f883e4ccae1e704bb1f67262c241b19c9fdde57cd3d113dfe982cd61b2063f64

Resubmissions

20/07/2026, 23:28

260720-3f9xbagz3q

20/07/2026, 22:40

260720-2lt8dah16s8

Sharing

Copy URL Twitter E-mail

General

Target
Mythfall Odyssey.zip
Size 97.3MB
Sample260720-2lt8dah16s
SHA256 f883e4ccae1e704bb1f67262c241b19c9fdde57cd3d113dfe982cd61b2063f64
MD5 a2676121728222cb8a34bad66ad3b77b
SHA1 fc305e08159be5894166c980151976de56d4ebec
SHA512 82f7535fad3fa98c5e5a6bc439ef4eed6839a7ccb40cb00d72910207ab8f24e242f2df29228e5dde231f582929b6efb3f244f0a87b0e845c14e4b3ffa714ee82
SSDEEP 1572864:j3gxqhmn7OeZI55gR/zoHJPzQdL0r8XflZkqDGwMnI5mlcMjhdaOua:rYZDroHJ7QdL0rwkBIYlcMtdea
TLSH
T10228331CD0B60CFB91FE1939A651EF50028732F42F75ADD743AF2F7A3A205606E26A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Mythfall Odyssey/Mythfall Journey_Data/Plugins/x86_64/Rewired_DirectInput.dll
- Size 104KB
- SHA256 5b97128066e2470d16b0cac708a7a9e8c95376522f16333a4455429cb17c5dca
- MD5 b6c717f623facadec79613ee3cfc6244
- SHA1 92a9613125af3280eb4c926eca22d3f876f9a0be
- SHA512 f096c1f220767976b8c69f38ada97a6806fc1e465ee1ccbdcbb8b91521d92e8af3f29d55ace9171ba065f164b2b353ade524dffa4ef82f12435fa102a4c7eeb6
- SSDEEP 3072:cX69UZY2taiItgg6PJ99L14v7QoKwRC4VwhgDlhb7:J9O8tg1PJarDb
- TLSH
  T158A33B1773E540BBE1779274C8A30E059772B8520725AFAF03A4465D2F277D09E3AFA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Mythfall Odyssey/Mythfall Journey_Data/Plugins/x86_64/Rewired_WindowsGamingInput.dll
- Size 149KB
- SHA256 946478c5e8f61cbe75c6d70e3aabe2766126605cba45ddb579a5ef38fb198e98
- MD5 4098ce29c5ea622b0ca8b420beacc87b
- SHA1 125078bf0ce9e876c9e974f611b864cd6f63737f
- SHA512 5ff37d531a5a2a45061cc43455fc6e6d8e7b87477c047bda8f249063d88cad5327fd83fd277d4b7cf88d9d8ff2a931fe40f3b392dfb624be0b9db12414a6b0a2
- SSDEEP 3072:/wQMc2bFa0gAQfngyVfi+nU7b2iIwOqdtfc2KlMUg6ASIgKsLogtMCkHTdRKY+00:1Mc2bFa0gAqngyVfi+U7b2iIwOqEXWg5
- TLSH
  T1BBE3394772B501BBD1B6D23888930A58F77278614B618BDF0774432A1F277E19E3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Mythfall Odyssey/Mythfall Journey_Data/Plugins/x86_64/lib_burst_generated.dll
- Size 265KB
- SHA256 b3580f236ec7a441c52c9d27dd548e60c0f17fb4ed3a8d83f70a9bfac46bf5e6
- MD5 6a2ca1e85a9381056e1bd20d4f8db5bf
- SHA1 7fe68922c2a136ee8312609aaa7803bb352c6124
- SHA512 1561b53d2972670f7add13210f99f9fe279153f7fb81b397edd47e591fb787b180f3417b7d13f7fb3dbaf67f983aaa0b33a5b3f356bfbcc844dd89f0d3cff9f0
- SSDEEP 6144:dAQ+LFeKP0ifdsb18rfjojKy4WGBzaEjyE93iW1:qii1sJGBzrD3iW1
- TLSH
  T180446BBC218768ADC12A8470463EAA67B5633C0613C44CF714E154BA3EF5DD7AF7C92A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Mythfall Odyssey/Mythfall Journey_Data/Plugins/x86_64/resonanceaudio.dll
- Size 797KB
- SHA256 e1667e5336ae067ab1d9aa04e7bcca9789ff5573ed4c7f6fa9305404d0485f99
- MD5 ec140d6d301e44742a271a7eee92e213
- SHA1 ed206f4365131f64ff140a393513806dfa5081bc
