a80964edd3d92e42a52582c75e3b4fd6a91c7159fec3b24a7a243b2476ab1076

Resubmissions

17/07/2026, 09:33

260717-ljn1ksgv2r7

17/07/2026, 09:25

260717-ldngvsgt6m7

Sharing

Copy URL Twitter E-mail

General

Target
CorelDRAW_X7_Crack_v17.1.0.572_With_Keyg_Archive_latest_754905.zip
Size 703.1MB
Sample260717-ldngvsgt6m
SHA256 a80964edd3d92e42a52582c75e3b4fd6a91c7159fec3b24a7a243b2476ab1076
MD5 01eac6206b58448fbe33d00ea697cdf3
SHA1 22984f7811db68e13a3b3402e198617409c60a17
SHA512 1860d13bc2f1caa33933b4af21185c3d2394bbeb815389c49c7f0293fcec5cc028f93b2739ad1ad2abea4e76221fe933e5f6852d734533f1411bb0583a4e034a
SSDEEP 786432:Y8bBo/PYz5SQH0TZVih5X0vAYHHUfz6pk5PB:Y82gND0TriPknH0fxJ
TLSH
T17A793305CD2DE3D2FA977AF8B8F0515BD62F51F132CD929479A432B49D8AB006F2980D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CorelDRAW_X7_Crack_v17.1.0.572_With_Keyg_Archive_latest_754905.zip
- Size 703.1MB
- SHA256 a80964edd3d92e42a52582c75e3b4fd6a91c7159fec3b24a7a243b2476ab1076
- MD5 01eac6206b58448fbe33d00ea697cdf3
- SHA1 22984f7811db68e13a3b3402e198617409c60a17
- SHA512 1860d13bc2f1caa33933b4af21185c3d2394bbeb815389c49c7f0293fcec5cc028f93b2739ad1ad2abea4e76221fe933e5f6852d734533f1411bb0583a4e034a
- SSDEEP 786432:Y8bBo/PYz5SQH0TZVih5X0vAYHHUfz6pk5PB:Y82gND0TriPknH0fxJ
- TLSH
  T17A793305CD2DE3D2FA977AF8B8F0515BD62F51F132CD929479A432B49D8AB006F2980D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.Tky
- Size 324B
- SHA256 442ee622777600efe66e5765f363b48984e4db49e9aa3c8c39d05fb2058c275b
- MD5 c0acd21e6270f577e99963034e2c25a2
- SHA1 18371c6f348416707596542b558bfdd00f071312
- SHA512 c4871623c916bddc2ecdae60b54ed5eba0c38b33e106d34af00b8789acae18f4529a468e04fbb6ee78554fd3df0c5ff84046ddd9ef06375613aa6a90481181d9
- TLSH
  T1ACE0262486258DA78062B280C52B028BD31025A6B062EAA85355B9C7E93A0237A61A72
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 e1cac9a290c5230743f136c37609ea3f87221f2d7d7a34fc350494a02f8df41b
- MD5 166c8dcf31eb089dc188547412a53e09
- SHA1 bf21443d99e808ae01e23ba6d64df5f1c9511f37
- SHA512 2537c9cdfd90b36ac4458f5eee7033a9eaf716c289a8db420ff2e689c44bab126f7a92ec4b63cca56e1a8c086d25f886fcdc45b444bdffa6cdcd06dee36de149
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/FU:ia4peoAyJzbuJ/RE+yUewQboCVQvlpY5
- TLSH
  T15184230988C710040DBC87A97105FA7CF16C6629A3EB637969E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  data/cache/py3analysis.rpyb
- Size 70KB
- SHA256 a32b314e4a0f36dd8c8b353c4327d6cb14c6314bed7c00d47b3c20bda75451a1
- MD5 b4236fc9dea9b1cae7c16cea5985a921
- SHA1 37dcc0f3f034756200f9739accf0722cd7ed22b5
- SHA512 954db8fe9e0a5c9f08af7e01d39b993e48f5133a0852ef80e45f23f80961db5d0a0917da0a940105ba01ff1b1e08a098a38a8877077f77b04cb64dd068229f29
