b4c5376674dcb62846b59d978592f702c2404bc0f4ea299e79fac40779b6c51d

Resubmissions

05/08/2026, 15:32

260805-sy37davyet

05/08/2026, 15:29

260805-swzfeavybs8

Sharing

Copy URL Twitter E-mail

General

Target
Syntex Hwid Spoofer.zip
Size 9.3MB
Sample260805-swzfeavybs
SHA256 b4c5376674dcb62846b59d978592f702c2404bc0f4ea299e79fac40779b6c51d
MD5 531867015f83af80ec0c8c57458a9de2
SHA1 a8cc603d4f9cd4ea674106001f8b07730f3a2d10
SHA512 227fc4f4fa239fe015438532367645d01cfd530edab5bf97b75924d4ee3d3b33c57cf195356330bd7783842f6ecf41f7772892b6daa8bef960f20585d8d5071e
SSDEEP 196608:EKOe1HP/ZEZO1JrEbGzs50a3sskbY3T++zYMH1/:EKBPxYO1BE6u0ac3AzFH1/
TLSH
T184A633FD134DC9C7FBA64A1F6F19C9E6FB2149409925A529C7DCE2C4B3029DC7CA2188
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Syntex Hwid Spoofer/Microsoft.Spark.Worker.dll
- Size 16KB
- SHA256 17a11d101ce6d493e5417f6aa5034b735466367d6bb2a6076ed6ef8e08b75b28
- MD5 976df54a0ee3a14cf4da719a4ca5f3d1
- SHA1 0d9247ee0039f26d252ef0f7eac2a5962fd20c17
- SHA512 5b63dd925bee7bca1be4f3b134db268a180dc1644fc5d20bbe11ff3e581acc356db611c555500d15bf7427875e953797ddd513fc2c9d8033b1556340ac08a530
- SSDEEP 384:GM2CVB9lYpqTGt/2RwtKb7YUYSeflO3oVqvWVwx:GM2Cf9qcm2RwrUYSew6qxx
- TLSH
  T121729E11E7944736E9722B7678F72B11173CF7298A638F6F5950801F0D767C88722B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral1 behavioral2
- Target
  Syntex Hwid Spoofer/Serial Checker.bat
- Size 1KB
- SHA256 050b8db11906c1eace384dcd7f243b0af5b8f2144703884c27f9f8e8b73e5df4
- MD5 a58f92565ac37c8cc93c9e8447ff30d8
- SHA1 d01761e91edf78a6f9f96ce02b00b1c4bdbf7998
- SHA512 26c9840fbfecc00db76a9951bb3ab1f538b6bd4790e2408c26df7b47848946568d604f7b60fdfca871d14e2fba9f509979c26599bec575ec193cdfd9b6ed4d95
- TLSH
  T19641E311B84409E836C9EF290E3246B330A1489BC5791C8D3A9F86384F413EC7A9AF5D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Syntex Hwid Spoofer/Syntex Spoofer.exe
- Size 146KB
- SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
- MD5 d19a23517f43e45508a441d58f7c63b1
- SHA1 a4a07748a51a0e0aaa15c7b23ab98a45691b185e
- SHA512 cc8ad848199af3e3fe2a45bed81f0e75bd21d85b62e88c56563969d90bf4f0e804b30f3745cf17f0dc4c6f8d85f707fbf903d8d45b47e980bf5616a0126429ae
- SSDEEP 3072:HhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuPCRL:HhK4XycqgpfCup5sVxuZ04uhAE
- TLSH
  T17AE34A03B2AC00FDE1BBA37889A25906F77678594B7197CF0390C56A1F67BD09E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

