86ba82362241c99cfbca70af1506812966c495729f1cc7e5d07c14fc7973ab21

Resubmissions

12/07/2026, 08:10

260712-j28ftsev4n8

12/07/2026, 08:09

260712-j2fqtagt4w8

Sharing

Copy URL Twitter E-mail

General

Target
OpXOyuApWKTlFzrV (2).rar
Size 66.6MB
Sample260712-j28ftsev4n
SHA256 86ba82362241c99cfbca70af1506812966c495729f1cc7e5d07c14fc7973ab21
MD5 cbcd1daec0b245b8d35abd09ace4abfb
SHA1 7e82eda9a84f49013ef6b6643eaaa136b8835c71
SHA512 566610f0e87c3cbbf497101063ca7912e1e96daa99e99a1dfccf2a42bff1c640e22f3a653f286794e7b27b7eec2fdbb83dd803b3a5d1c0a28ca24f8062103dfd
SSDEEP 1572864:UEElql3UAs5ldyRjmB6l/zQMxERx3CITI+Gx+/KBedhWH:FW2UAs5ld+iYnOR5DTIXx+/vI
TLSH
T1DCE73368A79C141E6C1BD3B9BB761C7D86132CCF67E30F19180436715BDACAAF284E19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OpXOyuApWKTlFzrV (2)/Potassium.exe
- Size 74.9MB
- SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
- MD5 eeb010dec5e5c64d818ab2a9eda690e8
- SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
- SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
- SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
- TLSH
  T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  OpXOyuApWKTlFzrV (2)/Potassium_patched.exe
- Size 31.1MB
- SHA256 b60dba7a7e5d8f0efc002ad1cb289271a19c2699f339d049bb2cf7797aca4354
- MD5 3def031512161351344bd6d6632a29c3
- SHA1 5cf86d4903e198ec408914f1b7fe76504ece25da
- SHA512 e274b3921115d88aad9de5af4ac5c086d417f029f1004139050e492a8f7d73746a40832c2c9f5257b5b2a3c97d4edc1986e2d26bf27835cdcd7f91e5b7e4ca64
- SSDEEP 786432:h2G4TLcNODhxOKvuToWAGWrYMc3r00FzYzgEHnR/R:6TIAtf0oZ7vc3r00FCgEH9R
- TLSH
  T1DE67335D96E029A7FD92803A88768325E3F268211FA1C5CF17DC4BA43EB71984D3E735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  OpXOyuApWKTlFzrV (2)/WebView2Loader.dll
- Size 156KB
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH
  T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  OpXOyuApWKTlFzrV (2)/autoexec.lnk
- Size 2KB
- SHA256 efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4
- MD5 fb5ebf1ae11a1059b54a7c1cc769ead1
- SHA1 0d4b9b9c8aa8833f2a4c91f595c915f82926a2c7
- SHA512 d66e93ebcb0b496c38b1c9b3468125240530b568de9993cc3c8454aa0be96353ed09337d193195b71e9a0c4c2ae280f36f29f5cebea6df05801e48c8ea269c01
- TLSH
  T1834115035FE60521D3BFCCB91EBB340A8A677262BB4109094114D68E1C71D17ED2AB1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral6 behavioral7
- Target
  OpXOyuApWKTlFzrV (2)/bin/Decompiler.exe
- Size 1.4MB
- SHA256 756d5a64b46a92b7e5c182ef505099242ab1024f7b9b790bb4ad6b36b9ce44af
- MD5 44c6987880e409bc44766616acebe04f
- SHA1 bea6998cb245708b63b07a0a5e98aad949ab80a3
- SHA512 419fe4464487c6c5cb8bb2b288e959926dd70a7b4de8e09baab5b2e98058e7d6ca77fe59b9d0a092e44f541656a09787ecf1c8f23d4bd11e32fe7bc957934a59
- SSDEEP 24576:pkPxYjuvNbd8kuxMX83fmqnd9i3u4cH+Y9cPO5XX:p3KvNZ8k63uqnmceY9cPO5n
- TLSH
  T13F653953F64550ECC06AC174835A9633F636B88A17347AEF1B918B312F6AFE05B39748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  OpXOyuApWKTlFzrV (2)/bin/Potassium.dll
- Size 9.8MB
- SHA256 e79dbdc895d229f5fe6aa3c13f3bb2cda276070f5bbab35cf0549a284944f7b8
