Overview
overview
8Static
static
3ArmDot 202...on.rar
windows11-ltsc_2024-x64
8ArmDot 202...ys.dll
windows11-ltsc_2024-x64
6ArmDot 202...nt.dll
windows11-ltsc_2024-x64
6ArmDot 202...re.dll
windows11-ltsc_2024-x64
6ArmDot 202...ne.dll
windows11-ltsc_2024-x64
1ArmDot 202...ed.dll
windows11-ltsc_2024-x64
6ArmDot 202...ot.chm
windows11-ltsc_2024-x64
1ArmDot 202...ot.exe
windows11-ltsc_2024-x64
3ArmDot 202...le.exe
windows11-ltsc_2024-x64
6ArmDot 202...ed.dll
windows11-ltsc_2024-x64
1ArmDot 202...ge.url
windows11-ltsc_2024-x64
1ArmDot 202...db.dll
windows11-ltsc_2024-x64
1ArmDot 202...ks.dll
windows11-ltsc_2024-x64
1ArmDot 202...il.dll
windows11-ltsc_2024-x64
1ArmDot 202...on.dll
windows11-ltsc_2024-x64
1ArmDot 202...se.url
windows11-ltsc_2024-x64
1ArmDot 202...rt.url
windows11-ltsc_2024-x64
1ArmDot 202...al.url
windows11-ltsc_2024-x64
1ArmDot 202...og.txt
windows11-ltsc_2024-x64
8ArmDot 202...en.ps1
windows11-ltsc_2024-x64
3ArmDot 202...en.sln
windows11-ltsc_2024-x64
3ArmDot 202...cxproj
windows11-ltsc_2024-x64
3ArmDot 202...ilters
windows11-ltsc_2024-x64
3ArmDot 202...en.php
windows11-ltsc_2024-x64
3ArmDot 202...se.txt
windows11-ltsc_2024-x64
1Analysis
- geolocation tags
eueuropefrfrance - user interaction
yes - max time kernel
106s - max time network
102s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
ArmDot 2026 Latest Version.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral2
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Api.Keys.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Client.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral4
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Console.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Engine.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral6
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.Shared.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral8
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
ArmDot 2026 Latest Version/ArmDot 2026/ArmDotConsole.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
ArmDot 2026 Latest Version/ArmDot 2026/BoxedAppSDK.Managed.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
ArmDot 2026 Latest Version/ArmDot 2026/HomePage.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Mono.Cecil.Pdb.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Mono.Cecil.Rocks.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral14
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Mono.Cecil.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Purchase.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Support.url
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
ArmDot 2026 Latest Version/ArmDot 2026/Tutorial.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
ArmDot 2026 Latest Version/ArmDot 2026/changelog.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.sln
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.vcxproj
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.vcxproj.filters
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
ArmDot 2026 Latest Version/ArmDot 2026/keygens/php/ArmDotKeyGen.php
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
ArmDot 2026 Latest Version/ArmDot 2026/license.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target ArmDot 2026 Latest Version/ArmDot 2026/ArmDot.exe
- Size 1.3MB
- Sample260711-devcssay2j
- SHA256 fd6ce83e2772aa231bafc2bf0325d8665801ac5a2a7db53bceb48733e732d564
- MD5 82228be8fba9810b62af607df3dcd1a8
- SHA1 aab3de22881679a9e964044eff8d03a7851072cf
- SHA512 5b4140b3baf25c480de4cc53a9733d10176919e8ef43a45328da13d2aaa390c5f2cf9f5410ad502b890fcfe35ee367cd7ea15f3f29b4635cc0a60cb782d92bca
- SSDEEP 24576:yPRQSbTb0rdxB2UQeJ9FjevfZKruQdtT:1SPb0rdxB8eJ9FKvfErtdtT
- TLSH T13C55E7006BB9E701C0DDF77797DB859453A040E5BBB2E34FAE19B6E57C22C1A794A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" ArmDot.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 ArmDot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "3" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 6400310000000000e95ccf7410004f55544c4f4f7e3100004c0009000400efbee95cce74eb5c42172e000000aab101000000020000000000000000000000000000009d8f2c004f00750074006c006f006f006b002000460069006c0065007300000018000000 ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff ArmDot.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 ArmDot.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents" ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" ArmDot.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" ArmDot.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" ArmDot.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell ArmDot.exe Set value (data) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ArmDot.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4244 ArmDot.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4244 ArmDot.exe