2rJ1tZyvlO
- TLSH
  T122139D0B3BADC20ADB064E74A8D2D5A55B3CFAD68EE8470EF011A30D7D057546F9B24D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/BoxedAppSDK.Managed.dll
- Size 2.8MB
- SHA256 1ec10c0adf7a9c62eea543ebf4e8a519e40240b26ba5f22047bddd4dac69b95b
- MD5 c70394733a49cc4b39cdb59e7f80707f
- SHA1 f30bf74ee68d8e3f82fcf0cda56008d03c4a06f8
- SHA512 ac3c5545a202a817c7fb6bb6aa704a2fca86e8a50a14cf4b0aa390d514ddb925397a64434e727490b9e1dd8e240feb617ee80a343a3cf50af14f54c5df180f8a
- SSDEEP 49152:0K2EMOLMdukQ5vmGFIKYpF+eVirw0ZMolnIPCKESdukCnk+rkbLD/lWmSU2OTwll:0K2EMOLMduhIKYpF+eVirw0ZMolnIPCD
- TLSH
  T148D57A83F2E500F9D2ABD179597A6713E7F07944433097CBA2E05E426B63BE1AA3D341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/HomePage.url
- Size 48B
- SHA256 c253c8ce0fff27bd8419bf228e3e0a8fb53d64088672e306eac70202eead0f50
- MD5 2de095733dd864568c32960aadd6cfcf
- SHA1 0e102cef56d6fff42adc3071273332e3e983cbc4
- SHA512 99280d18fce922897d757598934182950352aee8425dc908dc1c5aa5ef2f291ab56ccdc9da44992ccc817415a1389fb40afc5bfac6c2ce6fdc66e98b01b1043c
- MD5 SHA1 SHA512
Score

1^/10
behavioral11
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Mono.Cecil.Pdb.dll
- Size 101KB
- SHA256 cfb50637053d5c0be7b8cd3bc24e2c503bd3bae8b4a3d47156a62d6f5b837f01
- MD5 3f7e121b78896fc7a2eb220de777678b
- SHA1 04d5230a775992739d748757c45e154b5b430f19
- SHA512 8e880a33156c623d0c96dce65b8c6daa6b7097ffbfbd5aa8be9b571a5b4638339b1a2a54ea1386676341f187abc0d2c53a259d04d4dad04bbb747dcf1025ce17
- SSDEEP 1536:ZJWkg7TTPTa0FO9Qy3vsA4PjxtAoYKHs8QpS6HToSyEsQ+AtyO4v9:/Wj7TTPdY4jAiXQpnToasJAcv9
- TLSH
  T1A7A36C375BECB913D06C45BE98B1490A07F1E2968143E76E9AC8AEF43C9B76106313D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Mono.Cecil.Rocks.dll
- Size 40KB
- SHA256 e8ee6f9cdf3845c3631a51662bdd21c0a6f610a933c2caae0e05102507bc3f00
- MD5 14f775651726877820c841091b3bd260
- SHA1 1ce18c2045648f64c044b9f1b5027d944387d79b
- SHA512 92df2a95146c922c0f843d522f50e23ead507689ae56998d27cd0f9054122c232196002f3dcea3e01fb4e1e4b9ec49460333a04245c58673bc38077f38c361f1
- SSDEEP 768:O/aOO50hPriGlodyw8TR8XveRm1pczrog2A2uDpKzCKZikm5:O/aOxiRdyjl8XveRVfogttvz5
- TLSH
  T15D036D061764EF23C5BD4F3DA4E4210807B6D7C395A3E70A5FC8A5A87D1B3826B506FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Mono.Cecil.dll
- Size 394KB
- SHA256 57333653926e109cfa620e096cedf327a9edfffe4bae56cbfed0493c256176c4
- MD5 cb5fc2792143a7f1fa364c0202ecc519
- SHA1 9858e1307f773861137f685955c1627f3ec01438
- SHA512 ae11e6f921845c7c518c0c599320e3eeafda89db31b43caeb239b638584493c82ee83539012f1eb9fd1b3c2222b2a980334d2c1eaf8a971886fdeb6f8c9a7928
- SSDEEP 6144:cd7mDw8F033Fr5EpBO2F2JBHM+JFF+3o2ChJxookry99TJ/I:cYDLk3Fr5EpsM+JFFCE3x6y99m
- TLSH
  T122846D386AE41A3EEC5E6F7ED0A70015E3F8E4126347E71E46D0A2F62C777A5C9005A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Newtonsoft.Json.dll