- MD5 03296932d69a73a6190baefdb98e7a18
- SHA1 12fa9210c786aacd4024f46828a0dd4bd6351e46
- SHA512 611bc0f47482019bdc3cbf082a0d41a8e7f75f92ab1fe8640d16ab5f2b1e8cffc2be1c3efb0fdc6cc488bdb1a95f5a3b6a78237cc4e2948795902264f5205741
- SSDEEP 49152:RAsu1K3hoodVEWgwx3eGIbzqqLjEp8ctkbnDQD3fnZxJz0NbWJZPbUilP+U6lSB3:wodcqilYvfUCoyAfwsbcgYawl6cJ
- TLSH
  T1F5A67D6551B409E8D3BBC0B9EA4A9E13F6717C0D8324B6E78DE147912BA37E0673E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  OpXOyuApWKTlFzrV (2)/bin/Potassium.exe
- Size 14.1MB
- SHA256 b1d56988692f04708cd81acf57067750bf66db8402f7a322b1cf51611ff05a9e
- MD5 898f1ccc777b0168f1d82b58e73741f5
- SHA1 a2f283469ecb4a885b8e4003d91a19c0994b2a6b
- SHA512 de5b11c903c4575d92a9065dcbdaed40ce114ec60316042fe817320048ef8da60ad6b888511e909051335bc009014c12c64333dcc895619a918251dad603c885
- SSDEEP 393216://IP0eqrf28SGq/v/y5nOFuREMUeB+ou8T:HmGq3/y5O+B
- TLSH
  T163E623E644D421F4D8EB4B50B24A6BCE35E0A0AA49B9BD5D3BC11C434F32FEB4549E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral12 behavioral13
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/index.html
- Size 18KB
- SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
- MD5 8fd8d51f3c0c602ce8bb3ce24c759de0
- SHA1 a43d4d108728151cf5a4b4ad505de80c7f5c929c
- SHA512 a0054794d43959617923452d41bdce78caa541e8d2bf633db006a57779d75d80c3912b311521001e1fd05f8b60f589d6b52c776adc5309c7b7ed41b7e305a9c9
- SSDEEP 192:oIJbX0ggAbOmUSMKTnuMuTcJg5v2wzQW3V1VHDwFgBsK4u24FzZ+MHTq58BNLQPS:X0ggAbOmRJd/sV1VjwFgBs9SMwZ
- TLSH
  T19B8220DAB95F50CE7292326AE0FFF60AEC2DD17EA10506F6F69E6C708949106437342C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/base/worker/workerMain.js
- Size 174KB
- SHA256 19b566655d73370a820a7d6fffe7af03dba3af4997016c0983be5bd188603ec2
- MD5 9ce9e46b6d66d8b2dbcabba577cad2ed
- SHA1 397b0e9e7b2bee37a8444e84bb9788a0bdcb023e
- SHA512 f322ea669fa81397066edef062721ae3dd515b3d61c4ad7bef0db0eb3a53f056da298fd4f761bd3e5d613e6f5803a7c35ed056085ac3b97e06c7bfd47fffad49
- SSDEEP 1536:mi5eQeCEwCP1m9JXKmA1xKzyOQJf9X2K7eM9bWXsUK5QSkSoIMQwr+ZjtQYyeTMO:mHTdkKmA1yyOQJl2K7ns6dZ/RVaNzY
- TLSH
  T1C9044CC53265984353E652F5A07B0107FA38B877680C556CF3A8C9DF2D6A88760BBF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes.js
- Size 2KB
- SHA256 9636806a05da6a43937d122e2211e8d2877ed95caaf691f4f079dbaf47e0c6bb
- MD5 c25a7c14fa5635368e75d154c185755b
- SHA1 dcdcdbd05115311a0929390b82b6c5c2b029aedc
- SHA512 3a6b15608fcc48f78a6442fff4fe7781603ceeb7b8bb06f2c6546f821be2cb824612dd5d143bdecfa4de33a3f1f5723d2f643d4d7de2ec2d1bca3fc1ba5eb44d
- TLSH
  T184517096B7CE6BAF598C33ECE4778406A69FE5336116883DFE0C90C410D3119A2E89F5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/base.js
- Size 521B
- SHA256 9a6c60193eb2dda7c2682bf9c7ff7e01b0f6000d70881583f0055782c8b2c619
- MD5 29e50887a6f1c445e0f63bed73eefb83
- SHA1 b8e006b9ad14bb6012497e164d9a4f926e2d568d
- SHA512 16cc7fd8b5641d347a6a9e8542a6ab29d71a432dfb2f72dae05b21b274d92208ec7c5a9ad1ba313658f3a68aebd9edc3d0bcbf07a03d0f16eae95568f175dbf4
- TLSH
  T1CCF0976BF78F30CA1E474385A73AC1495C6EDC32D2322035F51CEAA94488C2923468AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
