e66264065923676807fd6d7b36f7c9dc52db9ef1c5399b2811738eb5e22a30f6

Resubmissions

05/08/2026, 01:46

260805-b62j3swbjg8

04/08/2026, 06:37

04/08/2026, 06:31

03/08/2026, 13:01

03/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

General

Target
Desktop Goose v0.31.zip
Size 4.1MB
Sample260803-p6dd5shh33
SHA256 e66264065923676807fd6d7b36f7c9dc52db9ef1c5399b2811738eb5e22a30f6
MD5 eaad0961b52b14d9a323f092ef307d8a
SHA1 feb3aedf16432b063ff93c90623a865a1fd5214a
SHA512 fc42d2ed6a8a8efee0898236526dbe46218dbec657caa5e70bcb18433345d56a010903c155c726a5c9e117e1759cae42560e18da49d5bbfe4e99048fbd326330
SSDEEP 98304:r2s1pAKXHAqe3S1s+2FpwDhbJ/XKGEzJKiMR7:dHAqEDP6D5J/tE1K3R7
TLSH
T10D16333BA7A5202DD10BD37CF01BA86BFAA5CD1F56F8D1D74381B2E329812D8164176A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/MemeAttributions.txt
- Size 549B
- SHA256 c6134785bb0927cce100b3b02ec08edfa0a3e485f16b2481ee28f8cfad208ab7
- MD5 fc280867f6cf727ff169b24371019a93
- SHA1 c3f522747d868510d4082a6bbbee856fc6fbc411
- SHA512 54b394b1b65be6baac4ee6381fb076fe6e5c27cf1777550a2d7093a0c4e6e1c8debb95815ac91b608a8367ff3cc215afb36bb027778d983ddf5205e0053152df
- TLSH
  T1EFF0E9A31AD54407A714A2876978F3EAF2539AC9BCE891D9E382D3362004E6AA055F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/GooseDance.gif
- Size 499KB
- SHA256 f1d46d538348ec2405f3a68291029b062129d8253de275e22584e22539989e8a
- MD5 b89e8c268b06e14d2dacabadcc1b7bfc
- SHA1 e340b373e8e24e9f2a555512f714fac02062cb4e
- SHA512 4f9359b4b8dfc759de752f40e20aa9d2875b4102d614eda2791ebaf55f3a9b504cdcfb35739a99fecb1f2e3a89998b397aae9c252069d3779a5ef023f4149272
- SSDEEP 6144:CFF4JpMuw+pTzePFcK1yETuAnul87wryM0uul75q2bz/USWQvRY6DG8QbJjfS8eS:o4JpjTSF91/uAnulaMMk27UCJfHQlyEv
- TLSH
  T1E2B4236CE55B346C6EB62B2F12F190CB6C9119835378E68F07FCA3E1A27071918D12E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme1.png
- Size 13KB
- SHA256 fe5ee195c07ebfc789f15ce771cc0f003ae43c0d5115c193d0f876de00c18dbe
- MD5 ec6a7941aa0d1c3cd0a7b724324fbb96
- SHA1 9a2c82916fe95c555ab488c51f9939defc0b6989
- SHA512 fac40ebc860b1f8a0126b27d35e9f685f00e0480348b50597b665cf3f737ccb8025c6deee02efb20d07bad8afad9f3031bbf9774f4ffa569b3f406487f17fb9c
- SSDEEP 384:29TaB3Rxj+eb9jiZHYiDB+ChX723MEjN2VYYy7B5:29MD/9M+aq3xjN2ZIB5
- TLSH
  T11F52D00FB99876FC49F2D263852705A2CB5E85CE2695C9110AFCBB54C0F314CAE72DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme2.png
- Size 461KB
- SHA256 77aa8c017272c774bb0bb59d21a409df09635676443919c7e5523abe3908ae88
- MD5 4f21b82bac2893afec41a77eb024e3bb
- SHA1 cdc2e6bcfbd72f8e5b911dd3b3d59d8b5476fc45
- SHA512 40919dddcbbdd71e6e691333c46fa9960c17dc67bd0e59c4244db2a8ecb5ce84c0e33e09738a709b62fcf23c2b3d4772246f95a7bd3c8a1d1f0d7603e80d1239
- SSDEEP 12288:TTS6y+/55cWfmi708n8rJIgiYC0GnU57sJXCpQsZ1TZ:TTL5XdhdnbgiYsnU5WXCpQsZ11
- TLSH
  T154A4234B55A3A7B03462EBF9C9BC9D02701BDD8B538560E29283F530A7917EC71227ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme3.png
- Size 98KB
- SHA256 37bc0e217c6d6bf3eaf31072c02f010e785f4935abe9849fbee96d586d0904a7
- MD5 cef6b9818bc01655614fb969cffc155f
- SHA1 84f7109e05d8d14fc3dd9148093b27a05a44c429
- SHA512 b2acd71d2f4a010f79da2895f4564ae7702032e9c13ed833835bb74e16363b72b89d5e34cf805686a8102a435b7c969a22118fb900c193d68eafb6e2976a1c17
