41a41c7e294056c8d440883e7ec87127483528e9c3b41d571c9d9f8c77479f51 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

MTPdrive210.exe

windows10-2004-x64

8

MTPdrive210.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...an.dll

windows10-2004-x64

3

$PLUGINSDI...an.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/IsVM.dll

windows10-2004-x64

3

$PLUGINSDIR/IsVM.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/SR.dll

windows10-2004-x64

3

$PLUGINSDIR/SR.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$SYSDIR/dokan.dll

windows10-2004-x64

3

$SYSDIR/dokan.dll

windows11-ltsc_2024-x64

3

$SYSDIR/dr...an.sys

windows10-2004-x64

3

dokan_mounter.exe

windows10-2004-x64

3

dokan_mounter.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
MTPdrive210.exe
Size 3.4MB
Sample260723-pp9e9acm7w
SHA256 41a41c7e294056c8d440883e7ec87127483528e9c3b41d571c9d9f8c77479f51
MD5 3461018c0008cb0e36204add2458f915
SHA1 6277f554a5fd3fde7e0f3c02cba043ec054b27d4
SHA512 756a662206aa58912dcbc22ba550a2dba77e90331dcbdd4b5ec223690e3de6d3d1bc276aa750e4749d4ce8b5eb5c005d8c03a9ec6c1efe2b3f5d778eab8032d0
SSDEEP 98304:1zv0WmjN6jJ1su9m1NF/j/RBw9UBJ/c+mD94uI0C7Apquq9:FMWmjAXDmR9BJ/c+mD9Kaquq9
TLSH
T196F533C132D0EC93FA3EAE32E4F3936D4A38E421EA8D53A6DB533DB6D900712D156495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer ransomware

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

MTPdrive210.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

13 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral2

Sample

MTPdrive210.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

13 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral3

Sample

$PLUGINSDIR/GetWinVersion.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/GetWinVersion.dll

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/IsDokan.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/IsDokan.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/IsVM.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/IsVM.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/Registry.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/Registry.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/SR.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/SR.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral14

