17e700aebc8088c586fb840c5f37780f63dcef25aebbb21a023c496995add9a1

Resubmissions

29/07/2026, 18:24

260729-w136yazbjf7

29/07/2026, 17:55

260729-whj1ca1yct7

19/07/2026, 18:34

260719-w79masbx5t7

Sharing

Copy URL Twitter E-mail

General

Target
legacylauncher.setup.3.5.0.exe
Size 93.1MB
Sample260729-w136yazbjf
SHA256 17e700aebc8088c586fb840c5f37780f63dcef25aebbb21a023c496995add9a1
MD5 531a6f33129a700cbd86ae6929347928
SHA1 0722cad1cb38a69ce2be4a814236e958ecadd60a
SHA512 2cbc8ccc03a2968d17748eb9a10bed413368a0bcb8d47b72b33cf9bf6916da2ac557c50a76a687ab2e522f58078b92d84eafcdb34e74c30e325d7a3d7c60e78c
SSDEEP 1572864:7B2YwYWY+FCCjaZYwXfxW+cYy4/TqTWK+JxgavYJoHrKfDx9JkXPkmUl9P0hcH0l:7B2YwYN+HexWh45K+JxV1LKLxUB80hcs
TLSH
T11728336A10B59906E519CFB86EFA8FBEE17A75804CD9303F770C272B3FD84449A0D15A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  legacylauncher.setup.3.5.0.exe
- Size 93.1MB
- SHA256 17e700aebc8088c586fb840c5f37780f63dcef25aebbb21a023c496995add9a1
- MD5 531a6f33129a700cbd86ae6929347928
- SHA1 0722cad1cb38a69ce2be4a814236e958ecadd60a
- SHA512 2cbc8ccc03a2968d17748eb9a10bed413368a0bcb8d47b72b33cf9bf6916da2ac557c50a76a687ab2e522f58078b92d84eafcdb34e74c30e325d7a3d7c60e78c
- SSDEEP 1572864:7B2YwYWY+FCCjaZYwXfxW+cYy4/TqTWK+JxgavYJoHrKfDx9JkXPkmUl9P0hcH0l:7B2YwYN+HexWh45K+JxV1LKLxUB80hcs
- TLSH
  T11728336A10B59906E519CFB86EFA8FBEE17A75804CD9303F770C272B3FD84449A0D15A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 15.3MB
- SHA256 e252ff70e8d0a84350dfb28fb0a217e2955c7a5fa6599328643a02fa28ddaada
- MD5 ac3819300c2dd8002d56beb3a0d4aef6
- SHA1 d56a42c5d48c7ffe8f3b95c6c47f731d003e419d
- SHA512 5c5dcca04887d625cb52fbd2df610856618d1baa055f933244eabeb2c6518797f63b451f7aa37d2cb68bd4d427e7eddea6cbaf319725499cb5e3b532d024c603
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6DNgQdGxw:w
- TLSH
  T1B3F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  LegacyLauncher.exe
- Size 204.0MB
- SHA256 e61796efd9be3c7312bf54802d11cb2700099f96876b90c486694ac1e7e0cf3b
- MD5 aaafd3362c8f05801832f6811f2ca65f
- SHA1 d3b26159b6491e44ce61fb26f2b4c035e77a98a6
- SHA512 5b3a198f2cc0dadda52b9cfa20d7fe000d2f1ea6b9ac1a8ea8715caa793edf987b6add803645ea4e70cc6d7e1e385a113446cf751ca2c97edcd71721e31221bc
- SSDEEP 1572864:mB4PuKuPCPGv6p3GWhe6RdAzNoJcEcm08jPF9aWbfEA32pKGv8WzXgGDPexfcK1X:uvuNB36/HlMjZ
- TLSH
  T1F2A88B03E29A41D9C05DD175575A9233FEB1B8094724F3DF2BA447522FA6EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 a40a84bd8185a4fcafd1099119800826f3f92d76b7c063c080391b9730eb6519
- MD5 217555afc8d5314c3044cb0e642a511e
- SHA1 7ea25474433ccca80215fe4540df7f1faf8eaaf2
- SHA512 e654d9809fab5696d76bb2d6c3459d8035e828a924092974074c4172e7c43b1b4c3608a5f7137476f3568595706f6f7b4bfff5b2f03102a7ff688f4ee56a0dcc
- SSDEEP 393216:LDo0qtOp5zxtGlyWOLynvTWcRedql66P2RJ:cOPxBQvlh2
- TLSH
  T157473A122646D49CC059C879C7678B268A6C30E73FA7B9EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 0b022f4e134f5306d9a84b05df6d8c3902b271f44fa6fe04f49893eb3aca5837
- MD5 fcc8264f5f5cf67159fb40e6c9893cd6
