8689b092e0486b0a6870ba8e6c479c67bd5a64aad434cd6bc4259d73d37f267c | Triage™

Login
Reports

Overview

overview

7

Static

static

3

Setup.exe

windows10-2004-x64

7

Setup.exe

windows11-ltsc_2024-x64

7

d9xmei/CYG...ll.exe

windows10-2004-x64

d9xmei/CYG...ll.exe

windows11-ltsc_2024-x64

d9xmei/SLABBUS.sys

windows10-2004-x64

3

d9xmei/SLABBUS.sys

windows11-ltsc_2024-x64

3

d9xmei/SLABCM95.sys

windows10-2004-x64

3

d9xmei/SLABCM95.sys

windows11-ltsc_2024-x64

3

d9xmei/SLABCMNT.sys

windows10-2004-x64

3

d9xmei/SLABCMNT.sys

windows11-ltsc_2024-x64

3

d9xmei/SLABCR.sys

windows10-2004-x64

3

d9xmei/SLABCR.sys

windows11-ltsc_2024-x64

3

d9xmei/SLABSER.sys

windows10-2004-x64

3

d9xmei/SLABSER.sys

windows11-ltsc_2024-x64

3

d9xmei/SLABUNIN.exe

windows10-2004-x64

3

d9xmei/SLABUNIN.exe

windows11-ltsc_2024-x64

3

d9xmei/SLABWH95.sys

windows10-2004-x64

3

d9xmei/SLABWH95.sys

windows11-ltsc_2024-x64

3

d9xmei/SLABWHNT.sys

windows10-2004-x64

3

d9xmei/SLABWHNT.sys

windows11-ltsc_2024-x64

3

d9xmei/UNIN98.exe

windows10-2004-x64

3

d9xmei/UNIN98.exe

windows11-ltsc_2024-x64

3

d9xmei/uninstall.exe

windows10-2004-x64

3

d9xmei/uninstall.exe

windows11-ltsc_2024-x64

3

setup_9x.exe

windows10-2004-x64

7

setup_9x.exe

windows11-ltsc_2024-x64

7

setup_xp2k.exe

windows10-2004-x64

7

setup_xp2k.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
USB-Treiber_V2.3.zip
Size 8.9MB
Sample260804-gzmegasgla
SHA256 8689b092e0486b0a6870ba8e6c479c67bd5a64aad434cd6bc4259d73d37f267c
MD5 352a72db71aa1bdf4b1bb82278d48935
SHA1 0c470fb028c6cd8a2674b894c1f560c831e72feb
SHA512 26a81a168bcc9432e4137de3e86fbd56f9438484633adf9adfeedf598a30bcdf02adac9e6f1ae437504dfb78e86c471976db2570ada4d56ef073c91a90e39182
SSDEEP 196608:jAfJGOJAKJyLhBV5XxGSoIkLCr4xg3mJNc8tf8DR5ze6G:jAfgOJKtBV5XYSoCSbtE3zed
TLSH
T1379633A769C232F44160FB6ABFAD524081AD87F6B35C757B47921C3BE711E3B226404E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Setup.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

