9446ddf2ee0228d8438928b8912f49d58bbd639a27c87b9a9668968c8ae1e37e

Resubmissions

23/07/2026, 20:29

260723-y9xfvswfnd

17/07/2026, 00:32

260717-avy45sb16y8

Sharing

Copy URL Twitter E-mail

General

Target
FiveModsSetup.exe.exe
Size 92.4MB
Sample260717-avy45sb16y
SHA256 9446ddf2ee0228d8438928b8912f49d58bbd639a27c87b9a9668968c8ae1e37e
MD5 8b03f9b09075b729ca8d6b739e3850c9
SHA1 aa44a09331797e95a480b55b6b3ee1c9bf8917da
SHA512 57daf85bd5ccd7b6cbc9442ce4db889a60cdd2c1548626ec8f6389f7ce317464a32db49b82bf6c15116819cf5c50d79b58f0b827ccead36e16063daa47ec736b
SSDEEP 1572864:70h2MpPi9DgjlXL8Xn9XB1tbd4fTZ/idlOO6UdH7zGubwzq:7o2Oi1gjl2ztbdAGT6UdH76ubqq
TLSH
T1E92833B46844715DF4DE03F2B3F693E22DF73B77382809E981783516A2282943E5B5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FiveModsSetup.exe.exe
- Size 92.4MB
- SHA256 9446ddf2ee0228d8438928b8912f49d58bbd639a27c87b9a9668968c8ae1e37e
- MD5 8b03f9b09075b729ca8d6b739e3850c9
- SHA1 aa44a09331797e95a480b55b6b3ee1c9bf8917da
- SHA512 57daf85bd5ccd7b6cbc9442ce4db889a60cdd2c1548626ec8f6389f7ce317464a32db49b82bf6c15116819cf5c50d79b58f0b827ccead36e16063daa47ec736b
- SSDEEP 1572864:70h2MpPi9DgjlXL8Xn9XB1tbd4fTZ/idlOO6UdH7zGubwzq:7o2Oi1gjl2ztbdAGT6UdH76ubqq
- TLSH
  T1E92833B46844715DF4DE03F2B3F693E22DF73B77382809E981783516A2282943E5B5B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  FiveMods.exe
- Size 158.2MB
- SHA256 231ff376286299fbe9e0d40f72c4782b837432d935925db7478d0ff27323f3a4
- MD5 1b4bebd0fa4adc731fb7ffc1185de085
- SHA1 093a5a1fe9a111fee3a0663240fc52eaa4dd9cc4
- SHA512 1833ff1800f7893b42d531301383a48ee996079bdb817105d595dae0d95cbebc6ad3f1c65f5d0326b054f1d23a761d81327f7ff75ec3dc4662c460ca43e65c20
- SSDEEP 1572864:ibVZx8PLGKEULTQ9hm/C1tdUKYjgTwFoKnRQwsu/YfWXV/NiisGItlAdgAnEk0H1:ZvCqSkRm1
- TLSH
  T130887B03F29610E9E05DD1B18757863AEA72B8861738B6DF2B5417592F77FE02B38B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 8.4MB
- SHA256 ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- MD5 e400cd908b8fb7c13985e2f5cc7a7044
- SHA1 bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA512 e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP 24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
- TLSH
  T19F96A42F7B48037706C64262AB8BA5CAF21F903F3B561654344CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 c47a8ccae037883173e0c3c2c3face8d4d5394f7c4492449e9bcfce6d09f5d6e
- MD5 15c3cc618663ad92e772556bf7d1558d
- SHA1 49beb2598fbaf01f62fd91c9e7e90dd6583d0175
- SHA512 971559d0b0a01123b2ba7816ca6f7e18c78d34a4a019ddc65cc37c9975c5bc632016ca7298d6a2fb2cedaf1d5aca41e4fabc076eab5ad8c834515249373a468f
- SSDEEP 49152:eMAu1YhEi8/IRIsfr6znwMLTNhNp5WaCTf6yftvJj89NgwQ2mLlVxEB9nrxj76e:eM7EJ6rnLNp5M2BB9Vh
- TLSH
  T1FDD5AE07E6D640D9D01AC474879FA233F62034468B24A7EF1B919A252F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 469KB
- SHA256 82d58ee19e2e9e4dbd1538b86826764127bd9c803786e3b0dd7ed8a20db52516
- MD5 8a5340cb6f4b3f2b994805377e55064a
- SHA1 3467c3ee0f43e7f96067a4214b4a779047b513c8
- SHA512 3ba4804fb812e0ef002ed28bc427e9ba9d72d2ef1061c1f740be74f2d14292e40cc0f458cf996e682da9fbf506158cb1771a2b8520f29de08f0fa37762e22008
- SSDEEP 6144:+Kd5lhuD6QUxfHF4HskqTmydxlbGENgMi2nVnIw:+I5vulgfl4Hs1P53Ln3
- TLSH
  T1ABA47B15779844A9E06AC570CA534652EE71B8960F21FADF0294E23D2F7BFF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 7.1MB
- SHA256 75c0f506a6dbe0a69baace580625974558f794258dc55d957f1f0ffe48cf7479