Sample

$PLUGINSDIR/System.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral15

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

$SYSDIR/dokan.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

$SYSDIR/dokan.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

$SYSDIR/drivers/dokan.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

dokan_mounter.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

dokan_mounter.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  MTPdrive210.exe
- Size 3.4MB
- SHA256 41a41c7e294056c8d440883e7ec87127483528e9c3b41d571c9d9f8c77479f51
- MD5 3461018c0008cb0e36204add2458f915
- SHA1 6277f554a5fd3fde7e0f3c02cba043ec054b27d4
- SHA512 756a662206aa58912dcbc22ba550a2dba77e90331dcbdd4b5ec223690e3de6d3d1bc276aa750e4749d4ce8b5eb5c005d8c03a9ec6c1efe2b3f5d778eab8032d0
- SSDEEP 98304:1zv0WmjN6jJ1su9m1NF/j/RBw9UBJ/c+mD94uI0C7Apquq9:FMWmjAXDmR9BJ/c+mD9Kaquq9
- TLSH
  T196F533C132D0EC93FA3EAE32E4F3936D4A38E421EA8D53A6DB533DB6D900712D156495
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery ransomware
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/GetWinVersion.dll
- Size 43KB
- SHA256 e1fd50b544127688a24509b3e3349669067a857d174875842cbe820e6b1adaff
- MD5 eb7a6b6702e9379ba963d0f0e4aca737
- SHA1 e42d759d93bc9b4178b97f675f2af233a0de22ed
- SHA512 6936eff08e07dc68229a5caebc3eec6eee804063bf2a2ac7c1deeaf57e092feebf4137f861307acc7489c5925f9bc9afd7f18fe082f8d69c2bb1805a45ac888e
- SSDEEP 768:YxnMWsozvbHB7WOJ6Q/oyGI6BJ6zNphzOQJUkJ:YxMWsAMe6Q/9GI6BJwTOQLJ
- TLSH
  T107136B113591C0B3D54A8279155ADB095BBFB9221BE494837FFB178E9E323E1A23F306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/IsDokan.dll
- Size 3KB
- SHA256 b97e29e5b441ac2c17021afecad8544f19a0b5de523e6f865eb37137cb257d0f
- MD5 b6996bce4ed7a4f544aca3a4fad844f8
- SHA1 941a5088f5436aab1f8975de1c1de0f53b337926
- SHA512 63303d2ff50268a2e80b06b7296b2ac21928700c05d6d2a176247839981787121e3842a7c12ebd754c3ed76df9f790d9075a5fdc5bb4f753f6db8498a620b4d7
- TLSH
  T1F6515023C3C808F2D04807F564D3097672BB872403E308CC4D86A12A3822B577E75E3A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/IsVM.dll
- Size 4KB
- SHA256 ccf52c19fc3628b1437584c14fdfb4f8bf1a9b86cb99ee4dd6feca46f9608dd8
- MD5 51e2f871b45ebd38d6e07d4a26e35db5
- SHA1 c387635d34e1f497f85417eea5f38b335d0eb681
- SHA512 bdea9f419af512b347d79b161ad19b0bb1f4de369800635624513c728efe7d96c8756073d23191d0ed4fd573d786ac06b7d5c30cf1beacf7ea828f47ce959f86
- TLSH
  T1BF817233F7A242F1C1C843F929A7566EB33D259017A484DB9A89573EAC304C73C35E22
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/Registry.dll
- Size 16KB
- SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
- MD5 24a7a119e289f1b5b69f3d6cf258db7c
- SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
- SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
- SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
- TLSH
  T17B724B4ECFE098B1D0EB283D75932E0F8A7BDC78251928A251C72CC1155D6A7336F7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/SR.dll
- Size 37KB
- SHA256 ae2d77b9417c14a00eb32299cf1a9d75efc3d81ba9755f28aded9070248656c8
- MD5 e352416e1787148ed042bf25a6327567
- SHA1 2e7fda27d0d0f6109b186d8e13d4273fe4543421
- SHA512 4741d0876f8ee50ae87b4440c4c8ca27c601df6355bd49a38765e0cc572efdcbb8ec387e902af56b8db61c6675c6d858ac4b8e7ed7c49e7ded796e5289c7f9f3
- SSDEEP 768:2VJ7pRVLj1uVXyYPba5K80cUy9HScH4epeRlL7:a3UQS040Il
- TLSH
  T16F036D21755184B3D28685B272A2DF265A7E7E3007E21443BBF72B573E306E4B232B47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $SYSDIR/dokan.dll
- Size 313KB
- SHA256 0f0b2b1649963f5bb542fe57e23cf2e9210eed3d4b071f4b33154819264ca6a2
- MD5 1829ffc16be161f8059748f25d20d32a
- SHA1 e8963761e247b2c050e826ae59c57a3642ae6f91
- SHA512 cea53090e3d465936f4db5172b9a2ed4c8fd3c8285bba5f16e3f0aa84424566c4656f6568db020b00e08a9f5baa3798d99e3e6da802691097ed64405014449d9
- SSDEEP 6144:S+En0XXkfRD431tL0k6ONEo7qpOfN2ca/Vz9627kv/P:SxrRi1tL0BOqo7qpOkJVkskf
- TLSH
  T167646B1179818032C27B383166B9E5B24DBD78311E349ACF9798087D5F785D1BB3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $SYSDIR/drivers/dokan.sys
- Size 45KB
- SHA256 31b508dcd109182b7a2fa5c7fc4efac25d82a5297fa10151bd32ae9dc7376e95
- MD5 6a3740165e1fb710ac4d34e97d338e23
- SHA1 0de8376fb84cdffff89509d6aaf5d3ecd02a7d1f
- SHA512 8a3cadfa60381b417e50f32cf491ba3102f1ee7cd3a7a82c1157632171d0564dba556da69e257aa6c454d327986cc0a9deae33af0b1655c55c97edec07f8784f
- SSDEEP 768:oU38z7Y2XNrOJWTzV2RMLTzk97lkgTFJ9XBLbCGLWlFecYQhk8GmBU:J8Y2X9OJezV2iLT+7dZpbCjFcQhACU
- TLSH
  T1E0237E623DD08CB6F3E3927058BDF661E83DE7A11E05926B730C4EB55EB0B91A60811F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  dokan_mounter.exe
- Size 120KB
- SHA256 27e0bb2b5be387aebcd18dbd93b27415525a2c386f8963f7a9c1b37d8d86694d
- MD5 ba20835340db6fd74023e38ba4374e5e
- SHA1 405b81019d1b902c506aff37951cee613db4cfb7
- SHA512 941967743a5ef801ab9072e4f67d102ebcc0606c757465719b13241c76676609297d563607d3ac00d612a305fc10556fc3123452ed94784cf4043a2219a0edb1
- SSDEEP 3072:lloqGc+75RvLvXx1CXoF9sGM0sYpsKSl8ylWcVM5VK6uvbe:llorc+75ZXbCXW5Mpje
- TLSH
  T19AC38C1175D0C471D5B22E3045F8CAB14E7DF9700E348AEBA398127A1FA46D06A3AF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

© 2018-2026

Terms | Privacy