12 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral2

Sample

Setup.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

12 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral3

Sample

d9xmei/CYG_Uninstall.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral4

Sample

d9xmei/CYG_Uninstall.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

d9xmei/SLABBUS.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

d9xmei/SLABBUS.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

d9xmei/SLABCM95.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

d9xmei/SLABCM95.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

d9xmei/SLABCMNT.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

d9xmei/SLABCMNT.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

d9xmei/SLABCR.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

d9xmei/SLABCR.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

d9xmei/SLABSER.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

d9xmei/SLABSER.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

d9xmei/SLABUNIN.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

d9xmei/SLABUNIN.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

d9xmei/SLABWH95.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

d9xmei/SLABWH95.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

d9xmei/SLABWHNT.sys

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

d9xmei/SLABWHNT.sys

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

d9xmei/UNIN98.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

d9xmei/UNIN98.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

d9xmei/uninstall.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

d9xmei/uninstall.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

setup_9x.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

15 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral26

Sample

setup_9x.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

16 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral27

Sample

setup_xp2k.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

10 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral28

Sample

setup_xp2k.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

11 signatures

150 seconds

discovery ransomware

Malware Config

Targets

- Target
  Setup.exe
- Size 474KB
- SHA256 a895b8fa84f355b41508a069e8b2c3c97e49fafd427afdfafd0b57c0bcbb19c3
- MD5 413eff425aaaafe3589c69dffd3083d3
- SHA1 d9832479b4d86087aab1d19d79c90d7d2cde5523
- SHA512 0c03933e89c1ae5f1c573b5b214a44f28d242924759281c6ea72452d7ce8211248ebd460c003757fb92b99f6472e2896c5fd5fa91ebfd6610b9c7a799e2d25b7
- SSDEEP 12288:wAGQ/9wRWdcARwQztXl0Tc3GLdpHJhsAD+Tifa:wApCQcOpXyjNhsZwa
- TLSH
  T12DA47C22B6F1853BC0631FB89EFBA365A43EBF112D2805476BE01D4C5F396913929397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  d9xmei/CYG_Uninstall.exe
- Size 64KB
- SHA256 d907e7b971673d374cee0df322a1f89d77ef14599910c886caa6ab3a1c92f076
- MD5 043f3884181271183f36d711147880f0
- SHA1 e8b7272a7e291147e8b287f631ebb06399d8ec4b
- SHA512 68e9844caa678dc6ede246d18d667417a94fd0bc5dac1bd5086affcf2fec325f324d8cadb1a555960b39edaefb75b26e4341e599fc78c93f494b84c2f3422f5d
- SSDEEP 1536:vPE3OSJiG+3TEwEqp9vragBZBoC+INtE:v+SEArBZBoC+INtE
- TLSH
  T1C9538E137EE118BAEC64137415A60BB4433E7C840A3AF5D79F94DD768C3B4AAA635343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  d9xmei/SLABBUS.SYS
