68d2db082d9b04b6af9f12fac373704e437a249b92c2dba5260dfd2090fd095c

Resubmissions

23/07/2026, 20:33

260723-zb71davvby7

23/07/2026, 20:20

260723-y4gs8aar2v7

Sharing

Copy URL Twitter E-mail

General

Target
Lousexcam.zip
Size 78.9MB
Sample260723-y4gs8aar2v
SHA256 68d2db082d9b04b6af9f12fac373704e437a249b92c2dba5260dfd2090fd095c
MD5 fee63d5bd6adaeb9a35104cd6eb4b0f0
SHA1 619c38f539c67da0875e8d5c69a60c00ee13b54b
SHA512 049e01224bc2f630101e360025c41d510a8438d650b5e70e30256aa89a3bc47969b2be21d78141a9f308c3dfcccdd5807a11af04cadfca53699d652e5a31ea32
SSDEEP 1572864:moM5n0qhlKG/aLPEuEnxG2whxn86q1LbZQdkHbyMgUhquvYL:moA0Md/ajEuZ2Y98X3wk2MgUdvYL
TLSH
T17B0833C9914E7C529479E0C533EE9FBB23CFE5C80508F8941666ADBB30AD364BE56318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  LouSexcam.exe
- Size 78.9MB
- SHA256 ebecc74ef2780775446526931ba911ec1e5c5230cfd1aa2002ead8dc9bd3eaac
- MD5 a003a393ed54ef869f15c2189db0cc53
- SHA1 77a51f814b114963764bcc11e3d0f31a7b2c9778
- SHA512 93a1a650ab423554ec2a6cc6d73dcc65c91fe7a5234a11c3346170c2820d0f29fa573c12363676d63d1686d48d309b773da3324db60c76d3edbc5a9de0dfb00f
- SSDEEP 1572864:84gPXMorFHkTbCztAq23VEg0RB1SIcJT3DKJS7tu+0qVak0k7:84AcoETbCpAqHgy3SFLmSE+0qZ0k7
- TLSH
  T1E7083399A10E7C12D47AE0E523EE97AB13CFE9C40518FC84166ABCBE30FD354AE56314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LouSexcam.exe
- Size 164.7MB
- SHA256 83cbd81fbfc2369dfa677042a86d9915fada7aea637aac254c5209cb439d041a
- MD5 172178732824e6b5ffdf93ae10b0c1a8
- SHA1 87175806731ebfdbb62d818fc64345f5cf201eea
- SHA512 085c157688599299e6cb55ff5f229eae4a74292d2b9ef12f27a97aea10226952ffb3bd8ea19bfbaceaf4ba61833d20ed140594dad5fd805d50241a1c61eef9a5
- SSDEEP 1572864:w3OB0RhDP7igv6wO+HkaN/xtpj56BZWua2T3jC0gqhd07YeRt6C1Bd1jKoUeKtQ9:APvt1x2z5m7jN
- TLSH
  T1C0887B03E29650E9F09DD1B18B97863AEE72B8460729A6DF175417252F37FE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral7 behavioral8
- Target
  resources/app.asar.unpacked/node_modules/@img/colour/color.cjs
- Size 44KB
- SHA256 f7c3efcf482624007f2019fffee3e1dec56b8cb893faa9a420b2832805888dce
- MD5 fadf27036e4867ef68b926db250c4055
- SHA1 82e42ec32823223fb0b732a14ca166ec86969f80
- SHA512 24b7b8f29a9971881931989d4e0b4f9f9506e502098e79b7cb25a01b8862ee25edb38eefb841fc2c2326975b6300c3b2d366443fca069c2350636136f807045b
- SSDEEP 768:NsUrIflE9Rw3q+FWAb93N0VZbYEYqSgqfbHC9zdrSMtMVyFVhy/Dgbzi5huG:NsOAaiA9z0MtWC6
- TLSH
  T1A813845865F658064317F0B81A4BD824B76EE503305EEECDBA1C92502F8E4A5C2F7FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/sharp/install/build.js
- Size 882B
- SHA256 37f7c9591d75dbc5fe734c5a196a46c355b3d7de5134260ba011efed8433a718
- MD5 804646c5651fe9057989fd3f91d28253
- SHA1 3f99d5243e0d44b5ce1bc7e72834910c5e4a5bad