- SHA1 5e6ebe50eba2c5aeb2115e92c4c8aa1082afb1bb
- SHA512 2afd5580a39528d6ba2b85f483343c5be04f798d44608793cdf848ae0dffac905ba37b7ce3cd57d0369f1e41e5765c739ebe74ff02df9d85b2b44903d1cb09df
- SSDEEP 49152:5WP28bu0s6grWFv/iGOjeaGgQbalS199aJLKIbk7k64aoijQrNoJdxljA6iPyfI:5028bu0CKiGWeL1bal9ZrNoJaL
- TLSH
  T102E59E02F6D651EDD019C034979B9313F631780A4F209AEB16905A223F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 500KB
- SHA256 826ad6072ab5e780e35eb6e92db88a18a751f327b14e178758c50a55d51855f7
- MD5 a05134b15a27d806a628ff10a2029931
- SHA1 302a1e0c078cdc271daf59322f34222a94f96dc2
- SHA512 1ed4b9f719e3d9e147618156aa20c59d7e3fece7fd7f2a23e7b22299d78bd61609b25f23cc77ec1bb14cdbb07e17a71696b0cf35f6270a5383be06c613ca0235
- SSDEEP 6144:PwKVOb8lys73EbAi3uYDbW1XJ5aihN5Iio64haxiVNcPPmWF3PdPNUkygV:PBKA3Z5XSiAaxiVNcPPmW1JNd
- TLSH
  T14EB48E15F3E947A8D07AC0348A538646EB7578960B65F9DF02E052392F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 9d4c2245410bdbe624325b1d7f4c27dd48e2541ae8de5ad62f7e3a6ecc9cbb2e
- MD5 21a5355ba57d6cb0725e71227072e399
- SHA1 e35d839f6ea79428c3e6a5740ca6c90063feff77
- SHA512 ba5b30682866fc7a832285965387940d4bb5cc56d38fb6541c203bfc271db2149f4b0fd25f551e19fef24578cf0f5a9fddb4e0d20385c9f4faab2fc324c40bcf
- SSDEEP 98304:4Hm3j3XoOkLxIpo4WddKJT8Yt5d4o5we5MMWR/:8gj3/0xIbZdO
- TLSH
  T1AE866A03F69641D9C01DE274975BA223FA34B8550724B7CF2AA453262F66FE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 0344aa5093ef1253db98158930b32ac1ac4dd2fb6d4f7ae60c5e820ace47f5c1
- MD5 16baa4ee45971f69b18eb96e9e19fc54
- SHA1 ed7aa878d4c4d84d8c6456dcfc855bb3f5360648
- SHA512 e0f1dc4d89c85283812e6b0fc1e212cc123f1ed461b1296194edad61aeae4ae2a289a77086ce6df27c98c5815858f8ce2684edae4cfb3ff87705bc7558511c97
- SSDEEP 49152:lRAYccoQajkjwWrTd/hMFsfyTpkXNYSsnt4p+L4lvgPTvFaHmJrL+4jopldbIqd/:lFccS3OQvNToxq3cTHIXP
- TLSH
  T1CA463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 0f2dedc564e39b1900a3f9b977f0e415a3ad03830eae28549070fb4b6dc1ee4d
- MD5 e917f26ad4815faf4c7307d91fd5a6f3
- SHA1 7333808113db951be82a0e9d261ee51aa9b574dd
- SHA512 d0ecc935432294e66aa5d398c7892e99754663ea2dba87c081cac2aa1f622ee0145875434b13ddeedbbd78bc0bea24977621abd6a7c4fa3d3aa33399f156fa36
- SSDEEP 24576:+hlEEziaf58fg5rY4M2IP4rB66Z5WGcXDYsHQDJ6g3P0zAk79oOHTQe:+HESiE5845U4be4rB66Z5WGcXDYsHQD9
- TLSH
  T1BA156D23DA644669C976D034C9D28B0789B175822326B9CF02A817047F6FFF47B7D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  $R0/Uninstall LegacyLauncher.exe
- Size 203KB
- SHA256 eac6845ccd5cca4afed6d41706f1f79f0cd2244be68e272d856e267ec798ddb8
- MD5 26d09a2d4983ff47e68bc13abd1fbcbd
- SHA1 69f31ded3884618264f47e0e5f962dc5ac96c6f2
- SHA512 acb95715e84098089414cae89a9c1660d27d6b644479b5b9191b4c4428cffccb81329a1c83925523f4a6a59b2bbc268136bf97831b387281edd20d6e426b4400
- SSDEEP 6144:4740INmGQkKAoCVB2/kL5irj2Ua8T2t0EyL+yaL:yumlkDoCVB2/MiOCLRKJL
- TLSH
  T1E414012563E0C913E4FB4FB16BA643CB0AB9F20425248B873BD5274E3AA79D1DD1D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral30 behavioral31
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32