costura discovery execution packer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
behavioral5 behavioral6
- Target
  Syntex Hwid Spoofer/System.Console.dll
- Size 170KB
- SHA256 8469deb8c7d532e8857f5c68deb291035103dee3698bf5005f4e08c5bd05775a
- MD5 e58a5726978b1dfd94b6b4cb38102340
- SHA1 d1a561662830fd01351341ca862bb93191095338
- SHA512 2d7b698720d7ab2e8535a68afa3aba41d39a888d05e59454cb7e35ee04e9e3caef52ea9be46bcd8e28c7ef4e4098f168d7d0580347a9f980893198995301a388
- SSDEEP 3072:zqPlmXCzdfd6+Vfz5mDVV9evshARZvgL4OUgZjZXR1BB1GlKi7:uPoXifd6qwV9eEh2ZvgmQ9bB2KG
- TLSH
  T1EF047D2AAFE8252BE77F857444930301D637A9C70302D6EB61C585892F43BC6FB726E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Syntex Hwid Spoofer/System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 4cd6810b4ebe8d6e1f5928f2026d257c112380d33b557a60bcfa9c7f2bb012e8
- MD5 8b5ee62abdb7b72f418d797fe73f2521
- SHA1 77582007964cbb215278267691a255b63abe5ffd
- SHA512 870ef275e1e8d1607e2b22eb25f1f05f99346b54651bc119d809bf21f1a6f041eff801b3b5e1ffbb1897975feb2c3aa47b3699cc4c63eca8e3e6a60387ab4bd9
- SSDEEP 98304:FdVXzmQ6u2Pf1F1HpwajX4p92QKxV36FChEqiPVGK5+k+uiCi:9WuuT1HSajXgJgV36FDqM5+tuxi
- TLSH
  T15BD6AE21A3C45F16E56EC739C6638292E2B0F492535295CBC05DEFDA3F13BC15A3B262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Syntex Hwid Spoofer/System.Runtime.InteropServices.dll
- Size 94KB
- SHA256 127ea3f2ff47cea14c082b2ed22066554d22c9d8f97dc0d403b17042fac62a5b
- MD5 1df866f691def4290407f5cf01b996ad
- SHA1 b2ba5af3f80aab63ef2fecf6341b44deae201ac1
- SHA512 6f96aec2abf7f6e96b7699f67cc8547334277c8e502e6ed357713c54b68faf264b1843ea42e6ab0f7c6ad7dcc1098b9042e1d5f15e93db6f8d346f613d1f6a1d
- SSDEEP 1536:4o6MupEelCtJfKS6+67NspnSPM+l5+CkmVhKWHOiOyzUizB:4o6R3lCto+dSPM+rJkm7NOxMUil
- TLSH
  T1D2935A2037C84666CA2A473C9C775D50C9B2F6C613A2E6DF5781895E1D9B7C0C3B23E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Syntex Hwid Spoofer/System.Runtime.dll
- Size 42KB
- SHA256 9c506c9347f872c3375255f744dcf83b71a96ff71cbf4a19b39873fa22f73c22
- MD5 dac7d72763e59a64c0d706325b747d92
- SHA1 5890f0ee30b86e01ab55d6017261554d16f6c916
- SHA512 4218ca96d6d2d4e24e3b6a70a87890a9035156d522d217f48999870f644548a7bc5c09b78b23de41c5974c375f9d03ed49054a173b4230ae835ff808469ce50a
- SSDEEP 768:2+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLu:KB/LuYdy50b4b7RSHTSkingzIh
- TLSH
  T16D13D5A0AE485333CD8B6B72DC73AC810DF233C4047A597ED88EE51A13867748236B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Syntex Hwid Spoofer/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 a875d0785cae18ee30db531303c166ba1a1d30c0ca4ab8edd38fe04056f91eaa
- MD5 7b3bded48604bacf38173a19cb38f269
- SHA1 9d15d2ad99f7437c9ae1775898c739712f8e5f93
- SHA512 a34cad7dc195b6c5b8a5c89e3a93083b1d401b5f772807524cede69210b04bf8fe746d9925c2fdb18b8d0f7636cfdfe48cf26fb0095500739cdc48e141bf344a
- SSDEEP 192:h7mXhp/SxgZW6sJWDWWxNzx95jmHnhWgN7agWP3zzccADB6ZX01k9z3AqRrimR:h6xiUW6sJWDdX6HRN7azzccTR9zlRrT
- TLSH