- Size 51KB
- SHA256 b3e3f102fa018698b30e3e80d8487848735dd6daf5bc4c2c20f438782c0cc63f
- MD5 886dbe1e6de104591e8b7334b6d42ed8
- SHA1 f9020c55daf0893da45a7c2b7c3194f63d3a3300
- SHA512 e9aa42a35aa9efa776e5c80afd043c95f2f662b5b11f26303b389784c97ce005bc9bb368f18a88d06b72609e094cb85f2aa63cdda52651345d5606db487d321c
- SSDEEP 768:UdNhWRoR2OQKJPmdrGST9ZTlvlm7Fr++47Gb2R7C0GK2ien9lLQO:UVWRETQK8dr3UE+wGi7MK2ie9lkO
- TLSH
  T14E335D62F7C10C76E4F31AB08AED37A07377B5611B07AA6B871419453E61E80E973726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  d9xmei/SLABCM95.SYS
- Size 10KB
- SHA256 d2917fb4ecb692d1e96ffeac83ca803c593df4dafbbb94680ee0ab908cc4cce8
- MD5 5ef05cdfdeb93f63fa99c90ce5e892a4
- SHA1 2fcbeb10529cd3a7e0ed73558b619542e6a80326
- SHA512 93199f788b13f25c9c10af89330173c4fcf8b0888b1ff5efa1262d40ecc4243325b8640eb272ccb708623764ed527c9ba97ba7e8fc545ceef52ac3954f5917c1
- SSDEEP 192:yMJ/djjEkWQWPGlFFNBc1wxExCCxq9tJE0QyuH6cBfOX+6IItQR9X5s9AUZ:jJnvFN+1w2Er9tG0fuH6+TiQR9Xt4
- TLSH
  T12A22F902CF47DC3BD9A20A711CB35358E53FFC3847A7860B0B4615495EA71CBA95A2AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  d9xmei/SLABCMNT.SYS
- Size 5KB
- SHA256 adf5cacb3f94255856ab0dcad6ada5dec1cba347275ba54138fd54be637467cb
- MD5 d93fd96d629adcf8ae147a391ecc4a40
- SHA1 8180157ad01fd9d1ecda468ca4a153fa884e5660
- SHA512 5c339f7c7937f8fee2103803a781c69b6578a66af842667c3b37e0cfd4f6e23cc9895eb126ecd7e872a729ec0237e961693d5eec9a54a09c21507af330837241
- SSDEEP 96:W7Cg7Bm/nmo4jWHMguH6cBfOX+64Unw9aQ96JZCc69H:W+/N4jWNuH6cBfOX+64Unw9aQ96Id
- TLSH
  T1B9C17553DF52CE26C9E21DB04DB787086C37F4182E4AD40E875A0A497D0A5A958A73EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  d9xmei/SLABCR.SYS
- Size 3KB
- SHA256 65fbcd86ba0fcb5e7886db1775858c2d4f8773ed8deecd4f5bc1a18c3983a5a5
- MD5 76af26814d7bcb416e145d47d416c61a
- SHA1 0a616675a32363125bdda02871e491d03d546f50
- SHA512 a7b542562720b9c77e6b723b68985d33ca3aa398c3df373b7f551aada0f110acb8587c8310a47953e538a0b7dad77671dc2534b35627e488ea20ee7c08f20243
- TLSH
  T1DD817522B6D4041FE5FA157035730775623CFC309F32966BBA6C02B22C66554DE63323
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  d9xmei/SLABSER.SYS
- Size 82KB
- SHA256 0c0d14ba3707f29a1d24ce5d9773fb690564268c6fc33c8bf873a6ecdb5bc521
- MD5 2f3a6eebbbbb158caaa78790fd49e7c3
- SHA1 65905aa25084f1b65fe8cfb706eb0790aebdc8e9
- SHA512 665244aa30119f0f3d5d2d6989083ffa85bfb020b79d8ec9bae2b002679f57298306110d00d4ba650c051c8a809c6f0eef46ffd70065e7163206463020b171b8
- SSDEEP 1536:FGxYIUQ+EPNW2unlv6SBR5Dlkzd9EEqjB0G9ejh2PXazVP:FG+IUBEPNDASSz5DW9EEBG9ejh2PXazR
- TLSH
  T13A836E41B7C78C73C5A726B199793365723BA5211A5AFBBB433C2C4C2F36A90B911723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  d9xmei/SLABUNIN.EXE
- Size 28KB
- SHA256 ab0056482699cd1f97c7c58aad328467a45eb5f1538c641871468bac85c6ac53
- MD5 0fa6f15be157ea679d4a6e360cc08b4b
- SHA1 a8f16373e6ead7b719fd4dfdeeb4a7fc026ab08e
- SHA512 e7da22f362f1f7b9933fa926edaa322915e0a083ed81d65cdb7713f8dda446426f06dac4e52d80ad3c683b638bccc67df1e5f23d869e40407780b34e4d59d4e7
- SSDEEP 384:VfbP+OYFy+Xd4I67OERIZqN9V604l4vUV:9+OOy+Xd4I673NHPn8
- TLSH
  T1B1D23B5B7B130AB2EC7489B0366E76769733540ABD7095A3D794CD19083B201EC3B76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  d9xmei/SLABWH95.SYS
- Size 6KB
- SHA256 b121be0894f0c89ed420424f35f2e4202fd711d86d5f8fd0ffa9d4e13ba35043
