0d81db5ed1e643588b4edbfb49fbd25c4d525d709d3d7375354a5c56d7824164

Resubmissions

19/07/2026, 22:59

260719-2yn7wshx2x8

19/07/2026, 22:58

260719-2x5hgsey9m3

Sharing

Copy URL Twitter E-mail

General

Target
Oringo-Client.zip
Size 1.7MB
Sample260719-2yn7wshx2x
SHA256 0d81db5ed1e643588b4edbfb49fbd25c4d525d709d3d7375354a5c56d7824164
MD5 ba360da12d2fdfdbbfb58318d5daf73a
SHA1 eb6a3ce82b7c293158cff7f0243922d5b55956ae
SHA512 3d23530b4c9e8188e9c2947a1237f272ed292cc015e5073a04141be8e75f8f49454e27ec66afcb99fc118434e97b607c9dc6fe940d95fef1d7b098bf74845ff1
SSDEEP 24576:qLBFfGh4e9tQ3cNH59H3gjAVEOBy86bqH5n+9gXCw+HYlRzu:wfGK3cNnH3gj+55H5n8qCwVRi
TLSH
T1BC85D126F61DB073DF8B767D830FCB2D276D4B5901621C42DF35010AA8BE2625B7A6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Oringo-Client.zip
- Size 1.7MB
- SHA256 0d81db5ed1e643588b4edbfb49fbd25c4d525d709d3d7375354a5c56d7824164
- MD5 ba360da12d2fdfdbbfb58318d5daf73a
- SHA1 eb6a3ce82b7c293158cff7f0243922d5b55956ae
- SHA512 3d23530b4c9e8188e9c2947a1237f272ed292cc015e5073a04141be8e75f8f49454e27ec66afcb99fc118434e97b607c9dc6fe940d95fef1d7b098bf74845ff1
- SSDEEP 24576:qLBFfGh4e9tQ3cNH59H3gjAVEOBy86bqH5n+9gXCw+HYlRzu:wfGK3cNnH3gj+55H5n8qCwVRi
- TLSH
  T1BC85D126F61DB073DF8B767D830FCB2D276D4B5901621C42DF35010AA8BE2625B7A6C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence ransomware spyware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Oringo-Client/.git/hooks/applypatch-msg.sample
- Size 478B
- SHA256 0223497a0b8b033aa58a3a521b8629869386cf7ab0e2f101963d328aa62193f7
- MD5 ce562e08d8098926a3862fc6e7905199
- SHA1 4de88eb95a5e93fd27e78b5fb3b5231a8d8917dd
- SHA512 536cce804d84e25813993efdd240537b52d00ce9cdcecf1982f85096d56a521290104c825c00b370b2752201952a9616a3f4e28c5d27a5b4e4842101a2ff9bee
- TLSH
  T125F02781599AB7374046051BEB2CF6AD9880D8D893926F10A0EC4938B67F5E862FAF51
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  Oringo-Client/.git/hooks/commit-msg.sample
- Size 896B
- SHA256 1f74d5e9292979b573ebd59741d46cb93ff391acdd083d340b94370753d92437
- MD5 579a3c1e12a1e74a98169175fb913012
- SHA1 ee1ed5aad98a435f2020b6de35c173b75d9affac
- SHA512 d6bb7fa747f4625adf1877f546565cbe812ca7dd4168f7e9068e6732555d8737eba549546cf5946649e3f38de82d173aaf9c160a4c9f9445655258b4c5f955eb
- TLSH
  T1C81127DE95656BB6480701011E1CB3F96D40D63C42C5EE10E0CE983EFB1D85602B9FDE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  Oringo-Client/.git/hooks/fsmonitor-watchman.sample
- Size 4KB
- SHA256 e0549964e93897b519bd8e333c037e51fff0f88ba13e086a331592bf801fa1d0
- MD5 a0b2633a2c8e97501610bd3f73da66fc
- SHA1 0ec0ec9ac11111433d17ea79e0ae8cec650dcfa4
- SHA512 5168643c1768ec83554a9066754507a781b6d14251a46a469222d462efc6ca87a72c90679154e8a723349c91e7772b32ac9b08dfe313cded0ee0a6f17885079e
- SSDEEP 96:GFCscBOvOFXDgRvi/3UCwN4ZlkRo/j5SpoNOBoi+geBIzCa:GFCsEOmWRa8CwN4ZqRo7geEk3IzCa
- TLSH
  T122A1A6B0D38AD363927A74C9EE4845B43AFF40B023705C68693C463167A8536D3B9CF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  Oringo-Client/.git/hooks/post-update.sample