  T160724A918BA84207EDB75EB0A6FDEA823C3C67C25C11A66B16C9F6541C633C1DB3063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Syntex Hwid Spoofer/System.Threading.dll
- Size 82KB
- SHA256 15cc9db291b87042f1ab4319f8d04f4cd226f15bf88bf0810b31dcd50fb0bb7e
- MD5 932a0c2978b649703c40b260b1955d26
- SHA1 e9a4c055bc14b3a2db5bc5d0cf838e79838ce8e0
- SHA512 51d6d767425fa1afa0acd5a149b99d4c62bab174ecd7485211e9b9635eb876319e8ad2a96d9a7cef26beb855da3661b26912f05014f6dc22cffe33306d9988e4
- SSDEEP 1536:AWgoICPLdImrmODZcUBeZ8j0GEH9wd633GRm3LGgLWz9zu:AWgo9PL6FtZ8j0GEH9wd6GR4GgLaS
- TLSH
  T1FB836B197BE80416FA3B47F9EAB69906C472FCD20710C6DF5049910C2E67BC1DAB227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Syntex Hwid Spoofer/clrjit.dll
- Size 1.7MB
- SHA256 0dfe34be78144cad7db5b66a7fca3d86178ec0f353aafba6c81eb72e797e383b
- MD5 cafab1ff05ff429bd46cb78b2ff8e9e8
- SHA1 e02b3b243b6993c0add46cab15bbb6549c602700
- SHA512 f19b60d26d784b2000e67a8698f8915ef623eee074dab9b853ba927a20ff11ab267c4ba385971620470987240263f917199e1424f3d23d263382163d66435639
- SSDEEP 49152:OkM51Lv2FQJioLYRa19wEvKugOQY5iW4WGGzgdZO3Ebz8d:OBioLQi9w/5ONiVGzgdZO3P
- TLSH
  T1AB85AE46A6F805FCD0AF9534C6574A1FEBB2B81A13209BCF43F409A56F237E2261E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Syntex Hwid Spoofer/coreclr.dll
- Size 4.8MB
- SHA256 b4375494bb10be11db6134d361df2f39a7a2c7f6696ca8d239a3ed424ce66de7
- MD5 389f964635cb95c6696744f56cbc092d
- SHA1 f133da56b7ad65d162656e052c358328877db1b1
- SHA512 49dbab9c3d1e9fe506ea7e0942d431559dcaf406c8e8233afdd234bd8337f735e1d9510861c1de00b7295d5956ee166d0ad55afce2142fd75a876f506f4dc661
- SSDEEP 49152:jh3nYAkdW1bIowGlFCJvETHWzaK6YL/XPSpRdUWPfeSk5GjyuQS7bPdB15i9FqeV:jkdW1bIowcrW6p0qnWHn+2OSn
- TLSH
  T14C368D56B2BD01E8D4BAC078C9D70A17FBB1B8590738DBEF02654A651F23BE16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Syntex Hwid Spoofer/hostfxr.dll
- Size 342KB
- SHA256 130a3656b07a317f859d542c0f11339f3d0ba4198169853781a3fc04ed64c907
- MD5 00f6fc45937b885439cc6c1a34dc96c1
- SHA1 5df3efd8a49b91e5af676d35c02e75a640f4755f
- SHA512 75f088c244271142c58a7ca8f42ee68b910332ac2a23c44f7e6f6c38ff2334f96b8f28ef312a79461f5c631b07110403523b67245be8d3c7b6d0368913438085
- SSDEEP 3072:zoo0qOJezezqrPeYvCuV10J3keQRJysmFTHABK/o3BCLNzWNxEvf5NCnFeotrcRw:0o0qOqqYvCuV1jyFTuKA2zGxuIeotdt
- TLSH
  T1E3741906A2F801BCF1F7A7789AA64901E77B78454B70D6CF0390846A2F67BD0DE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Syntex Hwid Spoofer/hostpolicy.dll
- Size 384KB
- SHA256 65d61078b6b97884ad09aa12da97d96f50f7d98e6d163c926ae199f9bb58a3ce
- MD5 25fd4181ab8b572a1bbfba2f4a9ec239
- SHA1 b834dfc4c908b3cb8d3fc40771e6d0e900c7de64
- SHA512 38b708595e5a91194fdb089ae56e4051841c27406f8e770bb720ee9a5d66e6fb1ce8599f224071c2c23d30d832315c2a51a532677f121b383547f149385d1246
- SSDEEP 6144:Ux0Ke3VmzsnHpYHkGWqTRDERqBwT5eQC0+1Bs2u7FksfEXk0Pzfw:k0KWVmzsnKHkgTWkBDQq1K2vk+4
- TLSH
  T19D843956E2EC01ACE1BBB2785AB34901E7777C49077196CF13A0946A1F77BD09E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26