b1d56988692f04708cd81acf57067750bf66db8402f7a322b1cf51611ff05a9e

Login
Reports

Overview

overview

Static

static

OpXOyuApWK...um.exe

windows10-2004-x64

OpXOyuApWK...ed.exe

windows10-2004-x64

OpXOyuApWK...er.dll

windows10-2004-x64

OpXOyuApWK...ec.lnk

windows10-2004-x64

OpXOyuApWK...er.exe

windows10-2004-x64

OpXOyuApWK...um.dll

windows10-2004-x64

OpXOyuApWK...um.exe

windows10-2004-x64

OpXOyuApWK...x.html

windows10-2004-x64

OpXOyuApWK...ain.js

windows10-2004-x64

OpXOyuApWK...tes.js

windows10-2004-x64

OpXOyuApWK...ase.js

windows10-2004-x64

OpXOyuApWK...ses.js

windows10-2004-x64

OpXOyuApWK...del.js

windows10-2004-x64

OpXOyuApWK...num.js

windows10-2004-x64

OpXOyuApWK...tem.js

windows10-2004-x64

OpXOyuApWK...ums.js

windows10-2004-x64

OpXOyuApWK...nce.js

windows10-2004-x64

OpXOyuApWK...nal.js

windows10-2004-x64

OpXOyuApWK...ace.js

windows10-2004-x64

OpXOyuApWK...ons.js

windows10-2004-x64

OpXOyuApWK...rds.js

windows10-2004-x64

OpXOyuApWK...ypt.js

windows10-2004-x64

OpXOyuApWK...ath.js

windows10-2004-x64

OpXOyuApWK...oth.js

windows10-2004-x64

OpXOyuApWK...gex.js

windows10-2004-x64

OpXOyuApWK...ask.js

windows10-2004-x64

OpXOyuApWK...les.js

windows10-2004-x64

OpXOyuApWK...pes.js

windows10-2004-x64

OpXOyuApWK...ets.js

windows10-2004-x64

OpXOyuApWK...ets.js

windows10-2004-x64

OpXOyuApWK...ain.js

windows10-2004-x64

OpXOyuApWK....de.js

windows10-2004-x64

Analysis

max time kernel
899s
max time network
574s
platform
windows10-2004_x64
resource
win10v2004-20260513-ja
resource tags

arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
20/07/2026, 01:19

Sharing

Copy URL Twitter E-mail

Static task

static1

2 signatures

pyinstaller

Behavioral task

behavioral1

Sample

OpXOyuApWKTlFzrV (2)/Potassium.exe

Resource

win10v2004-20260513-ja

windows10-2004-x64

14 signatures

900 seconds

discovery

Behavioral task

behavioral2

Sample

OpXOyuApWKTlFzrV (2)/Potassium_patched.exe

Resource

win10v2004-20260513-ja

windows10-2004-x64

25 signatures

900 seconds

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Behavioral task

behavioral3

Sample

OpXOyuApWKTlFzrV (2)/WebView2Loader.dll

Resource

win10v2004-20260513-ja

windows10-2004-x64

0 signatures

900 seconds

Behavioral task

behavioral4

Sample

OpXOyuApWKTlFzrV (2)/autoexec.lnk

Resource

win10v2004-20260513-ja

windows10-2004-x64

3 signatures

900 seconds

execution

Behavioral task

behavioral5

Sample

OpXOyuApWKTlFzrV (2)/bin/Decompiler.exe

Resource

win10v2004-20260513-ja

windows10-2004-x64

0 signatures

900 seconds

Behavioral task

behavioral6

Sample

OpXOyuApWKTlFzrV (2)/bin/Potassium.dll

Resource

win10v2004-20260513-ja

windows10-2004-x64

0 signatures

900 seconds

Behavioral task

behavioral7

Sample

OpXOyuApWKTlFzrV (2)/bin/Potassium.exe

Resource

win10v2004-20260513-ja

windows10-2004-x64

2 signatures

900 seconds

Behavioral task

behavioral8

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/index.html

Resource

win10v2004-20260513-ja

windows10-2004-x64

10 signatures

900 seconds

discovery

Behavioral task

behavioral9

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/base/worker/workerMain.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral10

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral11

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/base.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral12

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral13

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral14

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral15

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral16

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral17

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral18

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral19

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral20

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/functions.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral21

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/keywords.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral22

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/crypt.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral23

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/math.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral24

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/oth.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral25

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/regex.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral26

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/libraries/task.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral27

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/modules.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral28

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/params/DrawingTypes.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral29

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/autocompletes/snippets.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral30

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/basic-languages/lua/snippets.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral31

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/editor/editor.main.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Behavioral task

behavioral32

Sample

OpXOyuApWKTlFzrV (2)/bin/monaco/vs/editor/editor.main.nls.de.js

Resource

win10v2004-20260513-ja

windows10-2004-x64

1 signatures

900 seconds

execution

Report Analysis Logs

General

Target
OpXOyuApWKTlFzrV (2)/bin/Potassium.exe
Size 14.1MB
Sample260720-bpna5ady5x
SHA256 b1d56988692f04708cd81acf57067750bf66db8402f7a322b1cf51611ff05a9e
MD5 898f1ccc777b0168f1d82b58e73741f5
SHA1 a2f283469ecb4a885b8e4003d91a19c0994b2a6b
SHA512 de5b11c903c4575d92a9065dcbdaed40ce114ec60316042fe817320048ef8da60ad6b888511e909051335bc009014c12c64333dcc895619a918251dad603c885
SSDEEP 393216://IP0eqrf28SGq/v/y5nOFuREMUeB+ou8T:HmGq3/y5O+B
TLSH
T163E623E644D421F4D8EB4B50B24A6BCE35E0A0AA49B9BD5D3BC11C434F32FEB4549E63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1720	Potassium.exe
1720	Potassium.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1720	Potassium.exe
1720	Potassium.exe
1720	Potassium.exe
1720	Potassium.exe

Processes

C:\Users\Admin\AppData\Local\Temp\OpXOyuApWKTlFzrV (2)\bin\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\OpXOyuApWKTlFzrV (2)\bin\Potassium.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x00007FF7B1C48000-0x00007FF7B24B5000-memory.dmp

Download

memory/1720-1-0x00007FF8B5310000-0x00007FF8B5312000-memory.dmp

Download

memory/1720-2-0x00007FF7B1BF0000-0x00007FF7B32CC000-memory.dmp

Download

memory/1720-5-0x00007FF7B1C48000-0x00007FF7B24B5000-memory.dmp

Download