- SHA512 1b85350efcfa50a619b4fa740d3eee0eb8e60804f45d099306f8a3daa121c4ffe2fac71e1d8103a98db2bf47296001ad389f86c6333d3bb644520c980b97f659
- TLSH
  T17B11569B409F547F2D330CC7C0176A23EA2AC284534D8668C67F03873B6A29A40F3056
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/sharp/install/check.js
- Size 383B
- SHA256 31fd360ede9ff3e80d643faff6c4570d0b2b5c621dc421b6c4086dfe86ce981f
- MD5 03db44a15054520fa3a63dfb30c43af6
- SHA1 1de2238c09673b155f8efd23a181f952d297eb7b
- SHA512 e89f0a7f1815d7ed8a5882ce993e2978c6ef8bf496d06a87c82d1493c73a1477210f813c3375533f488b628a40911eefef089c2f1f3f2589e03a2c01ef633eb2
- TLSH
  T1C4E0C0EA89BC165039520DC3E81FBCBBA415EB91431DDBA2336C0195AB6163001E314B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/channel.js
- Size 5KB
- SHA256 4a699621c111427f9f6b3b767764a292f6a358616de2866e0078475830420f42
- MD5 41825ee4aaf6309d61b0e17ffe1f9df3
- SHA1 7473cdf471470ce8f36720411298e8086cde4571
- SHA512 66c42b5e267e2a3a21fab6d6e6eb7dae117bb2a226b5c0b7faa62db537768f67318597a1c9591182dc7770a115d6e4de874fe961aa468ae2f7284f2ff87cb883
- SSDEEP 96:MU/9D4VzfdY8b8+shbcqUzoKeGbtSUYiSFxIcTl130X608GM:MsWpU+MGLE3Fx1l1kX8GM
- TLSH
  T11EB1648CF9D06223459378E415DF4085556DA31AE42BCA59328DB390CF7C8F9E9B1ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/colour.js
- Size 5KB
- SHA256 024d2e9c04d50b492e91ae781da539c837fcaf40a585508c043356fdd9e69297
- MD5 f8e8c780e4ce105553fd7ddc9851ab5d
- SHA1 48fda8431a01c8dd38db128cddb23e20ff889e6e
- SHA512 b78ef03e44a9cede6c84bbe79b2f96de6ce9d8d6299be6ae4c94d37377f96e829600ed6a8b1f13bb199f6c94329e0c1828e3c0ae80083449b955b9e8a93ee9b5
- SSDEEP 96:BCp3qBbeUavKmpPx2HAksoyvsQJeGzWQfw7oY81YMe:aqgNvbxkstH9wkY8M
- TLSH
  T12FB1654CDB92511A3A779CAC2CDE91409059831E26235ECD7DBAAD802F4C4F5F472EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/composite.js
- Size 8KB
- SHA256 73f04ab765a11bfc72771dbd0a6324e8e34ea354d16108cc1277bba4e80dd523
- MD5 8dc15bd70c21fe95879c1af0bc1bd1ad
- SHA1 bcbf2829152ee6ccd5ef6324e4c1d569e7252c60
- SHA512 191229068717fd8573c7a98e419c9a376691819a6919c2d91e27ed20614ad2e17fa6160affad52eea139e0a56028d733b58184c10f788677afec4413c382c097
- SSDEEP 192:DhU3cDlTxqqKct5/tNO557H9VdE465JKAJtQcKiPipiJiP/iViQAW:DhU3cDVxqqKct5/tNO55brdE465RtQcP
- TLSH
  T12202623A0EA9701341A761B076DF02806395905FE36BC381774D7D507FEE6B4AAB4F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/constructor.js
- Size 19KB
- SHA256 b38f3e7ceecc305a8f81f278bf9219cba966993b8c2d7cebafdb8e8d5005760c
- MD5 ccd92574d65e7c9a200897c6043c1a61
- SHA1 ddac4648ff2e37a5e7c54e51a48be825a55a978a
- SHA512 3b18f51d08aadce0d00df8977455915e3bedd86cc1c26c36b73639ede35900052463c9d8f1dd6d8ed395f7b0a16c76daedfa15ddd4c4aa9d6bca2ce8e439479b
- SSDEEP 384:8zXJormMAgtb1FB3LRd7OL5uwN9zVRHIIkRGSMXQF9q8YuAUsPk+:8tRDBpVuA/Pj
