7c6f5323a9178c72e72f00b588d295e7f3cf840311160a25035955c3c34b2831

Resubmissions

23/07/2026, 14:42

260723-r26w1aem4v9

23/07/2026, 14:16

260723-rlccfszhrf9

Sharing

Copy URL Twitter E-mail

General

Target
OverWolf cryptor.rar
Size 35.9MB
Sample260723-rlccfszhrf
SHA256 7c6f5323a9178c72e72f00b588d295e7f3cf840311160a25035955c3c34b2831
MD5 93c097187d5c52e35f9d32a6b73419f6
SHA1 97828fea9869a2d3a4fa92cb2fb112b1b2a5eca0
SHA512 421977186df979ab7c57ed72e36d06338627b7a5de4b828dd0e408ae1c94b79f5e22c7fc67a6bdb44f0fbddf84e7aec0643f5d1a1a5d5068ace8f656ce3066ba
SSDEEP 786432:KDHyAzyNhirLbk26x+Gwsb48pXkEMKb/Hj7DMRTbLgnE3Rvn7txZcz70H:myBfj6M4ohHfMHLbvZPH
TLSH
T1928733F8A78759C179319C4EBAABDAA4004B1D1F72B78B622AD6578181F1DD43300DEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  AntiDebugging.dll
- Size 377KB
- SHA256 8758099b848b222af582be74cbcf51fe32c1e48fcce9e253e2579ee262d10942
- MD5 d234238a1b487610207ba8c60a51dc49
- SHA1 fa1e1562360f284fae212fcb52b176c481c9e293
- SHA512 92b6a413b7e0670b5dbd1e87a0b373e8a46f21ca86e30ecd33cf87445b4a15745f837f6d5154c5eab390ddc1aed8b6b56b2925460dce618f6d29422f06b8ae09
- SSDEEP 3072:UCos+eAkaVVWGJjIo1vQnPfr6+6cYhhNnsPTjfvjUDgkaXQVnrK2Jx8LRBdM:Os2kaV3IaQnPjOsPTjfvjUDgkEQRQN
- TLSH
  T12684060BBEC4C936C89D5231BDC789FD252FAC31D413845E69FE6A09697AE417F12A03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Dynamitey.dll
- Size 164KB
- SHA256 db29f47dc1918253a36a09ff5804d14ddc81098ecf627e668ca617e3a0e2ab5e
- MD5 c5fa3518d32e1e5290113ac31f3bbc6d
- SHA1 3a735f84575d3e19408f2c0b60a032166cea51a7
- SHA512 c1c508a014501f558df21ca9bc063eee1aa117a9c34617e76d9cc88f7d2d1a348377446c1f997fdff3564fe1e1424f113e36f309822563cfa1b471eb4b909a9d
- SSDEEP 3072:RnLcuy9J8ZC/jpYZ0u+yegE1My1KnSe+Iev:pLcTJ8ZC/jp+09vG+Ie
- TLSH
  T1A0F3D51D2B5DA2A3C2BE8B716890114746B0C637F84BD71E46C4FDE63A077C4A744AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  FontsInstaller.dll
- Size 371KB
- SHA256 3c357e4d067d2c9322b6d4a4a691698913a76570982af561c6c9438832f42ccc
- MD5 5063ada08270d629a051121a8ecb4160
- SHA1 0e2d0391523fe5595c408507f7b80918bfe23552
- SHA512 d9eb54f867ca0796dad47e9ebc5c40ca055a0bea90868220c6ae6dc6ad4d863dab24e38f51284fb33d7733f8034c384c8044946c14d92553a7b3a0dd379ad13f
- SSDEEP 3072:BZSayK7cup8yzxJQKhopX4Etl8Q+/EHz8c/TzyGl+qF0HWN/InbBv8ZtSOQ9duOk:D7ccWXPETcr0qF06/0bytQ3uOFXA
- TLSH
  T192849620B015AD50C4F9CF7E494295B48D33DE77C1A6A51720F3B45B22AF792EB28A73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Guna.UI.dll
- Size 1.1MB
- SHA256 576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d
- MD5 8673eae95d67e5eb19f0eca3111408e8
- SHA1 ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb
- SHA512 65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239
- SSDEEP 24576:hUsmpWNSUFmCqJPNsTuJDYYviEcHy1t6Y:hSUQWSF8q
- TLSH
  T199356CD173E4C9C3E0A947BA501641DC0FB5C109BF47B35782A8A29C3E467A79E3E993
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Guna.UI2.dll
- Size 2.3MB
- SHA256 78e51511b28efc474e92d060dd5123343631ee7d3400b6c317a518412c3544db
- MD5 9fb60db5dbddc1ec521625d416b17aa6
- SHA1 7f1da0b32a51a59298afae41f14e0ae6691d46a0
- SHA512 5607c16a7f5e51e14e6b697e1171fbbfc7df84ea3395738935bc12a52b5ef7d769071d7d0cd241b3e2daab3bf0657f4f2411da2a3c2091a422287cca79b81b73
- SSDEEP 49152:dF1h+CUn8yaJS7YmLdxvOOuOi6oUdzt159QoFosA9y9/H8/qW5rwGxdfkowGQJDM:gbLjv9UMGTke41u
- TLSH
  T12AB59D1A36CA2F1AE55419F818541325E760C5623797EB0BE182F6B5CFAF36C0FC52CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ILMerge.exe
- Size 668KB
- SHA256 8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd
- MD5 2bb6322885e6ca0986206de174e842c9
- SHA1 c5ea70169106d32bc513d28ea76ae8ea1e49380b
- SHA512 9750180c54a5bd8f0e1fa8a8f529364430f2ef444efbf8ac51e8d2a0aaa4e3d21fe553865ba8567c7c19e4ae84d04b20464f391743e88c52c00cac0bf20fc2a7
- SSDEEP 12288:8E8Q+HlWx+TV7109nrRoTQhfL40+FQT7gWoi:hn+HQp9UQ2dFNi
- TLSH
  T111E44B107FE4D617D1BA87B2A8B3091457FCE046F357EB8F59806AE91C03741AD262BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Newtonsoft.Json.dll
- Size 679KB
- SHA256 72cf291d4bab0edd08a9b07c6173e1e7ad1abb7ab727fd7044bf6305d7515661
- MD5 916d32b899f1bc23b209648d007b99fd
- SHA1 e3673d05d46f29e68241d4536bddf18cdd0a913d
- SHA512 60bd2693daa42637f8ae6d6460c3013c87f46f28e9b0dbf9d7f6764703b904a7c8c22e30b4ba13f1f23f6cbee7d9640ee3821c48110e67440f237c2bb2ee5eb6
- SSDEEP 12288:1eos/POdGV5jfWrV/9Yeh9eRcyLfLYtT5mWxTZ/B7jW5JMtRRpKzQk:10/POdGV5jfW5VnhFyvOB7jW5JMty
- TLSH
  T173E4598563F88F6AE29F2B74B830490E4BF1F44AA6B6EBCF4404D4A51CA3755AD00777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  OverWolf Crypter 1.1.exe
- Size 35.3MB
- SHA256 50062d171fd4f80379d3a1bdadc1c4c6c4ac6a2640e708d8471f3dc9614e5ed4
- MD5 dea64aebd0b2051617afb8125de0d53e
- SHA1 b0e4a4b64505d739e8b6cf0cb19daf7f19934e00
- SHA512 4d8f781c98dcfbfb9a262127a8fba6042901a49e2dfbeab57212b2ae72930718840dfdbf20058b206c149039c19a8f7be4b13a5c9d8185e572664f2c93160a4e
- SSDEEP 786432:MfeJhmSTrKdgwppe+aJEe77zZY+HRzO/DPeZry7zd0:jpR+a6CJYGRzO/beVym
- TLSH
  T1418723FB794A6C12D789390100BADA52276EBB3396A02715D5754C0EF38AED93303E5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