- SHA512 9ea039990be0c9579933ac0f6c43b83d2457652fb61d761850cb3644cf1842a419f85d0879238a11e93e82fc9c9483a306227e08f7acaff92ac50ead2649a526
- SSDEEP 12288:oqzaaeCi6jAY5B7CehZhfEpEQulB/NCCS2X+pon8NGiV7m7o/t:oqzaajiOAY5jhgyL/NCCS2X6ySZ/
- TLSH
  T10D057E05A62D86ACD036813884679946F3F37C494B609FDF53E04E6AAF2F7D0367A6D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Mythfall Odyssey/Mythfall Odyssey.exe
- Size 82.2MB
- SHA256 d5e781c3314d88cb8e38bc251e407d6c511407a9587d2395ff8efe8434d8bd20
- MD5 06070ffddf38834b6e552f06ce614bfe
- SHA1 255df4eefc74aa74b808730e35e805c3630730fb
- SHA512 910b6ab172de2298fa9c06f83df31a14e60674ca021de50aa0d1cc790675a68cfc32fd44eaa839e0105c8f0edb90030ab74535de185d6482bf6fc24536891d0e
- SSDEEP 1572864:kiaolwy18Zoj3Of7LqFdzLcBdyNyB13jSQDOqUx21x:kiaDrPqFdncBdyNsS92H
- TLSH
  T1BA18335CD6760CBAF0FE9C38F241EE610347BAF81FE598C6536E2A2639718751AF1508
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  LICENSES.chromium.html
- Size 11.7MB
- SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
- MD5 0b24e08f0d1dac2ee54364e50fef0b41
- SHA1 a4f3ea66556cdcc2e92bc924965e225488ccd94b
- SHA512 2beb14f31a87f0df953af26945288f35e916159b114ec1c205c3a58125fa6911b888c2a0b17b593c5b2bcd8e51012d8f2cbe4629f1968335ee3866a19712dfb9
- SSDEEP 24576:S9dQL6poq6jBCjK6D3UwRmETlmfTKjZ6ojK6QjZ6UjK6ajK64jK6cjZ6ijK6b6ck:SvPeGAyWPbX8meu
- TLSH
  T1CBC6A52F7B48037306C642A26B8B65CAF31F903F3B561654345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Odyssey.exe
- Size 191.9MB
- SHA256 2fa4f317ec84a5cc33c2c96bde803d419a5c90592ea30f27ff20a2f984fff38f
- MD5 b1996c0b12dff00a395d7ad967b3fea3
- SHA1 edea600637bb5ea2445f73abcea276483627084a
- SHA512 5d5cb55fbe141528e9b99c10983cc9ef17bcf1c860e4f6bef20e85862850583d3da1a0858d78263cfdce86d33d5075bdde3e3f41e1d4dab4c7a0188925c96914
- SSDEEP 1572864:uhqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709x5:TOMMpBKvPTJJlf
- TLSH
  T164A88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
- MD5 931b7dbb1b27b4ff0ac5cd6cca485c1f
- SHA1 22578fcadd0fa4b1159dd721c2d8dc6bde89c07e
- SHA512 c5f19baa9de5502c752797fc8a488ac4b85bcd1325968a88461b25844fe36b313560c454cd2849bc48b7bb67724d2f1dbfa67dc7ff0c21c34438ffd0f9da56f2
- SSDEEP 49152:oJ2o28BhFrhzXIbk8HV22QNPa12wLOA1AdL10SApX7jCf1Xh/+Gk1ekxjGsDefo9:oCWFrIb1HV22QcSAZ7jCf1Xh/+Gk1ek5
- TLSH
  T151D5AD07F6D6109DD029C070979F9213F671344A8B205AEF26D05A243FABFD86E3E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  libEGL.dll
- Size 481KB
- SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
- MD5 46f2bd2a1c312a65e09ecd1d04e559b6
- SHA1 6b071a36ed51b3829da871ed2149abecb22ee6fc
- SHA512 ae082bb8d6d161d185a8d5b1f4fb20b020e73e9711688b4ef7c9dea610206ed5a95b2b2691db68725d38760aec5a918c89a36e94c61651e31cafe59407f77818
- SSDEEP 6144:5qQPf2bILvlflS9XHaT9ZrgDUypbrzi4uBcFObfckF0fASM9:x2q49XHu9ZrgDVVi4nFObfckIAH
- TLSH
  T17AA48D15B3E544A8E06AD1748A534642DA77B4920F65FBDF03E493392F37BE85B3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