- TLSH
  T14092E72AAE1112265467C4F129EF42981364C33B7E13B198714DBE641F8E4BEB2F6FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/index.js
- Size 385B
- SHA256 5e30578a16290fa0855c32fe3d544ce4f26c147de6bad69cffaf7bc416a2919a
- MD5 7258e49e156aa4cc13574942457431fa
- SHA1 25ff8f1243b587cb04057eb55f7cd1e15f36d216
- SHA512 783e8a989764e2d1bf7b1fb8cc62a7e75b632dc4246c0eee9119aa7972364531dede1c7aa679b0936628ffe7fea0568d82d93cf6196313cdbe16c7258d8e2918
- TLSH
  T14FE06DD34FA0EC0E79F903C198E34585B022D312A3496250B50C2CCB41D91D18E53D2B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/input.js
- Size 32KB
- SHA256 d88bdf5d807ef57ce8aa5d9be29bc7b9199974eac385bf559f19d5fc06bd632a
- MD5 ff01fadd3885471ddc4fa1d791048aea
- SHA1 71ec70a6e72d1a29aa5be333f6cb04428feda6e1
- SHA512 5a2e752db6b5a4f95c06b2cbba6b174f439ee3080866d23c07a7c891f74f25eb1dc3a2aa54fcd8b8b8e11add741b4dc7c24a9ba1436f08dbc9409bebaf9f4921
- SSDEEP 384:tgJ1/RhZDPs0BZxCNKY6kssxpOU8BXA5ZNMzefCd5T37C82WnmLBJGdbyd6qyEjC:iprs0BZxC5p14zRxhbyHckuO4
- TLSH
  T126E2200D1EB61212498370712EDE41016276DA7BB269CA933FADD6554FC86B0EFF6F80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/is.js
- Size 2KB
- SHA256 7ecb71679b5b58e7ddf7e14fa697ff6a31bbe9ef107745170095031519e93463
- MD5 ea3c318037ab9458b0bc7bcf949c7663
- SHA1 be7deb9c421e283ce9b7587f87d14919d42164ea
- SHA512 04ce8395346dae2ce6e82dd70b70ac06c682274a56dd1d6d0df806315f5b736370ecf13baed0759d3cb89597694b74560367b2fe1104aad4ad689d64fb55a54f
- TLSH
  T1AF51DE411BA100A5411845A5F4F0BBC7DD12403A73157CEEA6EFA8721FDEC71C6B6EEA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/libvips.js
- Size 5KB
- SHA256 ae8cbc8008bf88f5100ca56729ed43d45cd88316e030dc2eed62e142f657cd79
- MD5 3cd07a80fb4842c16c97b576de73fa75
- SHA1 d29700413966ad1ab438095e1f73d1bcde30ec93
- SHA512 581b872a8deba9359c0bfbd649b86fdf4eaf73af446d9f463bd78a825747584b649cd7373d0fbcef1eb3132ed158300b59c9ec537e19525adbcb3711f94b26d0
- SSDEEP 96:jLDz8tIv4IcQBAcJROk/mFQBG5dtBZm0SIoBXu+2/5XOTUUtpMV6jo0nWWsnTvf3:bz8+4I/AaRO02dSIoMt5XO4UPMV600nc
- TLSH
  T1DCC176A625F6653A10935DD5949AA804AB7FD323728CE9ECFC4C215DBFC62D881F20D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/sharp/lib/operation.js
- Size 32KB
- SHA256 01019d62cfb83c5f6192a65a4a97635214e5dc61da07c51be59b8216ba907a7a
- MD5 7077676037d5c71485ddd117f77209cf
- SHA1 b9e90c5ff48914277380d472ec6e2858a981d1b7
- SHA512 55256fc89de869f524d7558a8e9eb99663c0677fe2aca7a4b39db4141771185e8a5d03eb8a25111f2ada6e13eb7adfbcc5d6a77bc2c8e4fee970fad1c49c4d3b
- SSDEEP 384:AYCB3aT0aIqQc8czWirEJNkbXufeEIxOOvIld1bHrYe/5i/JWnJga:AY/TOCTEfwbbxOkIld1Dji/JWma
- TLSH
  T16FE2851996A51302468376F449DF4089213CD36BB61B8D85369DB7E01F8E8BAE6F3FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32