2a667855ef58eb24977bdd7d7a26012df4e88688f12b420e0256d1ad7049bb84

Resubmissions

22/07/2026, 11:52

260722-n1ppjstgpf

22/07/2026, 11:39

260722-nr9ncsgr8110

Sharing

Copy URL Twitter E-mail

General

Target
Installer.zip
Size 9.6MB
Sample260722-nr9ncsgr81
SHA256 2a667855ef58eb24977bdd7d7a26012df4e88688f12b420e0256d1ad7049bb84
MD5 ac9110abcca4240bdab0f6fe8d84f2ce
SHA1 15f909d2a5ca0bdc226d5d5e4cbf33df514fd4d9
SHA512 1a3871d8ddb7fbcb94fcebfeb294ca9868afbbac3977bf05d0cf891c6cd7437fedd7993bc90ae4d2f0dbf12630609e4ae71c1c9a82cf1b19b7dee1cedfd1cf56
SSDEEP 196608:SEXl5YA5ITjg5JhxZ9Fttx/nFYQkaiXzYTqAec6H4jS4o1Typ++41wdV:SulaAWE5TxLNlcaTTqF4os5BdV
TLSH
T19DA633353B954CE797BC61F08DE0E74299DE3DA2043EA6C240573516DEA4FA9CCEE980
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Installer.zip
- Size 9.6MB
- SHA256 2a667855ef58eb24977bdd7d7a26012df4e88688f12b420e0256d1ad7049bb84
- MD5 ac9110abcca4240bdab0f6fe8d84f2ce
- SHA1 15f909d2a5ca0bdc226d5d5e4cbf33df514fd4d9
- SHA512 1a3871d8ddb7fbcb94fcebfeb294ca9868afbbac3977bf05d0cf891c6cd7437fedd7993bc90ae4d2f0dbf12630609e4ae71c1c9a82cf1b19b7dee1cedfd1cf56
- SSDEEP 196608:SEXl5YA5ITjg5JhxZ9Fttx/nFYQkaiXzYTqAec6H4jS4o1Typ++41wdV:SulaAWE5TxLNlcaTTqF4os5BdV
- TLSH
  T19DA633353B954CE797BC61F08DE0E74299DE3DA2043EA6C240573516DEA4FA9CCEE980
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Installer/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  Installer/DW/README.txt
- Size 544B
- SHA256 7f022910960d0b0b59a8c34cc6aa8ef2ab6b3812556edbff37c705ae84f9e7b3
- MD5 cfaa8fa0af14238d62ad14cb3d6f9a98
- SHA1 4ef6bf9018c513f6a1f1c950e77b75aceb1709d4
- SHA512 e087d62af3569ac6cd6b02b843e4d3281a04fd9dc2e2f540c67a436ef99c8c14071945eca3b0fa87fa4dc38125d8f966d649a39c339f7d96efef1c45826686c4
- TLSH
  T173F08B0EEFCFA6B21501E7926B4DD953D208A43C93618DF45835217C61703B46AED6F9
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  Installer/DW/dw.exe
- Size 3.5MB
- SHA256 4184828eccca015560f315b8fc85212978a0304ad4d0a629a022a90f703d42d9
- MD5 6fb5a26d842ffd589c6f546fa887c66c
- SHA1 cbd9084d33f191b0801b6d8ba139199ecbffd759
- SHA512 b9bb8ab2a18f1893d06397e57a6c23c78d721c7b3d862d4adfff22ad14f3b2ac86257042a2204d11c3e172330348609d4fda46633f86d272abdc557df2591541
- SSDEEP 49152:R+uWQeeN05SGa0ylOftAh9LhA3bJEynpTRsqXiu7mVCMxeA:Rgxyl4ES3bKynoqr0/B
- TLSH
  T154067C07FC9149FAC059A33289B39255B761BC091B7277D72E917B382E72BD09C3AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  Installer/Installer.exe
- Size 3.6MB
- SHA256 16e96c9e7ee33c498000534883c78f0e14bd5bc650885e5ade76247ca455e122
- MD5 9f48e0765e3bd7ffa07759dc66f80c69
- SHA1 a77997f3d8498a3ed9398f1cbcf8d9c0fe65310a
- SHA512 742777aeee37d5d3f0277e4c863fdfa80bc8e69e8a7ef8429cdd9d0db2b37c1f57b3900883102da849c18403f0d2369cf80b6762c5f305c292b05de8b34bf084
- SSDEEP 49152:BHkUp4Mq+wKghfvSZOlZo0eDLKonAs9luiBxPJJzYbDCoZ2:BtqUnvmQhPHaD9c
- TLSH
  T1AD067B07FCD248E9C099A33189B38656BB75BC081B3277EB2E61BA782E727C05D34755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  Installer/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Installer/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Installer/config.jet