- Size 189B
- SHA256 81765af2daef323061dcbc5e61fc16481cb74b3bac9ad8a174b186523586f6c5
- MD5 2b7ea5cee3c49ff53d41e00785eb974c
- SHA1 b614c2f63da7dca9f1db2e7ade61ef30448fc96c
- SHA512 473ad124642571656276bf83b9ff63ab1804d3c23a5bdae52391c6f70a894849ac60c10c9d31deff3938922ce83b68b1e60c11592bbf7ea503f4acd39968cefa
- TLSH
  T119C0C0C89D41F4105091114A003D44BC4E0B80416106083070744B1FE28C45F3F4FDB8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  Oringo-Client/.git/hooks/pre-applypatch.sample
- Size 424B
- SHA256 e15c5b469ea3e0a695bea6f2c82bcf8e62821074939ddd85b77e0007ff165475
- MD5 054f9ffb8bfe04a599751cc757226dda
- SHA1 f208287c1a92525de9f5462e905a9d31de1e2d75
- SHA512 cb78aa7e9b9c146e5db65d86dd83f04e2b6942a06fab50c704a0fd900683f3b6ad1164e74afe2f267f6da91cdff0b9ab07713e12cefc6f8d741b5df194f4fda6
- TLSH
  T168E0A3204496637340410059AF3561FC4F40C4CC83E2394040ED8BA9F62F5D461F9D30
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  Oringo-Client/.git/hooks/pre-commit.sample
- Size 1KB
- SHA256 57185b7b9f05239d7ab52db045f5b89eb31348d7b2177eab214f5eb872e1971b
- MD5 5029bfab85b1c39281aa9697379ea444
- SHA1 8093d68e142db52dcab2215e770ba0bbe4cfbf24
- SHA512 4fed684b7e262fc847610ca646074fca45c3c677c40d8fb6c7ae522b9c8a9be7327b41a59b4550ceadd41edf57ec5ed07e575e02dbc6c003951e1822ac3ddd5b
- TLSH
  T1B43161429BE0B535022043844A9EB5BAAF0796EC0331702A16D9C1ACF36D661A3BEDF1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  Oringo-Client/.git/index
- Size 82KB
- SHA256 55de64e5ed2a1779f52886b122917f84ec121d6b5ef3e8ab4693349f07eaf140
- MD5 e4e796f7f0e466595ecd0de144d5127b
- SHA1 eb8a397dd528f86f4f8ed05e6f211313d34947aa
- SHA512 dcf4d58c8e5246d4f3a871096fc055cbb2883503f7270deb30173b4cde6441982827cf65d3e63a240d4ca3135db894eef295104404944ebfd8e9d96a37eabf5e
- SSDEEP 768:J7WC/vgmOsZ9QDn+Ethb93A4OhyuLwjSmi1tlYc/GImDCwWcjxmUKkF3+:J7fHgm2hb9V8mi1tlYc/GImDrWhVQ+
- TLSH
  T1D1830186E1DF84BAF79B31BF42168FE53C3C05AD62AE3DB3B4E5515B406825083EB116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Oringo-Client/.git/info/exclude
- Size 240B
- SHA256 6671fe83b7a07c8932ee89164d1f2793b2318058eb8b98dc5c06ee0a5a3b0ec1
- MD5 036208b4a1ab4a235d75c181e685e5a3
- SHA1 c879df015d97615050afa7b9641e3352a1e701ac
- SHA512 9828c6ecdf91bf117416e17f4ee9caee2e1e37b6fb00b9ff04035ace17a3089b9d0a25c6baa1046c0e1c62d3da88838e8fca74ea82973d6b975905fde58f3072
- TLSH
  T196D0974BA3C8401461DAB0B43C4AF716A917C3310D24FA22A2F3C0C8415A3E801D92A2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Oringo-Client/.git/logs/HEAD
- Size 182B
- SHA256 a7d9c371326fcad6e779299b125cbdb767e17d75d63053b0f4c2c4e096b120de
- MD5 4f3a5ed825ba7acb57247691d4b73326
- SHA1 b7134918513a4b799ef404719adb66982cbd4d78
- SHA512 8d6d992c23a024b1cb0b050a12684496fe5e6c825fcbfd822dc310ffd1f3a64dbbc892db19a11943c6330b4ae190dc064980cc86f4d89eaf1d813034fabd9150
- TLSH
  T1B8C08C44208572A8CB886A90796830DA25283000A8E7A869896418054001C63AE8E299
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32