- Size 33KB
- SHA256 75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38
- MD5 fabe9b3ec7774eb374f18709ab41c8c0
- SHA1 de6c19413ef008000357bccea90faf0d23ccf605
- SHA512 d7b4a9dbfab0ec55e27b2ded86066b37ebea7d50b3b6b28f44c996f8280463176f1107c6bf15a52fb700f88ac3e0e7b87fb8a50664da9b31fc0e89a38d2055e9
- SSDEEP 768:EDVdzN+yYumzw/Wx5nYCH0e2zBsGMPv3lHhj4MyjKG9jn9/j7NFvHR0hT/YEkd3M:H6/W3YCUpqUDW
- TLSH
  T1E2E231E7F38C3593199B4784A27EC68539BEF6BDE4F10079782C5608079481933AB67A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
- Size 11KB
- SHA256 573e821c40792e10d2dab59ee3483e2482379241c94b2b98ec5fb098556e3e89
- MD5 f2adca6e8020236f5e86b8e6aced6806
- SHA1 1f77dc5554c3ad94a78b693d1bd8fb859138de03
- SHA512 040fbb8bdcb58ecd2fbea318ba661efde39f96ac2e3aa751caed100e1b4a8941916b8a9bcc6335ff76875d558a2994866069f50f88beda76b7f09f258fe670c1
- SSDEEP 192:AJCfeXBM5iG6zUMmYmr6QMlr4qLYFQjG6AcE103aNd9xZAqGQ2qFARewPxHFTX0:9feXB2iG6zUMmYmr6QM54qLYFQjG6AcQ
- TLSH
  T14D42ABF7F38D799719438786AB3DDA842E2ED938D93240B8F70C6615248C959232619F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
- Size 594B
- SHA256 9bd9c85c5d1f476e663889ab2008f83b323c8d794abb0df35d43091c689ef64d
- MD5 4d0ec8edaec389b1eba92c1d18676f09
- SHA1 6eafd8ed47700b9a2ff1e10dd7468e50fab1bf6d
- SHA512 d4c7655d7db8d4f7d4bb2d0add36bef916caf291b2855785685a3e812279369848ce081ac6fb5cc869fb827653a4a1f874273af17bee67987e3c3a441ad368e8
- TLSH
  T10AF0EBBBBF0B3697060B63C8AB3DD740192DC831C4624425F20C5B6040C0C2772360F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
- Size 1KB
- SHA256 f7ada012dcc309b7c1cd272d1a81657b0ddb3d51521e682116522099285d525e
- MD5 09bbad4c05be7ab76cc3c5ef4fa9ddc0
- SHA1 a38cb372349a2420619e2fb629f0912500dc1064
- SHA512 40b753d8e97ba46be9fe4241dbe892bdeb62c902ea088d68ee7ea5ce0506d51b16f7105355a6b5360363c80d98b0f644b7a7ea2b4262210f24870368a2629c44
- TLSH
  T1AB21EBF3FB8E304B1D028785573CDB011C2FD834C87210B9F108A67090C9D42225B29B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
- Size 777KB
- SHA256 799c0657b0ab027c3ec0794e8934bed4a4a8e7f063dcae47783a7f32fbeda25c
- MD5 b1e41317d3ffe843032f5eb6f74806a9
- SHA1 506f617da8d8093ed58cfda68e0d60e1aa2ed08d
- SHA512 fb538a73935fd41b9f2ba9f6ddcdfe066f6f672d5dfe682dad301cae3392a93405fd35ee61126e9889e14f71c51e11cdecb4e20d213ba91b34801ec5b89ce02a
- SSDEEP 6144:0XUmTfyptLD/yxnbDh+hIAKVwhWppLTl+ExT3dsX34hAhbAhQ9qhjLmWhXXu:wVyx
- TLSH
  T136058CF7B78D6A4B2C07934AB63DCB04393EE6B4DC2254BDB65C7B2075CC901126369A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
- Size 16KB
- SHA256 807dd6d35bf5fffcd4de4aa4ed1800716223a6fe014077f23f2f652ac86d2a31
- MD5 430fa91891107d6f1f3c3392dde9ff4d
- SHA1 5d42ebec7a7c3f5e5b7eb074c38572345e33c1c1
- SHA512 22011409e428216a619ca085ce8e034dc6bc3a8f9de27fb4f2e3dd6b8aa8cc7aa3b02508af816137f646ca1fa96e083a832e68bd8c8b016bfd7a3674d532a875
- SSDEEP 384:pFcCsgQgj6bPo2nv5CYR8/+qvPNEzH+AK6/NBA8K/tQsdz6FKRjrDcWYUeih+hrA:pFcCXQgj6bPo2nv5CYR8/+qvPNEzH+Ak
- TLSH
  T10E72DEFBF34D36A71D4B4281EB3DEE46261FC67CD83201B0BB5C6A15164885623A785F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32