- Size 697B
- SHA256 7ab308abac85601d348005bbb7032c92261fa25c782a712f1b0482bd85845ede
- MD5 53a9cdbb5470cba6ec4fbafdf7ac618c
- SHA1 dd8600c6f92b975ce54f300ac854abbdddb96559
- SHA512 c501cf9bbce1186e42352612d60c1f41699c0e297bfa93a6a91ad586b8f09fcd81b00b67ca1cc52a80a227d29750739ec56a8b494fe3f679ffca0c797ccec02f
- TLSH
  T1CD0176308A7D243C430CCEAC3D62EB5AAA7C020F5784C41FD56D8EED1BC00A159D7352
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Installer/data/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral17 behavioral18
- Target
  Installer/data/Localization.json
- Size 8KB
- SHA256 0ed2630f4d0450117719a6200426a1e1b78eeb9b100a0fb8e4cc10b7995e3aa2
- MD5 53efcb8e8d93ca156a3962254cde417e
- SHA1 dca16a76e1345958a33cc09d9dbbf080adc0aead
- SHA512 63fd95544513f9f6716d39c5e9d732fb2b30927e0e43717846dcc1d59f80e5dd31e8f302d169f7d5f3a7d897adf264cab22b6e610f35409968b3a5b04d5f4fd6
- SSDEEP 192:Q7WjQPr8cHgeaxcE57vTQNZfl0RB7vTQNZflBa7vTQNZflhWhN7vTQNZfl1B:iXrUcIspERspBAsphWhdsp1B
- TLSH
  T1D9020114FB401CAB822261A16405FC1774A901FFAB29B7FF764C811E6BAD02ED477AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Installer/data/eula.1042.txt
- Size 17KB
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH
  T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral21 behavioral22
- Target
  Installer/data/eula.2052.txt
- Size 17KB
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH
  T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  Installer/data/globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH
  T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral25 behavioral26
- Target
  Installer/data/kernel.bin
- Size 518KB
- SHA256 952ca2531233f5993cadc72e6396983d96957a435c9b78a568dd8ff4fa9ca4d4
- MD5 d9b31471fa5f562bf746a1fd1f07094a
- SHA1 95a381ad0e3aa296aa0545ca5b86cb5ca96924b5
- SHA512 af2c1f585001ae50bdb1dd0d407eff25fb0b4bd3c98c8c07da873afedf7aef3b75c4757d583616a666154b2911be3744a4c358a4c20afed24241ca82be48952c
- SSDEEP 12288:GEakMQ33cCxTWI8W8o9hMCiWIUdJWz3L1bfQmudC4WPgHGwgQ3piVnMlPs2n6aJk:3aDw3h9/xZjM/dkWzBbn0rGwgQ3piVnx
- TLSH
  T1EDB40E68273B0BA5E106ECC554921C03DF54A39633BEDEF19F579EB60350CAAA4B4CD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Installer/data/overrideAutodetect.lua
- Size 162B
- SHA256 817dc1b1f94ab2bae24edb81907f0ef36a00631563de9e47b2263d2c23958db9
- MD5 a51d997e849f796e0df777cb67f2f3e7
- SHA1 7f59e9422d976cef13ebb588c62e28f5e4b22dec
- SHA512 581d26ad578ef711a03dc9f58e90a946e3000021907f3d1a118c4f6caf89038cd3ac7303448768a735a0a7e3d53c1edf4945e992e141c90cdc4b04509103de1b
- TLSH
  T15FC08CB09736B9280B1BF7B7EC022A0604F0E81A01A7242F1350008C5A00F69A42AC1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Installer/localdata/ALI213.ini
- Size 2KB
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH
  T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Reads user/profile data of web browsers

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32