08cc5258273ab45f3d2c40ee9bb032124684480f7b055bba286118a3e07419ab

Resubmissions

11/07/2026, 10:24

260711-mfpclshy9x10

11/07/2026, 07:56

260711-jsnp3aes3l10

Sharing

Copy URL Twitter E-mail

General

Target
ExtremeLoader.zip
Size 3.1MB
Sample260711-jsnp3aes3l
SHA256 08cc5258273ab45f3d2c40ee9bb032124684480f7b055bba286118a3e07419ab
MD5 cabc23d36cb4e90bc1b7b8b8cba7f073
SHA1 9fdb664fdba1d59d31befc61f558f8fc944e505f
SHA512 d55404f8f6305cfc0fee9fa39160973f25444a54ecc9b41bd1c1504bbb2737299b0fc4f179f62b6744f7dba8df5b62b2b05a1e110953fc885934186e8a10e4b8
SSDEEP 98304:qpFJ3D2xsVmhTqMn0WSS3q662x6nJLgR8AqZRT/HAXYCr4F:qZD2xqmheMDSSoRAWeYCc
TLSH
T18EE5335DB7407C3FBAFC66926C9246F6204A9393AF96F3D497861C8711B01123C8AFE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ExtremeLoader.zip
- Size 3.1MB
- SHA256 08cc5258273ab45f3d2c40ee9bb032124684480f7b055bba286118a3e07419ab
- MD5 cabc23d36cb4e90bc1b7b8b8cba7f073
- SHA1 9fdb664fdba1d59d31befc61f558f8fc944e505f
- SHA512 d55404f8f6305cfc0fee9fa39160973f25444a54ecc9b41bd1c1504bbb2737299b0fc4f179f62b6744f7dba8df5b62b2b05a1e110953fc885934186e8a10e4b8
- SSDEEP 98304:qpFJ3D2xsVmhTqMn0WSS3q662x6nJLgR8AqZRT/HAXYCr4F:qZD2xqmheMDSSoRAWeYCc
- TLSH
  T18EE5335DB7407C3FBAFC66926C9246F6204A9393AF96F3D497861C8711B01123C8AFE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ExtremeLoader/666sysEmx.exe
- Size 3.2MB
- SHA256 36bf0456c4678928371a6e0c6c0472c2da182fbc0055c8b04f2cb6bc30c975c0
- MD5 678e398d1b86375bc23bda418810b4a3
- SHA1 a24b70d7a3b6a0d8546be38846b1fc8bc742ccb4
- SHA512 e02a748fa48508fce63feacf45507f79172e687f426831972a9a1c420ff482594b1684dff82cf6d2a761e571ba688763930d8613a728a98d1add83b2323734e7
- SSDEEP 49152:jMDTnPBjU0gIbrAD7b5uX19VLrcRImsgcQAK6nFcFRJB:QDTPqKbrI7b5ufVURIDgcQA1nFcF7
- TLSH
  T1BEE5BE0E5AADE601E1BD46B91CE80532C3E1891A4E96CB169BCA3DD319E17D1371F0BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution trojan
- UAC bypass
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral3 behavioral4
- Target
  ExtremeLoader/extremeui.exe
- Size 2.1MB
- SHA256 dd725418f891cd4b0d9e8afc844c205e09b3180b33cae53ef262f79157db5327
- MD5 c8026b187c58f3babf6094ac5170a6ec
- SHA1 b2a8b3e73cb9cebefabda9b2c6d42a1c43cca1d2
- SHA512 64fe1a4e6e1a314efa2f187f92c3848ef219be87eed9cfc45bc12d2963bbc37f407b8a58ba7c78f7c4bb72f1f521ee4073890606264e2c0768089b4787097db9
- SSDEEP 24576:T4reX4hjui/FNM3kqjVnlqud+/2P+A94KQPUKQ9bNRh251UJ8tqsgta5aD7qZPAa:T4qn67M3kqXfd+/9Au5QpJ2n4XcAm
- TLSH
  T1EDA5F67D37C1EC40FFBC62B0A2A2CD211A21F9661D8151413CAB12F697879D32E9FB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  newtonsoft.json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  robustdreamworks.dll
- Size 36KB
- SHA256 64aff8eff0a741d0299ca8bf2362096d2958d7a7e061cd48788937bbaa4a448c
- MD5 afd4aa5b058eab0ebd781e2b04a8d6ee
- SHA1 bb1ba7446ad3de79a17c4507811593b989e15ab3
- SHA512 237ddeb302a62f850b0dee63976f2a9911a8d5520c1aed42a82458ba733f6f09fe5888fb3815cb0810d057d5fa86a9506ecc7133ea07cdf7c1c7475bd0e97295
- SSDEEP 768:RqQfF8DoIFfL+449HgSfNM1OA3n8pBwnQeY6:eDoIFz+R9pfNM15Znf
- TLSH
  T1ADF21851576CC237EAEE5AFDB072501227B0DA213386C7AEBECEA16C895371D12107DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  robustdreamworks.pdb
- Size 145KB
- SHA256 829a7f41402c1dd785d721c28f3ad659b0c25dd5b8d3b466679b1c5a31405ec5
- MD5 d29223ada19073352baf826458a0b6ec
- SHA1 844639535025829b825635a5583b21309a770e69
- SHA512 b29530d7747903b3145d7a53a4a3c7debfd1588a8533e3d082eca7896f888462075f41fb8c7d7c8e9ac8ee927ee24aab488be1dc47ca8e7aa16676822af5c30a
- SSDEEP 1536:lA/RYmHcJyCiaxAQUllAEbqw/wF/sllAAw:loH5ZIEbSb9
- TLSH
  T19CE3746BBB50C631D864C874799B4B5D0634E9C8D782578FA356F02C3EF33A92D8B264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ExtremeLoader/re.txt
- Size 11B
- SHA256 cd12b12791504eafc8a017cbc60d32fbdc0424cf3f3b7a59b7bf870b4f968d4f
- MD5 583ff21d02ca55b3c70f364468787134
- SHA1 edd54867367c30bca4aabd3aab49eaff49bb7963
- SHA512 4c072db1fc746f97d48b3dc0d789ad6a8f88a458f956e20b743e11df4d200f9f5a94f1684bd59ca81a22eda8c8f1a9ed47e4dd16e891fe3804cd7bee805c8347
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral19 behavioral20