- SSDEEP 3072:3XxY20b5W2KcrVdrRwZ9XuYvl5Ks/e/QJcRWyU:3Xx10bhKcpXwfuqKCexRWf
- TLSH
  T1B2A3023C3FD292A2D407BDB097C1963C1B86AF9A55E40B5729F522D1C127EEF21912CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme4.png
- Size 234KB
- SHA256 9fcc9a9adcd231656e848b9b42bab449ea5a083cbf3a7a987c2e52963d9cf6d0
- MD5 af4bef7b9f4f37ac62e782b5b59d02aa
- SHA1 c5d73aba3040410351758c5ecb1662fde8105ad4
- SHA512 602a153d2b1bcc4c5c4caf596ce8431618a1ff53d102b9180d2211001162644807103385e36fc1837d12fbb0e29313827210d99b54bf9b12fb86754b61a37571
- SSDEEP 6144:g939OpIyLNK1n5DPni3taJ27Aipg25O9SqZRFrOO1Am:g9oIyL8di9S28iuSqDR3h
- TLSH
  T116342321FFAC80F0DA9FE1267500BC235A21A947FE61576273003E596DADCCB61C7B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme5.png
- Size 88KB
- SHA256 f8a5d603018a04375b7b19fe72034f904e6a91237b68e196bd2b626519d6ef03
- MD5 01f620eda22ae06fbcc60500374fdd88
- SHA1 6489aab1190801bd6d66729a82472e8061f05585
- SHA512 28316583d5904d4b372a138193aeca06def7fcb26a0dc0c8b8de0608b7870bbab8f60f7938e4a0f1faa0d4bbf547e9bac8b336f9d901b4cda7297125c9a9e3dc
- SSDEEP 1536:ieiWZP46a4zXxGHCJ40++zsDkY01XUqLkYCwqvUx0LoMS+7uQwkkIeJl6l:inT14z08+lQXUIkpwqvM0MMt7FdkIUl0
- TLSH
  T19793129D3C3DD17B4837EC96CB0404E9D6CBD73AA8B98CC6211E7934A6153BC7982A4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme6.png
- Size 47KB
- SHA256 a078c89de64c606313e251122a4d6025ff3f76cd941f1fb2195938e6173cf9f1
- MD5 e46d6d7154cebf37d064c537f5d01f36
- SHA1 56fd4ba570a03fdbb565c22734ee9f03e93e60f9
- SHA512 376e706dcffcbc28824c744a493bf54e1b8c368e81c0d62d3103b5404fbaaa417934ea41887dbe3167079dc56f1ec0fec21432f1b6c937f49d88a0fc4c86cdef
- SSDEEP 768:yaWM5J69G8deXPBT5Ko5QZNognzYr90Vz3WKr92YBJ/uvQYxjHosziWRo65dSSHJ:yan5J69GTXPBtK2QHosy8z3N22FuvQY3
- TLSH
  T1BB23F14C4FEEBF84BA58122B15887D31F80E3362DDC1B517B1914EACAD3EA3915AA5C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/Memes/Meme7.png
- Size 10KB
- SHA256 9e3b5c5158686f49bc91d41d1215e8df9322a092b7c9015e8f9228cfbe4c61e3
- MD5 245f29e1e0905c497306c8f06f503244
- SHA1 31e8d127f740e3de8f9975556fdbdbf82f29a27f
- SHA512 27ee70118a5963d1f492a65f714c062c2c5269c3c9bbb40f960dce88bcaa124df9f34890a81c87ab9987038fe7e73ea8511525c5b1237a3f50362ce36974a48f
- SSDEEP 192:X/R+NOZzphWhE2+vSbcjeDJT4fT6KNEKtlOA6t+0W+926kt12BQA42NXtY:XqEWOXKgjzqFi0Wht12BNdY
- TLSH
  T1F4228EA037507EBC153C50A609D947BF5A7B3A5083D9978DC4B95F0C359DA0A9382CFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/OtherGfx/DonatePage.png
- Size 114KB
- SHA256 a6d7047bcf036513d32182339a049d04323cb5a113d0147514bf743e01edea2b
- MD5 2e137058fea9426215796ff5c341d4aa
- SHA1 3fcb7ecc472715d6d3ced1b1a15dcac05952e6e8
- SHA512 3a4e5531c0173e4a98aa5c267dd3b3a273db75bd3cc03bb619b16ab6729046119b1eaf50f0fcbdb0cd012329e5c7ae46822b7688267d01d38552ea69acf9c85e
- SSDEEP 1536:FrDO3ufDUoCRCwkf3a07QwSAgLUjztkuBi+wUQtPNg/iUn6o/e8UwGx17W4rQJ1t:FrDDfwoCRVkJJSAOpgumJfUnrS15iGX
- TLSH
  T1A5B312C2E7754C2E9D5AAED987BC7DC9B30A106108756AE80D7DD0FB1A23F04DACC958
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Images/OtherGfx/heart.png
- Size 990B
- SHA256 11ae0a796817293fa0fb66978614a0bb87d249299ab4a75439bf56502358c0ed
- MD5 76f468aa187e5c042c7ef5ae6a8a0753