- MD5 3fcf2af2ac606196af5b362f6b9c9470
- SHA1 6f17c685b886f98141d10d1c8190bbf8db232b71
- SHA512 69da96f6bcaa5685dfe372ba461d015be428deddc6a687415c90a0d12c125e6b0cca514bc9518f9d2c44886eca43f9f2624e07204757dbc6ec907dc657675335
- SSDEEP 98304:/XQ27zNwptqCK5M8twgfM+P9hKBswndb1GXJij:L7zEwPP90XdQi
- TLSH
  T1E8868B03F39A40D9D04DE2B8C7579626FA35B8850724B6CF279413292F67BE0EB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/bin/win32-x64-133/dpapi.node
- Size 126KB
- SHA256 9da75b2e77ba1b383e9573484431c31993bd8a13c9456e7ad5fbefdebbf28e2f
- MD5 5208a01234bf613e8e9e8a44cf3bbb65
- SHA1 479e10e964f988e99b61f5fd94d62a9372a5a000
- SHA512 27dd34df683582d7c2a88c8b14e227545e5b9ae3dd1dc5f97b4dfc422a43968e7b455611f63b89c4c7acf0f2377add30c21b43769e2215ec6af34beddfd44641
- SSDEEP 1536:MqOWzpju8EFHYBFSOS2kubpmSae62pA/vtKntBMJhLsW8d09dluAWh5TQB9+u:OIpS8OYBF9S2ZbU7qpA/vt8MwM89TQ
- TLSH
  T18DC34B57B2A840BBE0778278C4630E15D772B8214761DBDF07A4465A1F237E1AE3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/build/Release/dpapi.node
- Size 126KB
- SHA256 9da75b2e77ba1b383e9573484431c31993bd8a13c9456e7ad5fbefdebbf28e2f
- MD5 5208a01234bf613e8e9e8a44cf3bbb65
- SHA1 479e10e964f988e99b61f5fd94d62a9372a5a000
- SHA512 27dd34df683582d7c2a88c8b14e227545e5b9ae3dd1dc5f97b4dfc422a43968e7b455611f63b89c4c7acf0f2377add30c21b43769e2215ec6af34beddfd44641
- SSDEEP 1536:MqOWzpju8EFHYBFSOS2kubpmSae62pA/vtKntBMJhLsW8d09dluAWh5TQB9+u:OIpS8OYBF9S2ZbU7qpA/vt8MwM89TQ
- TLSH
  T18DC34B57B2A840BBE0778278C4630E15D772B8214761DBDF07A4465A1F237E1AE3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 1KB
- SHA256 3043aeba077d86d8b2e7fbbd6e1ecc3438c65ab184a2bda9fa0179976c5b0170
- MD5 526095b58d1cf0113586690f4e449a40
- SHA1 878de5a556f1d56afdc1eb9e1eeeeda6b23bd7a7
- SHA512 000db3def9ce5a4cc615fbbd57b2b8077bc25e04cbb34744293ab18e89be1f6534c564d3b8d2ae3d515f6ee5b1c6b003a8601a39071caeba93c5cb8e5badb16f
- TLSH
  T1A121AC1B2BB19C76C223B1C3161AD412AE61813B2E19EE1D7B5C43EA6F14450FC82BB8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/@primno+dpapi.node
- Size 134KB
- SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
- MD5 5dc8861862329b3b4122314922be3ed9
- SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
- SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
- SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
- TLSH
  T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.8MB
- SHA256 5d50e3d6f5e0ebecf18c1e0165546a614cf79e27bea835d766fd21c49b49357f
- MD5 1f5fe02b009d743a697a2a6e674f82b6
- SHA1 13a9aab96610f3bc94736d6b38c11efe887b82c6
- SHA512 debd6c6ee67de6dc04a42511e45ec81f2139cf1799d15b72aa5c84c198f31925a36cb0b5dfc10d4bb1a43864f863e70c5649635b96a867c8caabf4cda9aa5d6a
- SSDEEP 49152:9oTd8/5HKzPSLUOvrVKvYtyN9YteBpdukBYzdVtKGEcNyT:9md8/5HKGLUOvrVEYtn9EcNi
- TLSH
  T1C5958C4BF2B400FDC1A7C0B9851B160BE7B6B40517749BDB1594CA6A6F23FE217BA324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32