- Size 562KB
- SHA256 6a168461c721fd14163751f7839fb8d67483cb5831f1b2b1ab3e96a68b82d384
- MD5 486015a44a273c6c554a27b3d498365c
- SHA1 cb08f5d7240dfcdcd77de754259b36c0d9a2a034
- SHA512 1578ed43e815017c269d2a37bb9cdc16d51209bfa6bdb7276ad67cbb39955708826973ac7f48c795e6a1361e7d2a14b14b6cea02ee9ecf396a4b02313aada1d6
- SSDEEP 6144:IJj8fixN6WWWgIkPgXCv8YiMvrrN91nU1cysJZx28rs80nnlrautBu+cfImj4yu3:IJjHxN65WCPPvWqFOV6ZxFrvKbByjdu3
- TLSH
  T10CC4292023F89B2AD5FE7735F5304924ABF5F89BA27AD74F590095AA1CA2B404D503F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Purchase.url
- Size 59B
- SHA256 b7ff845bae3f36b3b82a521048ccc579841efc4504feaf1643ea1d17d8f721c7
- MD5 80b6e8f5683c2f7dbf58dd4bfc6a7bfa
- SHA1 9a038152e55a53e9e8b5d8bf275cfd309e0263ea
- SHA512 cc6b2be82336d1ce5f94730e33b8ce1afc612a96a8cee19a800d616cb0e2cef1120761bcee1e7602861aac2f8789834072db0a211e09ab14955d5e470d17ab79
- TLSH
  T11FA002965209D56E95168CDC5172D914F90374A48456C4D4D291CA14388A1A5B98421D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Support.url
- Size 61B
- SHA256 ad34a6ea90b6fe95deb7897a5408c5aff6119268a86641417f6117131adcfbca
- MD5 84511d16e70e2576f55f7a0acbb8393c
- SHA1 704d8601166f5f5197eafc69ffd6bfe9faf15f94
- SHA512 6fec016b588c7c275debcfeee3dbedf612791ff1500556655c1bc9638677b9ff52ecfa1dadc38ba5af768b963209518de589538433ae6d17f51ee77d4cbb3df0
- TLSH
  T1AAA00297C119E56E9A0648CD6062DA15FD0330A48C96C4D8D1D1CF14284A195A68461D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/Tutorial.url
- Size 67B
- SHA256 89a181f8072fcdc1e2def08aea8bd3447786ff4161fd00083a17afd6e931dd11
- MD5 402ff9a0b3d22e84e16a5be479ea3368
- SHA1 ad63fcefc0d41a82fe2ebd59efe8c22aa5699ba7
- SHA512 6242bab5bde09bec19a06e0dd612d7684453ce5a7f45771a5f464fe4bf9e3068909af6785b764eefd3bef6a14f558261b417d07fe75685213de5a59f62f17337
- TLSH
  T1C9A022A2820CC03F800208CC00E3C000FC0330BA8203C0C8C0CCCA0C288B0C0AE8820E
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral18
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/changelog.txt
- Size 16KB
- SHA256 4d636a7d9ca32ade7f86cf1f2c111921fb72d6196e9aba652b083dd5b60d16c6
- MD5 19e0b6e84c4725126223d1588737564c
- SHA1 756101a8ff365b452a4dae16e1b532f7dcb42cf4
- SHA512 aed344ace7303dbf5fec51ccaf42cf00723743963724777bc6bab5715d552a09a7a6bf1c512b1a486924abcb4509b22eb77a4ffbe9e5cc26f45bb5f9fc48f41d
- SSDEEP 192:FzPjmJcese7/nhz3UYXNKfWs6G/HBX0x7zH0WQvxjDyz7x856gpOfMQbBH:daP7/hzEdvvBX0JzUve8ggpgMqBH
- TLSH
  T11A7231DB1E2743240AA641C56D48626CB7BD7128D7BAB94570BCC20D260CD39E37B2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.c
- Size 36KB
- SHA256 fcd80504d1e408d6184294f0f39b3f8a4fbb6e6a491f52a1620f00f2fe8bc299
- MD5 d36b06e1ffe39d9fcede116c2d4836d1
- SHA1 60a625194eb72950c9b75678220fa87fd73f353c
- SHA512 75b605034d5e0f611df295510b3a5aef5122ec533fa7e2fe47ba02a26fecf1267d3017688bdfe888b6b33ed5263b9dd6c1ebcf99494ef8d96ef4247e92162706