- SHA1 01f6514bf31ce922aaeadc35ca6b9e82589cc62a
- SHA512 aff7cb688e0ceddc55faae067bbb54eabc4cadcf538ed45918307e40dce723867889162de1c486a7597e5d4e2a492dfeb37b83aa376ecfb05aa5f886d2dce264
- TLSH
  T12311C8BE31F516F9C3955703215364B4E123037475DC36103EC06E478AADA0714DC71B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Mods/Autumn/Autumn.dll
- Size 11KB
- SHA256 5c0024fd7cb4fe2424c3c04c6036a2c67bb460f67a04b652afeeb5d4c757b70f
- MD5 ad4b80cc7ea519628734687452b8ac0e
- SHA1 1b096e964b4d44f2d6a77cbe4818f8914ce60eaf
- SHA512 62f74876bfc3c24d371ce2051f1baed14a0625d0699bdc3590e9ee7fc55a92a5997aa99e160cde0705e42c24940641e27baee648b73ff0d17f6aaf60a538fc75
- SSDEEP 192:C+3F7xb75FvYTyUhEazn54cpk6CEM9RCgEKdwnv/EyEiLc:LSpBm6C9DGnEuLc
- TLSH
  T11932FA16ABC59732C6FF0E7A5C938A0663B1F249DD76E7AE09C4B56B2D27B00110374B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Sound/Music/Rename me to just Music.mp3
- Size 2.4MB
- SHA256 1427ec3e3e50c1402c1fa182f0b1bde0a0a3274dbf1a89fb13b787359bd1c8a6
- MD5 3c954d9b4b6d739ef833fe72511f258b
- SHA1 d70699a88a9720b9fa40cb1f7b876270b01ad100
- SHA512 2b773d8a7059941361208a1fa310ea40433005f4df6f1db526be5e089e80cdb6bd83453fa89d4e98cf591615e1ee2b19fce13324c886ab05debd7542f13d52ce
- SSDEEP 49152:DTelni0VmBO0MdR48WfYQekkVqILzpGCMqbhs47DS0VMED9XU0m7smK41f:DqVmBO0MdWrYQekvILYxasV0VnhESRe
- TLSH
  T1B4C522493F8A229C986DAF3E1A5FCD756BE24A5C8D21FED690647B128C3DF213971340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Sound/NotEmbedded/BITE.mp3
- Size 4KB
- SHA256 2bf822b86e4adabce83a796de15fbbfeb75ff82c3bc1ed2a0f5286962915d362
- MD5 5436e6aebabf071c1d832071a01b8bcd
- SHA1 c7b19e1afcaaea7cc2db55d4ef74f25c0f3603e2
- SHA512 dd1851bb2d6ea5217f59974270ed59b0d7c758c862a333dcf455d43e03ba4c4484a86596c4a7b1ed46c3c671da5ede356ff5c4f7f9d93746d119f4d4332fd204
- SSDEEP 96:ZFhf4LII+bH3zOYDRweO/ZU32Q2t9C+G4DPxEv/ybbL5:zV4kJbXztak2TiSdp
- TLSH
  T177916E5C284554B0CDDC0174BDB3DAACC804FD0A3F74F4D272BD766B7435590E255A56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Sound/NotEmbedded/Honk1.mp3
- Size 5KB
- SHA256 56a240ddfbb494a6cb5c02a1271b5cc9a79217c53b481d9d3240b4973808d65b
- MD5 db2b7cf36003b2b653df6f3ca986e007
- SHA1 d61a94c7b965dec3daa6351d849fa22f646edf8b
- SHA512 3c5ba0484567bd520334837c54df160b26d3a3be952474aedf23a946369bada58241dc43a471d8e9e652e0b682599f1c5dbd03e39fe8c1f6182b806b6939eef3
- SSDEEP 96:y1tlnP78lTHmiyN/EyHhWt8BOh9N9fjbjRU/uAkorTVLnQMfkHNDa1QNOlpajdP9:iP78dxyN/FmoM+e6TVDfkD4QTjdP9
- TLSH
  T132C17DB2B9396007D86A4373D4FB4C01FB5632DA1615A3CB8BE22AF096E551CE204E7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Desktop Goose v0.31/DesktopGoose v0.31/Assets/Sound/NotEmbedded/Honk2.mp3
- Size 11KB
- SHA256 7c8864e0b63969e2469c2d80cd855648044cd15fd89dbabd275954efb7ef6879
- MD5 3b86bf25cd702a3a071590f088fabf64
- SHA1 31b279bca59916ba8202b029e7b7b808981a52be
- SHA512 b63b24259b6a2acb01f7d066fa10c5ddf4237b0deebab4e4389a40ee677ffb232baa0f3029f47e388eb1f6fbcf97f4a640e41b594ce9f0c41a841b97e471e214
- SSDEEP 192:u3r/5bBpyAxhmp57c3bgpEa/Fo1e3LtZnf+hNQ6bzE7hMWdYu8LmrgbF9fB:u3rH+P7c3M+a/Fo1ELtZfSJbgM6YumbR
- TLSH
  T1F4328D72F189007ED0062435C6DA8691F000832AF146F5CBEDD887BF057CBE28C935DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32