agilenet costura defense_evasion discovery packer themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral17 behavioral18
- Target
  System.Diagnostics.DiagnosticSource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  System.Security.Principal.Windows.dll
- Size 14KB
- SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
- MD5 b40bda63658a012d46f930c243b77056
- SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
- SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
- SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
- TLSH
  T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  System.Web.Optimization.dll
- Size 69KB
- SHA256 321b29486a5c3195574552ad05dba2199572db3a3ba3952bd1ee768cc3f8cedd
- MD5 68abd36d1bc8a214214d4551dcda5162
- SHA1 72a420f9026890fc6c7f6f3a8050fd4dcf7e2d4d
- SHA512 bde5737d5e5bc81089ce89975a52c3f502b76d0b4fc6c0543e8edcc2790cbc55b48a9f8b522a0c87f98388d7d0533fe7048d79a10325f38b5a9c1f3e54c4c838
- SSDEEP 768:O7wHXoDClYMX6UYg2okay6kz+0TmzYJe+nxPDC0jrqVjSEd6BrQjLwnGUP5HpoDA:OwHMahf2o/BfYJZx7AMEdurKLmDiz8J
- TLSH
  T130636D7533AC476ADBDE4EB4B47051140BB6E6872C02DB7A5E88E09E1C777A00712AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  dnlib.dll
- Size 1.1MB
- SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- MD5 508ccde8bc7003696f32af7054ca3d97
- SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
- TLSH
  T1EB356B0177E9AB3BC49E837AD432091943F2D40677A3EB0F1654EBB92C837959C217A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26