4e80f448889f36015a3aade4710398ae0577be0506183452b89b5e80995b5947 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

Chara/Chara.exe.lnk

windows10-2004-x64

7

Chara/Chara.exe.lnk

windows11-ltsc_2024-x64

5

Chara/Hack...LL.dll

windows10-2004-x64

1

Chara/Hack...LL.dll

windows11-ltsc_2024-x64

1

Chara/Hack...pt.dll

windows10-2004-x64

1

Chara/Hack...pt.dll

windows11-ltsc_2024-x64

1

Chara/Hack...UP.dll

windows10-2004-x64

1

Chara/Hack...UP.dll

windows11-ltsc_2024-x64

1

Chara/Hack...rt.vbs

windows10-2004-x64

7

Chara/Hack...rt.vbs

windows11-ltsc_2024-x64

5

Chara/Hack...un.bat

windows10-2004-x64

7

Chara/Hack...un.bat

windows11-ltsc_2024-x64

5

Chara/Hack...wn.bat

windows10-2004-x64

3

Chara/Hack...wn.bat

windows11-ltsc_2024-x64

3

Chara/Hack...Sc.dll

windows10-2004-x64

1

Chara/Hack...Sc.dll

windows11-ltsc_2024-x64

1

Chara/Hack...9k.ps1

windows10-2004-x64

3

Chara/Hack...9k.ps1

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
Chara.zip
Size 93KB
Sample260730-hwjpvashme
SHA256 4e80f448889f36015a3aade4710398ae0577be0506183452b89b5e80995b5947
MD5 89811586d80f17c448e213a2f04501c6
SHA1 754199be07f8530a8a88237ec5a177d5a7fe6600
SHA512 378a14e015cfb73e2f1e66766387c62d98d5e074dd700b0974db76b2262c2ded040538501097e87d1bcbb3255d0672dc742277ab5b044e5fe617301279735205
SSDEEP 1536:7r8cPUTOxHWX9wGhvIE6SHIuuYytHPAcI6PJ+h2GloSX7uRl5VK0luc4KlRps1Je:7wcP8OpWN8aHIDKcI6h+vlRLQlvKXWlf
TLSH
T1819302A2621501A2E8D6B53B31A3936D5F2D2F85CE167FDB6C65C00022F1D707B5A7CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution link qr

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Chara/Chara.exe.lnk

Resource

win10v2004-20260513-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

Chara/Chara.exe.lnk

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

Chara/HackTool/CharaDLL.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

Chara/HackTool/CharaDLL.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

Chara/HackTool/Crypt.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

Chara/HackTool/Crypt.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Chara/HackTool/InjectPUP.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Chara/HackTool/InjectPUP.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Chara/HackTool/InjectStart.vbs

Resource

win10v2004-20260513-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral10

Sample

Chara/HackTool/InjectStart.vbs

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

Chara/HackTool/Run.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral12

Sample

Chara/HackTool/Run.bat

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

Behavioral task

behavioral13

Sample

Chara/HackTool/Shutdown.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

Chara/HackTool/Shutdown.bat

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

Chara/HackTool/SyspnSc.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Chara/HackTool/SyspnSc.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