- MD5 3aaa06ffeeaac2fa1db7657209b4518d
- SHA1 871e82e295f9a03a4515b56d5b9db31d5ff2b18d
- SHA512 9a78b212e691ffea77e039d6454fc685d4496c32396c4889d3e2592c1e76f5a54fbc4617b6e1172b515d6c67caf13ee5a203b91e17be91914312664627d43105
- SSDEEP 96:Y0oQdPxmLiacB2zERaG7eYnzfbe7cBfOX+6wCJTCF3olAJL:/o6PaIB24X7eizztBfOX+6jOFhJL
- TLSH
  T160D18310EB22C92BD5220CB52CE3431CDA3BFC649B6FC6474B8612945C935D9592D3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  d9xmei/SLABWHNT.SYS
- Size 5KB
- SHA256 b053b8636482290e91b38f1b64e29bfe124732071a31b0bb9bbfe097202169d4
- MD5 058343a08415b084a25c2138bff6cc3d
- SHA1 8888fd03375447d23fcb1da310379ba86ebde5bd
- SHA512 ad3e760e4a0f118ebf3778acfc9c9fe68959baf17e4f32c6396b3c98150167751d036ae93136c0f829daece7393d2e2af0aaf64c4c7d8f7602aaab54a9f7faaf
- SSDEEP 96:wAhQOjWIHwcBfOX+61hUnw9aQ9PEJWC7391vD:wAhQOjWIDBfOX+6vUnw9aQ9wr7t17
- TLSH
  T123C18653EB56DE26C9A218F00DB7434C6D73F0481E99C91E47EA0A5C3D4A4A4A8763EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  d9xmei/UNIN98.EXE
- Size 204KB
- SHA256 9fb2a4950f25c074e5ec71f54c953a19732e22e2a93abb3ec2aa8db79ee29d79
- MD5 36129ee5e3c91879e40a03e391aaafff
- SHA1 8b83756f05ee6474c68937f3a47d16a2b821c42a
- SHA512 1f8cecdda8f7c6af39ec5f6788068bdb0aa72b5f19b54ac9a10d9eba0afeb4aab21ad8d511c262ee33c034bfa3b03bf45dfeec1474d75684ba8f81e277d90d74
- SSDEEP 3072:ZwQbHZ7225Jct5KpGxexbmXoEWUevuzFomDmc5Yb3m9y7zZqhAS3l1KeEPSEMW:ZPbHl2Gc/KtxbmXTWEIzKfKeEPSEM
- TLSH
  T1C9149E2374D1CCF3C96042334CA397AAA3BCE42447919B1763E8AA3F5E6B6C51F26355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  d9xmei/uninstall.exe
- Size 46KB
- SHA256 d111f2ca394df3dd9067a700c610ac4a13c58eab70154b07c8981ab8342b3544
- MD5 1661af4f8a6dcf49549493d75a894344
- SHA1 cc6656f38a69b9a29f250b7e9e24f5babd4a1991
- SHA512 758cb887226d50417b8dbf26e58fcd797348f854257bcd334153836d84e06257511789e190ccfd3ee55afcea5e191f6a071f0e578f555b2204f9bbd6bc9c2f53
- SSDEEP 768:Q5sy/GSZlKFPpOMJ85Bdkjxal6rRtq9/e:QHGS+FPpOMR9RtO
- TLSH
  T1A823B80223E98619F5F73F306AB462250FB37C91AC3CC64C0289952D5AF2E91DD75BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  setup_9x.exe
- Size 6.1MB
- SHA256 ad7396d0efca6d14b654bc0ba10506e46a4839613fbc63a4628db57d1910d699
- MD5 5c659412d36802243ea2e63e930f2084
- SHA1 361e6a3d4d29253d39596936e5afa026ff7b5690
- SHA512 88ef47a0f0f36ea6fc4b91879f2be65d7ce9b2b15c362fcd2a5b7735f1b2efe9c8d7e226310a233e24846802444efbf36acf942cb78a60dac41cb6aecc74a689
- SSDEEP 196608:fHqfGMkASVqV26hgDneS+lrHNQicHkRYa3MniY8I:iuMkqE5AtQiZ1m
- TLSH
  T16256CE30BD92ACDEC3A280B510D9276F40EDE5D639B06D6DB6BD36C112C68E3D1A6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  setup_xp2k.exe
- Size 4.3MB
- SHA256 400330ed6273449be488a680df3b519b6fdb7a36d2e1193e0fb5fee0bdbed13a
- MD5 0b159843e2981f4399d37f41a3ef3183
- SHA1 492aed8100df53190b28720899e07ef7d3214c1b
- SHA512 e519b394c1175068a1e771f38b98cec15eb4245282984d0d31f3e8a93361177b601ce7d7f269ed7f16115208908b4f3db1281cf27b6d57a02d555d07bc15e5c0
- SSDEEP 98304:ffdqqkfGMTPQLco1gufrVqVxt2i4U5xMTkzkTAeyj5j6WlcV:ffkfGMkASVqVxt258xQkzQAeyjNs
- TLSH
  T11826DF32BAEB6E55E309E47C7CD013EFA25E4CC0A5566853227E2DDB11AC8D1AC84F47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

discoveryransomware

behavioral26

discoveryransomware

behavioral27

discoveryransomware

behavioral28

discoveryransomware

© 2018-2026

Terms | Privacy