- MD5 7ef231a60b94dc67d845879e53253a9d
- SHA1 6d8d60149e27ef0e2868cc516a2b92bca3aecf28
- SHA512 7e9d8639221b9049c36723df0098bbfafdd1b4f4b046ee74c24586fc290d2ac0b25152ef857a6bf2619a40e6791abdd62c46e36f5be5326b115c414aef14681a
- SSDEEP 98304:9tiJiCLKLBLAzNftWPaMT12CwV5jBwWGDa:gwQBMbaBNG
- TLSH
  T121767C03F6A281D9D05DD2B9875B9123FA30B8A9472072CF2A9817113F77BE06B7D725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/index.js
- Size 1KB
- SHA256 04a22ae517a8f93453097ed636dee04a7635f928eef73cbc003916d091d0bbce
- MD5 e4f4ed46cbf7884a2227a07d47907ab9
- SHA1 7b9e4d9904b4468c101b121cf47e4c2816ac77e5
- SHA512 4ba3d99629d983c2b073a584c58ad1d54fc3d2c55eed3e704a18e5db2c8625dc3fd5ffbffe8c56fbe5b096448eddf14b808dc97be9cf73c554095c1d842398f7
- TLSH
  T1CE31165E2873A2D15BB7A1A1E38B825259E3C05B754180203B8F87C5EFA2E658BC7DD0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/lib/checkGrowl.js
- Size 550B
- SHA256 01c807bd9f273f09ffd87bab13473865bbf321071513f5c487dd1b6e7fbdaf10
- MD5 fa7d81bc020ec4ef6c8055083876fcd0
- SHA1 d3c62e48427f39dc613bca96997d38a06c966283
- SHA512 4fb0844820363199ad78f0a667e0f945114e9d65d86283fb5bb79a1b97be25dbe8ebd2ce85a9dc40545630f3146b3897433e1d23e9117027d2c74fa698df3f1a
- TLSH
  T14DF08B25E8B6A832627376F6C0435A523D21C4172585CD8F839DCBF07EC708C800BB9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/lib/utils.js
- Size 14KB
- SHA256 bd5ed859adeda193e15672e769551966b31cecaa6294fc52297533d835af3702
- MD5 46b0f23f133ba1bd568e5cbdde8e7502
- SHA1 fa3154cd92cb2c398e8b324e6b8a2402e46c4a32
- SHA512 198ea2cb626be8ed7ded3188489952ae6a424da8a9294a507345bc23fd14ccbd4715dc472e4febf25f2ece460492ee3d3dceef394a79e79ea8e91950016380fd
- SSDEEP 384:lgQtxf7vKWXU5sli8m4q95W+V0TYVRvQliYqG5sYaLhG:ZH1q4ihG
- TLSH
  T18F521C5D24F7335202F372F6A68F9449777AC323205CEA51B68D83D4AF94530E6E7A88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/balloon.js
- Size 4KB
- SHA256 ef68f4d2e8dfcd1443843d81707a3e0e7a2e01d9573100710736eb1990306220
- MD5 22e0b5a21107a340bd37f034e88be79a
- SHA1 cfa46acdefbfb08542ac890d8de2fd007e343355
- SHA512 0c45207ec1875459355a01a8ce163811f267a95546171f2837dfd09a9587bd2888add14c4c0f868a67a66b56e6a15fcc8bbfb713141311bb8df737c8a23a91c1
- SSDEEP 96:EaKoSVm5cv9SRMRTvgkKAyJBVNL/wm/1Go/WB6EiTyaugNN2Jv:rKzmGKoEk0JBVB/3/woDzy9Kgv
- TLSH
  T11391ED0C39F363610AB373E6464F9219727FC2137148A962B6CE83E09F915A4C7DBA50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/growl.js
- Size 1KB
- SHA256 922eecd40262c26337901479de95b0960c719df76fd3b53dfa3fc3aaed95823f
- MD5 b899ef0e83aee19a163ce8ee249ac392
- SHA1 b729bd63844cb485a8cb183725d8c6720633c23e
- SHA512 cfc0ab6a0ab5111da7759868d4478043688f6eccd261d4f5fdaa74ffb4422956fe1cfe94974fbf3b08f1405ddd505053ee4ca3102c7182ae1e4ac5006ee2f882
- TLSH
  T12E41104878F3AB1155F372F5D2575149B07EC302259CE855B58A03E1AF910E8C2EFB20
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/node-notifier/notifiers/notificationcenter.js
- Size 2KB
- SHA256 10dc099d7164133959a61c70ed2951921ef591738c327dbd76d7338f1c9630b4
- MD5 09de38e77abd206cd405aa6ea70bda26
- SHA1 f91eb550baf3378e63086160100fbc82e88a6c1e
- SHA512 0dff587aedc93fd315b1b6f8001ef33973cbea5b416b5103da80dbb54e8182ceffa00402b3e6affd5193ddbac3b9c3d00210b052e8f1ee0ae91bb306552c056e
- TLSH
  T18551DC0C25F366A55AF3F2F5465B920AB03FC602254DA85173CE07E09FC62E4C7E7A58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32