- SSDEEP 384:temWNvm54cDR2e6XeB9637ToEgH7HE6mDLe1kRD65C2i:mvK4WcNYzE6/mRD1
- TLSH
  T179F240485D20897B06F743265FB66C0DFA62916361E0F389FD6C22580F79C6463E1BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.sln
- Size 969B
- SHA256 d63a433015a0a4fc1494bbffa8b8e2a437dd398c74b816de779fc0e3b6bb549d
- MD5 b842c4b53f3d4323371933a3b97e3529
- SHA1 51acdf1f54ef20d820465ce931e8f1f372ff79ec
- SHA512 88755bb0ef04365df83e11d1cc2d32b484d3a037056fc59d116156a8899bf415388cfb1f9044c6debd033028e982d82190f332d3e163cf57951dcce68fa8b692
- TLSH
  T1FB11C27C611F6FF474411A9FD4F94E9B3E334341456C453D825190C59F32D80810B98B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.vcxproj
- Size 3KB
- SHA256 74b76285fefa23407cd3f0e0e10b73e7ab0729f6b4ad5f60612238d44172d978
- MD5 2e00883501d3ffeae1c0dbc4e4628261
- SHA1 536cd13349fb223654b44b6e8a314c055e7de95b
- SHA512 51acdb91d3bac2fa7cde27c1b969b145f1467ee1936d498046a6f8ce8ed201bf7dc9dc692498b41224a8b5d6eff0d971a0250e6df448704f0baa8a71c55bcf47
- TLSH
  T10181A864A4D02D4681B7822BE6E74981EF71C3830D2A4CA8F6AFD75B4F335587213B32
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral22
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.vcxproj.filters
- Size 962B
- SHA256 d442f5efd91f7201e612d885ae10d2d07e606924f5c2afdc9549720519b59a8b
- MD5 4fc591b3a3d0fe5fd0110a41f9685918
- SHA1 b79c172f0748dfee3744fc7dee629126e81e7554
- SHA512 8053598424fdc5a97fdbbb72030539b02a4362924da9b4dc2a9d4b08b70754c2b5c27bfa5bf3bb2df6fd2d44e7316d7f503cc0800c302a951301440034a3b42b
- TLSH
  T1D9117A2188DD3B582137A82AFBD0CA15FF69A2F331C1118076E9D0072BF2328A527764
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/keygens/php/ArmDotKeyGen.php
- Size 11KB
- SHA256 e5a079ed78a80e52f9b8005e20c8d5652464e13c83b39458681403a27725116f
- MD5 c950b3775fea2da12fe19ae15f7c1268
- SHA1 33df34e860f8dda33b3d50cf41d6304dee9bab20
- SHA512 574cfead92ce89f0d7f28d22f9a580c6ddb78c6913e3c5e773296d041bd7d9bfe24c402cbc2199d1b673319b0c003f90baace1df38a1657f513d3467a871cc23
- SSDEEP 192:THuur/Cj/BB2QX8I35VQQlUMSrlIhr6TJYJ3R8aiIetZftqr0t2IZ/i:TH9i2gfQmUMSpJYcc0m
- TLSH
  T1103232953D428AAF81F306293F79900CFF65811B221996D1BD9D1AD80F74F28D2B9ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  ArmDot 2026 Latest Version/ArmDot 2026/license.txt
- Size 4KB
- SHA256 95db618e4330ec7e4d4c1e658b39148a608221800d8c65eb442adbf8a158c129
- MD5 d2a9e7414b796ccec5e9b04cd3911047
- SHA1 1447ffe16eaaa2f226e29a0e6f3430e1de8ae88e
- SHA512 3b87df0973483ad37832f0d55a63056d2bf748402309bcbd4329923f9c4d2293810b8cbee7dda5264083e1874e7a1f14f2853ace1cc20455c42d52ed5456096a
- SSDEEP 96:p+HsWkZBRNRDzDwHqndY2KxakXVENVIB9hhZHJZ1e:BnLRNRtnLV8eg9XZpZ1e
- TLSH
  T1CA81626EB31A17B303D113506A0681D6B32FA178766B5294B678C25C3367C3D937AAEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25