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NR8:fK4FJumM68gsjFliwugQikL3NR8
- TLSH
  T1F663021A8259773BB404EEBD7ADADC44C534F6C03EC603A3AF59B98853D0DA03652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 3582a5ddfb18cd4c9e13e5f838071af54630a7daa24017a6fd3629d87a080831
- MD5 ded8ad9d80b56ba4eb1c62a2a4168550
- SHA1 3625381b2ebe486901128eeaa6da689a9a8fc5f7
- SHA512 8f2d003ed2df369cecd5ed9e930f1ef8395d912b7897b65ea4a00ebf291e7dd1269920924eb33a5735911eb8ee5a76b29bf039b6235de03d668c106efdbbf4ca
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKK:Z77jHIL0vBzbiE54gbyDdkqL///qHaV
- TLSH
  T1FEC31327BA3C584858A47C16CE81AF9A06E04C0FD58FBB4B42867C9C9C1F182FF51DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  data/cache/shaders.txt
- Size 1KB
- SHA256 2403ee4bbd255733d5b5e1d0e65426204c02859e8ca349065471eceb3c07a08b
- MD5 7eb0254a26e0b4b1af699ba0c8702862
- SHA1 dbab0fc1e0acbc9b7aae7a27d133ccde695fd886
- SHA512 c6d3c3642c1c43bd28e36dd1aef6749ca1a3f8bbee7e290b3162ed020b42d40a41d22616eaa4a9dbabd3ccb9ef9f3f9264cc5a1e5d2b16b6f6ef3ac4d21ca022
- TLSH
  T1B41175A0436FDA22F1D2210421D81F04E56313402ADACDFA17344E81A21176680FEAA3
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 07920304abc18ae9730f3905fb8be3a4985e834d054aaea085516f0aa3bf9a0e
- MD5 07f79589d613439fdf1b234e2cded6c3
- SHA1 8e2eb1d55225e1d6166817093796bd3d69f15177
- SHA512 7cd9e9a67a05dcb99e9b013fcab3a6b8a1f15620cded215c58215a5b2507747d8a6e7013f8f2a48ba268d5c34da052f7eea78389455b68e7c330d42dd9579a99
- TLSH
  T1D13195EEE33D2FA49741DDE69170B9F2CB0E1700B9F8B89C554B57B00A475236049771
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  data/gui/bar/left.png
- Size 1KB
- SHA256 9c3bb8c261ca20fb5f6e1ef442e542f6957b7f69c9daae053dab9b40165e3e0f
- MD5 c5d5c9ea79cf55bf4d7edeae03714fd5
- SHA1 e83350fda9914ab7343713bf79438661937e1077
- SHA512 341323f3c0963faa76495323010460e2756322663ad34fcb9ece8751072e2f88c129d4957cb7ff234d4b45a2b5b473bbb36f7f4e20db76cf2f8e7e26a35299a9
- TLSH
  T16E21D880EB64F62BF11E609261862A7315247D3930F2FEBC9193B60F0283F7A2C39C55
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 0b74cd74157773d831d13c8619625429c637fdc0fa606c9ead977e082590cc42
- MD5 a6f513361aecd9b26893de0ff35e1758
- SHA1 073112ebfa84db6b7b8be47b1e0bf4a3e902a4c5
- SHA512 ff5b2d6acb2f8d0506a7ecd83583444c56e423aa07f4be2c7f5d1dd2e222d2cb35327020439ae5c8415032503fbcddaa4043a3e208bf95d3c2af1509bbef836f
- TLSH
  T1A0215180D650D23326609161614969F1A4211F7D6C24E95802C33B1F21B2FF8BDB9FE3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 e73e487553bc14d739e6f7a76d90d0332581f5ec06643c065a16a9bcca12b74c
- MD5 39e1a4a633213251af9670af3246fa7c
- SHA1 03530f5e696ac9781941f6e16dfac0185e2ffb5b
