b3d8d66cf902aa6eb3b7faca617d8bdb7753212b791076e7fdd1929328c98c74

Resubmissions

06/08/2026, 15:04

260806-sfl55sae45

06/08/2026, 14:06

260806-redxpsxvb18

Sharing

Copy URL Twitter E-mail

General

Target
emissor.exe
Size 96.5MB
Sample260806-redxpsxvb1
SHA256 b3d8d66cf902aa6eb3b7faca617d8bdb7753212b791076e7fdd1929328c98c74
MD5 d44572c1605f78bfb9810c3f08082992
SHA1 193c3c0053e2fde7ee2e5a8076765c7a16155ee2
SHA512 0cde63cf93f30495848d890902221b081c79880658f106a1f69c18aa7eb2745868b06cd29bda0bb819b987f5318ddbaac2032b96ed716632cfe7be3ae5135ddc
SSDEEP 3145728:K2xux3SXNkZFK3PY7x5rrEnER5MUIxDestaa+gg:Ox3zISMELM/xT7g
TLSH
T1B728338CC8A41ACED93FBC358BB11A48949557B7F2978C37FB001785DEE62C9847C49A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  emissor.exe
- Size 96.5MB
- SHA256 b3d8d66cf902aa6eb3b7faca617d8bdb7753212b791076e7fdd1929328c98c74
- MD5 d44572c1605f78bfb9810c3f08082992
- SHA1 193c3c0053e2fde7ee2e5a8076765c7a16155ee2
- SHA512 0cde63cf93f30495848d890902221b081c79880658f106a1f69c18aa7eb2745868b06cd29bda0bb819b987f5318ddbaac2032b96ed716632cfe7be3ae5135ddc
- SSDEEP 3145728:K2xux3SXNkZFK3PY7x5rrEnER5MUIxDestaa+gg:Ox3zISMELM/xT7g
- TLSH
  T1B728338CC8A41ACED93FBC358BB11A48949557B7F2978C37FB001785DEE62C9847C49A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  jre/conf/security/policy/unlimited/default_US_export.policy
- Size 146B
- SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
- MD5 1a08ffdf0bc871296c8d698fb22f542a
- SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
- SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
- TLSH
  T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  jre/conf/security/policy/unlimited/default_local.policy
- Size 193B
- SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
- MD5 2a0f330c51aff13a96af8bd5082c84a8
- SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
- SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
- TLSH
  T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  jre/conf/sound.properties
- Size 1KB
- SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
- MD5 4f95242740bfb7b133b879597947a41e
- SHA1 9afceb218059d981d0fa9f07aad3c5097cf41b0c
- SHA512 99fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87
- TLSH
  T11A213B3F770AA55F17D600B839BC8A2F91CC0A3E5D63A4C028AC4301BF4A8876D51E46
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  jre/legal/java.base/ADDITIONAL_LICENSE_INFO
- Size 2KB
- SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
- MD5 71bb3ad0017bf36d14bb96a8d4b32c45
- SHA1 1a5c553e71bdb7d94995b206bc9eaa49abd1e888
- SHA512 9f658dfea71bdc3cc1549edfb5ad3171dbfa0082b2d91e820c09abe0b376b6bcd8b5170442a5e25e72274e98f130176bbdecfa7997c59705782b214f02136a20
- TLSH
  T129413262958513731BD200EA2E1C58DEB29D65BCB3190960B8D9C15D335E826C7BF3EE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  jre/legal/java.base/ASSEMBLY_EXCEPTION
- Size 1KB
- SHA256 a44eb7b5caf5534c6ef536b21edb40b4d6babf91bf97d9d45596868618b2c6fb
- MD5 d94f7c92ff61c5d3f8e9433f76e39f74
- SHA1 7a9b074ca8d783dbe5310ecc22f5538b65cc918e
- SHA512 d4044f6ceb094753075036920c0669631f4d3c13203caf2bea345e2cc4094905719732010bbe1cae97bc78743aa6def7c2aa33f3e8fca9971f2ca0457837d3b0
- TLSH
  T1F7311F3AC2441A7346C314625E1825DAE39F5C2D3F900570B85CC2CD1695A35E33B7E7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  jre/legal/java.base/LICENSE
- Size 18KB
- SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
- MD5 3e0b59f8fac05c3c03d4a26bbda13f8f
- SHA1 a4fb972c240d89131ee9e16b845cd302e0ecb05f
- SHA512 6732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673
- SSDEEP 384:sY2fSz/rGvS/66YsaZdIP3Lf4vAkMVhPGkupdDdicW:7vuvVmjkbylupdDdiZ
- TLSH
  T10182A62F770503F205C302A16A4F68DBA32BD5B9722E11646859C19D236FE35C3BFAD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  jre/legal/java.base/aes.md
- Size 1KB
- SHA256 45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
- MD5 2e33468a535a4eb09ef57fc12a2652d0
- SHA1 e64516f3fa1e72f88caa50f14b8046dd74d012b6
