68d2db082d9b04b6af9f12fac373704e437a249b92c2dba5260dfd2090fd095c

Resubmissions

23/07/2026, 20:33

260723-zb71davvby7

23/07/2026, 20:20

260723-y4gs8aar2v7

Sharing

Copy URL Twitter E-mail

General

Target
Lousexcam.zip
Size 78.9MB
Sample260723-zb71davvby
SHA256 68d2db082d9b04b6af9f12fac373704e437a249b92c2dba5260dfd2090fd095c
MD5 fee63d5bd6adaeb9a35104cd6eb4b0f0
SHA1 619c38f539c67da0875e8d5c69a60c00ee13b54b
SHA512 049e01224bc2f630101e360025c41d510a8438d650b5e70e30256aa89a3bc47969b2be21d78141a9f308c3dfcccdd5807a11af04cadfca53699d652e5a31ea32
SSDEEP 1572864:moM5n0qhlKG/aLPEuEnxG2whxn86q1LbZQdkHbyMgUhquvYL:moA0Md/ajEuZ2Y98X3wk2MgUdvYL
TLSH
T17B0833C9914E7C529479E0C533EE9FBB23CFE5C80508F8941666ADBB30AD364BE56318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Lousexcam.zip
- Size 78.9MB
- SHA256 68d2db082d9b04b6af9f12fac373704e437a249b92c2dba5260dfd2090fd095c
- MD5 fee63d5bd6adaeb9a35104cd6eb4b0f0
- SHA1 619c38f539c67da0875e8d5c69a60c00ee13b54b
- SHA512 049e01224bc2f630101e360025c41d510a8438d650b5e70e30256aa89a3bc47969b2be21d78141a9f308c3dfcccdd5807a11af04cadfca53699d652e5a31ea32
- SSDEEP 1572864:moM5n0qhlKG/aLPEuEnxG2whxn86q1LbZQdkHbyMgUhquvYL:moA0Md/ajEuZ2Y98X3wk2MgUdvYL
- TLSH
  T17B0833C9914E7C529479E0C533EE9FBB23CFE5C80508F8941666ADBB30AD364BE56318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  LouSexcam.exe
- Size 78.9MB
- SHA256 ebecc74ef2780775446526931ba911ec1e5c5230cfd1aa2002ead8dc9bd3eaac
- MD5 a003a393ed54ef869f15c2189db0cc53
- SHA1 77a51f814b114963764bcc11e3d0f31a7b2c9778
- SHA512 93a1a650ab423554ec2a6cc6d73dcc65c91fe7a5234a11c3346170c2820d0f29fa573c12363676d63d1686d48d309b773da3324db60c76d3edbc5a9de0dfb00f
- SSDEEP 1572864:84gPXMorFHkTbCztAq23VEg0RB1SIcJT3DKJS7tu+0qVak0k7:84AcoETbCpAqHgy3SFLmSE+0qZ0k7
- TLSH
  T1E7083399A10E7C12D47AE0E523EE97AB13CFE9C40518FC84166ABCBE30FD354AE56314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app-64.7z
- Size 78.6MB
- SHA256 1a4ac15a149f869ca1983c5cabd013c5a5c6b2d7d9ee929cbf3ddbcfe0998b28
- MD5 1a6e8284ad77d0350d94d8458c28b461
- SHA1 feafd6b5730b6fb336bb99f7612407d1f0c9aaf7
- SHA512 906c3e59500f01ffe312ee9fb200fdaa9522c1077dff542ba2ae2e6be9a2df222a952c1e2cec322cfe383638f33cb1ccbbb697ffecb804d7f0e7037aa49d7d7e
- SSDEEP 1572864:S4gPXMorFHkTbCztAq23VEg0RB1SIcJT3DKJS7tu+0qVak0K:S4AcoETbCpAqHgy3SFLmSE+0qZ0K
- TLSH
  T158083399A10E7C12D439E0C523EED7AB13CFE9C40518FC94166AFCBE20BD364AE55369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral11 behavioral12
- Target
  LouSexcam.exe
- Size 164.7MB
- SHA256 83cbd81fbfc2369dfa677042a86d9915fada7aea637aac254c5209cb439d041a
- MD5 172178732824e6b5ffdf93ae10b0c1a8
- SHA1 87175806731ebfdbb62d818fc64345f5cf201eea
- SHA512 085c157688599299e6cb55ff5f229eae4a74292d2b9ef12f27a97aea10226952ffb3bd8ea19bfbaceaf4ba61833d20ed140594dad5fd805d50241a1c61eef9a5
- SSDEEP 1572864:w3OB0RhDP7igv6wO+HkaN/xtpj56BZWua2T3jC0gqhd07YeRt6C1Bd1jKoUeKtQ9:APvt1x2z5m7jN
- TLSH
  T1C0887B03E29650E9F09DD1B18B97863AEE72B8460729A6DF175417252F37FE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 132KB
- SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
- MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
- SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
- SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
- SSDEEP 3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
- TLSH
  T185D3D0D7B3F4EE7DCA6756F7A62540B1ECB386280691434B078BD8752A26748DCC8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 190KB
- SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
- MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
- SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
- SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
- SSDEEP 3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
- TLSH
  T1ED14E1C7A3B8DD7DC9670AB3662501F1ECB211395AB6525B03DFDC357A56BC888C8283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 6b721af2850f8654d42585e363e1ffa2e92843b3b84bb2e0074cd954966300ff
- MD5 a9ea2fab0940c6d0d04deb70e0f81b48
- SHA1 a992109beec766bf315da8035a6eaa5c3e4660d2
- SHA512 014e3fafaa84f433c26d77e666ba94f0e364d7ae4268602742af9ab81169601a1e94d20a8a0a4328573b6f36052e2afe0745374c03c71b4d853c825df9372096
- SSDEEP 49152:kF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQISCu:kFvSkJXv+tiLAD0+DIS5
- TLSH
  T10BD5AE07E6D940D9D01EC070879FA233F62134468B24A7EF1A919A252F7BFD46E3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- MD5 e0f1ad85c0933ecce2e003a2c59ae726
- SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
- TLSH
  T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  libEGL.dll
- Size 477KB
- SHA256 5318dc1ede886a1d33c7243f68847e6c29436f3f7d1891a6803c70aaea3a278d
- MD5 f1c6c87ee66112b3c7cce3ad1cab59c8
- SHA1 cce4f00e654c10ea5408897296a269be79a21a2e
- SHA512 ddec01354988ce401a1fbdf06c57b25acfcfd8dfbcd58337f029f579e9f6c7cdc98aeee9001073de88db192d4b7ac6bda4b3bcccf2aa5d8f136aef580c95bcc6
- SSDEEP 6144:48hd1BSjuMmof2SEXVVfgV8hxN7h2NvIEOg51f0FticyQ:48DXSjZmof2SEsmN12NvIE7f0FticyQ
- TLSH
  T12BA47C15B79844A9E07BC470CA534652EE62B4960F65FADF0394923D2F7BBF81B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 158cc009ec9b331b6b279818743e451c3ee706b8faac52e85ffedeff4643ffab
- MD5 d5993dd046fc7331aa3da6a6a68f634f
- SHA1 f7a8fa4add31e581d7af8f1e832168e29c7c759a
- SHA512 e37bcfb2919ae649ab9be9f15150f5cc221d07913a4d6872060d722fbada266620868de2179ffefd04d119f08909a6635561078b0a24b59e60478e42770f162d
- SSDEEP 98304:FwY1sQqaLe2Egto8U4r5Pp6TlITQZ3uW888888888tb8dKi:mNaSgtvroZu
- TLSH
  T1B1767C13F69640D9D05DC2B8DB579533FA3178990B20B2DF2A9827213F7ABE06B79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/@img/sharp-win32-x64/lib/libvips-42.dll
- Size 18.2MB
- SHA256 f8d356def73941668252347b825055310e99023ff77c7d3036e592d0771e1529
- MD5 5f3e5819b9b10f5d7711b090e1e7ef81
- SHA1 17951621e24f55505c654adccaa9f4977e850fb0
- SHA512 3fa9e5499d218dcfc9c3a9254677ab7e37596402c94fc1c5e59ff12116e31d957168fc3524aa41228216bc3b983cb61bb2c2020ca2f874e548fddfd782fc0f3b
- SSDEEP 393216:2z+r10n8PyGuudU2D3zDJxl9crqKBMBG9WCNV+ygLfENwq4YrM2KLQ01HaERtj9c:OdMY
- TLSH
  T16517AE0BF1C250E8C41BC570836BA722FA35784D476565EB27989B603E66BD07B3EF48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/@img/sharp-win32-x64/lib/libvips-cpp-8.17.3.dll
- Size 319KB
- SHA256 f1b3c3eeea1b6a8292a69d78dd2cd1debacb9951cabdd9217a57e34137570cd1
- MD5 6015f5e1ffe05ef54b13e105c141dbb0
- SHA1 b56d0de903d70030f0f8129927a15372c98aa79e
- SHA512 0c95e0075f85bdce5f9a346e247be0d4c6838a2fb524030a281709a4fc8aff53ec2f01eac8b0476095d62a2936a95b3e86f1888e4e8569dcbf9a67f01cf7fd8f
- SSDEEP 3072:NxpfGuA3jxPZjlgGFOwsLWNM7aa+E9wNtj/RpELtcoEM/XlbkfbwHv4nZv7Jlho:NxpfGuA3jP/FfSWyfJ9y/cL2Th7Jl
- TLSH
  T1CE640957A7250CE2E46FD03EE85A8412F572A45503A3EFCF07B4821A6B1BBD56D7EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64.node
- Size 423KB
- SHA256 afc813593f255968ddae8f1d66557e0f96484bb374606e4eb2267a7dbc7cb25a
- MD5 671cdb967cc79774146da9fde5e0b322
- SHA1 23fb09dde3fa1820d48f80ae2673e08e502e8a15
- SHA512 1a716a71a64d159f777e5c0ceefe0c0b253a9c89ada17d83c2f777cb1596d0342fddb3985e04b431c41ca25e4d4a55c2d7b721294a2c62dd910e3c0b4f40d0bd
- SSDEEP 12288:FSrXFko1ziH8hriRoWQb+AujFRNI+x06x3:FSBk0echGlK+dHTxn
- TLSH
  T1D9947C2BD3650476E1BBC17DCA978502FA3238054372EAEB07E1DA655F137D1A63EB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32