- SHA512 ac84b3acf56c5753c69194087272326aa239dbda35c1ef8a9020efb175895f0485fd535617b39c180601fd16a1817e805eed2d848fc81b65a547f8f0968773b9
- TLSH
  T19E117CADD63D2B609381DCE6513176E7CE1A1300F9FC645C648B97B00947573508AB70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 09bea0eebcadcc0b7d27fbf9e6666c902a0a56a78b2f076814c1c4f53d9773fc
- MD5 e1dfdafdf4265ee5c21dc92e75a8c95a
- SHA1 a046c0e23b44c5d06fc58257c4f841a2d1114650
- SHA512 3bce1e2d7bb51219607c8f5113167d528e96c4004fbf35a1094b59c53d43473132c5d69bd649f2091563946e179ea195de5be02c0d24d0d1f8f9861e6eb655e5
- SSDEEP 96:ttTlZ6i7DfbKvW2rfhcJ7vZH7z6G+WsB2llHnJaKmpm4RVbC7NtxOi8iutRhGU:vzR3KblGhHiG+WsElhnJ3mD3SNnt5ucU
- TLSH
  T164E18E1199DCD666D7B640E158852B27EEB10A3D06BECFE1ACCC0D82C9B0D079B598F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/button/check_foreground.png
- Size 496B
- SHA256 099c1b93f7cf9c8484daae728129557003c112174a7ca853c6993bb0aeee1ea6
- MD5 7fade179e73edd2762aa12ca40319515
- SHA1 36adef6cc5084302e28962e66561b6106c2860ae
- SHA512 1612623135d4189a1384044c41e3cb6700a9ef0e788909eb749ff7309d96d2e17cb77deb596de649a5da73f2024e93595a2a9e29e361395cd41ddff4bd0d5111
- TLSH
  T142F005E71852811A945D836A079A614094A0E9A8345E0225D166D376E7C27A9B70754B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_selected_foreground.png
- Size 334B
- SHA256 2e726ebaabc614324a2f9bd4b6f9d0448f45e2633b9562a24fdca7121db3193f
- MD5 fa4922579c249a9e11e36a3645383140
- SHA1 ff8ba47782c9c3f723f2ce0f2153bd7e4f562f6f
- SHA512 140bd402569bda243a88482a8cc2196761c1c59106c48ffef31e65812180ea8156e9d7ac47cd30ca56576b2f9690af2a212c5c7012a1a79e33113a1a30fbc74c
- TLSH
  T180E0C02DE563381EB3086AE3BE207720643890889A60292C0032A075C2A001889AD38A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 d65a683e60bf06397f39c6a8528cd2a4b1856120b0d814f57282f33f9ca361e9
- MD5 12ce27f3d7adbb84bc2b0e64d1653726
- SHA1 ddbcca190b833eac7f9561ccbf7378a48a2d6866
- SHA512 dfaa6d4b0e11ae2a18719d20607f0cf1995172465e6c929c384549f0582d691b855fc874bc9915b1fd1fed2c9103492c0dadabf2e4aef14ecba2e7a3d3611fe9
- TLSH
  T1AE412CC2E3A0057332450180B084855382881CBBB4A8FD4819DB792F8B7BF799E70F83
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_idle_background.png
- Size 2KB
- SHA256 f1596cf33f7169463d0e6d5e37bdef83fe8aaf553cdfa3c1123ea2fdc3866fd7
- MD5 600a3026df0005544b085a3f11335f1b
- SHA1 889c0ded1a392d1d3d4e5a4cc1e7313cc67cb399
- SHA512 2a7ff6e37451959d07435319cdabc2514c781cded6c39da513798ff687660078e5c394c9a6f21e116993acb2cc9b36dd0799441416a9751990ad08b43108a6e1
- TLSH
  T18241DB01D3290577BB151928F4E61097AE028C337D02CC228EC77AAF6357FBA6CB2D60
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Indirect Command Execution

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32