- SHA512 4d14b5ddbb4d09797264ed29ba71fab6986b4a9e75efb9402c1476e0a9e2884813d6a922dea125643b4f74e1f3e458f4e48d6c840e0f4d16ed72ffbc4611dbb2
- TLSH
  T1FA31776B114447F752E21AE5399299C4608DD03F3F235D083C7AA289673F03EE4F7015
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  jre/legal/java.base/asm.md
- Size 1KB
- SHA256 a2b58c7fdba022b67a694f56c38157e29d1dfe8e45394b6f74e33d905a5f019c
- MD5 40455bc36f87dd3af88252c390dd76bb
- SHA1 05bf192499de5b1368c3e5e413933a5cd60ba540
- SHA512 e9de2413841df42a5e004f47677b88dffcb41876ff410096b2f9a1a5e055e11f58911688a6e5bbf68f537ce45896fb17fad2b809fb55f0d739da3ce7beffab93
- TLSH
  T1D631A3AB22444BA759F242517516EDC4B48CC03D3A236E052CADF3846B7B03ED4BB041
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  jre/legal/java.base/c-libutl.md
- Size 1KB
- SHA256 bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
- MD5 2e89a282a50f8702e52703464e6937ca
- SHA1 cfc22a6f5b17cd539234d5b3160a5224abefadb9
- SHA512 ae459d8ce5581ea57e203088373c1ce86d122d0e27eb871ee1383e0e64cd8a184fa207eee0e835347316e70afa24a1c95aec30def3e09d15ee19a0b2c3ad2095
- TLSH
  T16831456715405BA75AD30A913DA75EC4A08D903F3E277D04346EF2555B3F32FD8BA094
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  jre/legal/java.base/cldr.md
- Size 2KB
- SHA256 8c9852c0fb411a812383a31e481fe7d1440ec18698681657f0c1fd5c7b5d866c
- MD5 f1259f314ba0fd7b89931656c0e01f45
- SHA1 998597a92a51ae132359be387ecae88034480e6a
- SHA512 6ad5e8edf7f57774844da9a42d2de4b1fd718431411ffb709abe3faa8f98bb857e11fbf452b50dd9fd13b03d9c1deb616749ac12f7a416b2c69623cb1cd95d83
- TLSH
  T16851974CF15807B067E5AEA672B4E580B12EA05EF2DB30C15C49D328216B42660B9F54
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  jre/legal/java.base/icu.md
- Size 2KB
- SHA256 8ec7dfc03761f581c0dde060b794bda2c657a9db708abaaf05be48e1889b4674
- MD5 f06c93f6e0508ff7475234cff59d9f0a
- SHA1 be09fa29c875f3957947a3a93b2d5f4063fcbd82
- SHA512 dd27147c253252e76012ce4b0c8bd4dbc3dc5e3e31cbc068438babe22ce7d54725474d30f2b075739f9926ec6477a9cf91962358c50700fa3aa2a703006324e1
- TLSH
  T13151865DF16C07B067E6AEA672B4E584B12EA05EF2DB31C06C49D328216B42660BDF58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  jre/legal/java.base/public_suffix.md
- Size 17KB
- SHA256 d9ed58c3132c2c8e82b095eb4ce24cafd1f20531c16a7c9d01f2134843904db7
- MD5 c2d4b87600e0769171f791f64283e22d
- SHA1 9474dc5d0723ca972c8e2243dfb69fbe207deed0
- SHA512 46d7a97cc474be4767be1f737513eb975eed8157e677b0cbacabcfbba7174d62d2df39519e60ab246d19ad944090bd4d68eceff5b85fb863d959ed6037e35b3c
- SSDEEP 384:gn7pa28R/9yoeF6cXpMPWeXlUl5omyzQdBGYVSleCqxi:gn7pNw/woj25kzQdBG4CqI
- TLSH
  T1938242BE3F492F730AC3C1626B0764DBE31A903925691064705CB128279FA7547FF6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  jre/legal/java.base/unicode.md
- Size 2KB
- SHA256 b94ac2343c91586806eac816d26407f0c1e3d75abe3dfe6ee19e767542f63824
- MD5 75a024fb74dd00eb3ef5c9f6827494dd
- SHA1 18ca19b9fcc66169a88f9746ae35f5728b8b073d
- SHA512 2db59652fccce036ee7afa3d58002adfb5a289ae3a21e55c327b2dd0e700a6fb76f41fb8e2a62d9964dc55ae4322e34bd85b7484a71d4681ff5ed67a0b0cbf5d
- TLSH
  T10851754CB25807B06796AEA672B4F580F12EA05EF2D730C06C49D328716F42660B9F58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  jre/legal/java.base/zlib.md
- Size 1011B
- SHA256 19abd401bac9af9b3e34c07e226de1e6f2c1f0806ffcdc3fe2f1ad5855a42ff8
- MD5 19f03867b2027801b674a81134fc94bd
- SHA1 c239d2da15dac52b8b928c712bbb29a0bc18aae4
- SHA512 e37aa89a4f46987a6bc1b2b5fad4cbf8daa1f27ca30c02bb0405512bc9de9c76b8655222b35ddb1c6aae89234edbb59b7d8b0989505cb72d216fd3d44db76824
- TLSH
  T1CB11021F739A937129E707FE7946CDD477272E14A34F46D5707D8088376722502304A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  jre/legal/java.compiler/ADDITIONAL_LICENSE_INFO
- Size 48B
- SHA256 31cf9d68e91f003b1d332f2a7517c3439e1a6571ff9dc4b740122a53cdcd4f5d
- MD5 77ab7d887e438b9c23ec99a3aaeda368
- SHA1 5b800f4216048b3210a8f4cb52b54ce9b71bd6e0
- SHA512 f21fe8675e34cadb0a25b42c9f9af11f0b39ddd5c57a4665c5b95dc9a2d9218e2ddf7a0b78065b1323e7852bdee8673a8eaeb02779ceb8b49eb2cae9526d14d8
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32