Chara/HackTool/Y0k9j8h76g5f4d3sdf56g7h8j9k.ps1

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

Chara/HackTool/Y0k9j8h76g5f4d3sdf56g7h8j9k.ps1

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  Chara/Chara.exe.lnk
- Size 2KB
- SHA256 7ea5dc28a5e6f57294049716b15db54063b31d31c641e98d381310a69d9c54e2
- MD5 cc8ff333b3b640336454573067f423b1
- SHA1 cb94275ea9f2f798c0ff6de5854b34b9078a0af9
- SHA512 af75cd8006d03e488d48205f738c624d805086e1a8696cd829cac24885d0f2b212c71fc004a4303c8e0a9d04084570564d0c994a3d794a009d5fcdd56fbff988
- TLSH
  T1EC41CD1327712AA2E37F5AF4E5FB42E1C5327937AE15920D4004C14B1875F29DD3876B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Chara/HackTool/CharaDLL.dll
- Size 109KB
- SHA256 2cde6d3a161a7c7f9943d4928994b2128e797488dbdd705a8a7f72626a54731d
- MD5 a32ed60845dfc48c2731abea7534451d
- SHA1 2a3a18eae58ced30241ab631af944cf71ffb1691
- SHA512 73e7ab1d07b396414312a1a90b0cb140c55e5117a53426ef40268c70d656c3ab691ba42e88968c85ac4b0878302f2c65a0a6d14daca82debc66a985379dea6ca
- SSDEEP 1536:OpSqZfdIz3hyQXtIimshZ5j7oqjP4A7zWCl7MbiRhRxCWelL:yNdepIiroqjP4AxRxChL
- TLSH
  T152B31989BFA1DC97D915433945E6C335273DF2806B878B173E2695391E27BA0BFC4282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Chara/HackTool/Crypt.dll
- Size 134KB
- SHA256 d859fcb7bc121d12edaacfb04093dd429518e5fa2c2d235ad212eac57a3e3bed
- MD5 65bd12f92c008bcb0bf990dbfb9a6425
- SHA1 c836e07605e25bc4e89e79385964a1ff99e23072
- SHA512 5ad59d89d150dfd52ff1b39b11420b930238d0b759916877d1b2ff6a4f40509fd818f5b965bbd894de404f4bc8809c02a63d9b948820fa78557a160d5d4eac56
- SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkt:YxnkWh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Chara/HackTool/InjectPUP.dll
- Size 134KB
- SHA256 d859fcb7bc121d12edaacfb04093dd429518e5fa2c2d235ad212eac57a3e3bed
- MD5 65bd12f92c008bcb0bf990dbfb9a6425
- SHA1 c836e07605e25bc4e89e79385964a1ff99e23072
- SHA512 5ad59d89d150dfd52ff1b39b11420b930238d0b759916877d1b2ff6a4f40509fd818f5b965bbd894de404f4bc8809c02a63d9b948820fa78557a160d5d4eac56
- SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkt:YxnkWh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  Chara/HackTool/InjectStart.vbs
- Size 124B
- SHA256 8391ee8fb8436b089728e57b05d64f12a49f2fb4dabad53672ca79719f187619
- MD5 486b22dd77e079de8d2db8fffbb03ef9
- SHA1 2b934fed2543357ddb8056bb10c801fdfb1ca611
- SHA512 f71c071d7085a32345238a424db636f8597bb710b87acb98839641251661337997ff6287c417f0c5c5e81b19dcebbbf3e54ea71b716c991c5e3d83f58c3b28a6
- TLSH
  T12AB02B047404832C0569C42C0830C5188C5C244492105302B270612822142308204109
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  Chara/HackTool/Run.bat
- Size 55B
- SHA256 ec96730cd5760f76624c76d0c318095c8baebf131a457ce0e7f06169e01bc8d8
- MD5 953afedf73e9fd5cbd5dbcd0920aba23
- SHA1 b5b55fc17f8f6ab01a13e07fd9a5d9565660ac86
- SHA512 56f17fe591313dbd4d97a360b6f0c824e841270c6c456475ebe45f5a307dfc4b5bc6b3c4f1e9696ed2dff525586debc6cf0e95a86d755ab25fd83cdd6f32c421
- TLSH
  T12F902208AE88880C80828C000000E200F002208A00008088022088A0088E2C2E8C0803
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  Chara/HackTool/Shutdown.bat
- Size 32B
- SHA256 59aef04a19756a4c94ebd8f1e1fad17ef7357ec85dd65a1d72d52f103462fea3
- MD5 2dbd841601d1bd90f52dac1373a14528
- SHA1 acd4cf25d59fa05a8e050c9afafb0b4f05458887
- SHA512 dcf24c482bec0905c2bab76594938474a96b572d3810153dd31a10182a28dba209501a162296c07c5e1f5d1e5b8a1315a6fbf013476cc02e3b03ee9fbe9d592c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Chara/HackTool/SyspnSc.dll
- Size 14.2MB
- SHA256 cf022e9a6b4db45faa4ac8e98c5d5d2f40a6fc42bd3e7926a3ff01b748d06e13
- MD5 cab51fd2980523407d184735d4b55acc
- SHA1 bcc71db938477bff410a17a275616aef86db545e
- SHA512 8af5ed6fb140695b316fef5765c625bd9743c56b633149b5e07a88646cef1ddcff1aa876510391a6fc14be8b0ef051178497869b7e85d23ec0ae213a0f553be1
- SSDEEP 768:YhkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkDkx:YO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Chara/HackTool/Y0k9j8h76g5f4d3sdf56g7h8j9k.ps1
- Size 6KB
- SHA256 bd1791def7110e324ba0be709865305857e9349bac0e3d1700064298774e64be
- MD5 577871348146d64d0fad43cad66ff1d3
- SHA1 12db252d4cde2926718bf4955d15fd0e1d045e25
- SHA512 00b05ba1c74b3e4a4d427db4edfcbc172d3c8a2a7e0775404d2e306fb69e8425e84dc83e80d50eae1d4c11263abb2fae6c3c5d1f4306ba65a9159b9b1fd21bd1
- SSDEEP 192:Q6UZ0KpgQN3liP0ZdRrPP7u1G9AR3gPqlS9cV3M:Q6UuAgQN3liYdRrq1G9SgClUc+
- TLSH
  T125E14428735B8185A7B72B0A9D6F9889DE0E203761049914358FE2D1BF7B19EC374F8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Visual Basic

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

© 2018-2026

Terms | Privacy