67a94c59d36e53ccb75690a5d0f995476e93d17be62fe2c4234e1eea11ef525b

Sharing

Copy URL Twitter E-mail

General

Target
DeltaClient-2026.rar
Size 5.8MB
Sample260810-y6yjrasxev
SHA256 67a94c59d36e53ccb75690a5d0f995476e93d17be62fe2c4234e1eea11ef525b
MD5 d587a88d29c442ccd7da6778605264b0
SHA1 d53eae0302a2ba8435af1a25e860172e5f61e510
SHA512 6be3589d5a4fb157be25944ee122973eb01db3977529faab83a592b8c40b67d2ab02a9eaae3e68133a32056236b1ee595bea1c6451652d00fbf4d9bd69900f48
SSDEEP 98304:xsNIfK4PWkY9uUjDTM/vccZHjAsytATj+2FsTbBPJkS98VRU9j3+4jtcjxOy:x01p9uUr+djnfBWvBPJkSfzpB/y
TLSH
T14256E182D80779EC655B72170C20C43544F9DABAE565AFCFAB34490AFEA6AC018FDD0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DeltaClient-2026.rar
- Size 5.8MB
- SHA256 67a94c59d36e53ccb75690a5d0f995476e93d17be62fe2c4234e1eea11ef525b
- MD5 d587a88d29c442ccd7da6778605264b0
- SHA1 d53eae0302a2ba8435af1a25e860172e5f61e510
- SHA512 6be3589d5a4fb157be25944ee122973eb01db3977529faab83a592b8c40b67d2ab02a9eaae3e68133a32056236b1ee595bea1c6451652d00fbf4d9bd69900f48
- SSDEEP 98304:xsNIfK4PWkY9uUjDTM/vccZHjAsytATj+2FsTbBPJkS98VRU9j3+4jtcjxOy:x01p9uUr+djnfBWvBPJkSfzpB/y
- TLSH
  T14256E182D80779EC655B72170C20C43544F9DABAE565AFCFAB34490AFEA6AC018FDD0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  artemworld/.gitignore
- Size 79B
- SHA256 15b636527f8b8a212c3718e3709a490729db13772457f7d7c34e110eb811a707
- MD5 0935b944533de242b4ff6a7f8152cd0f
- SHA1 89b9a274cc7bb86ce8d11bbfd06b01f948fcf35b
- SHA512 608d44c41568f116cbcb7c7a2dd2c67acdfe7044dd875e6bdd7bf32b71d162ff042ff391f346cd5b0ae8e42f7608822f7c39941bbddb352a603603c52a3f41f2
- TLSH
  T12EA012B1044D3402EB0AD48488350120F15451E20570001B01110CA8C0334016427BA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  artemworld/.gradle/7.6.1/checksums/checksums.lock
- Size 17B
- SHA256 133adebc90abb39f12e98a8535baedfa5fcd9666b5584dc6ad6aefd621294bbf
- MD5 fa638280c0d7b026e39a689e4c8d2bc4
- SHA1 b854278289b9cee8a19d7c04f41eaab3853c0505
- SHA512 8d69364beeee9bc2c7847be2c79ea82c615a7889dec13971c6121d92fe31902f3f83d99af1c322c1c58a7cc4f7e521f82b9bbd2d1fd2abdda406a9b990bf1cf1
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6
- Target
  artemworld/.gradle/7.6.1/fileChanges/last-build.bin
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  artemworld/.gradle/7.6.1/fileHashes/fileHashes.lock
- Size 17B
- SHA256 6a6cbde53c7a788966131e31dcb9e58eae687ead3a9e69d989de9b04b5e3a33f
- MD5 7dc189e2f4d10379218ed60bc73fa8b0
- SHA1 39f2c33730efec60f4ff30843329a00272a006fb
- SHA512 2672432f9733283ca101cdb0d9ae38451402c0ea9f819f18ede435eeee59af09cf8c3765c73749cf0492faa31b9cb061a283e4fad104a6d56d75323b927c242e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  artemworld/.gradle/8.5/checksums/checksums.lock
- Size 17B
- SHA256 e6d941d8380ccb18bf0e1ebf6f6d09cf52cdfef6cce436db98fc6c073e58f706
- MD5 825bc7fd4945e5007b30601e3a296061
- SHA1 13cdd333a70d3c24143e007f058398e58a57595e
- SHA512 3760460b8c07269c164f2b5a559fc779cab2cefb8ef0e79ff1c971a1be3a5d696ff64e18a3f26fe19fcc43ea471800bbd4bb685f79aa8b6a57aa1ea7bdf8891f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11 behavioral12
- Target
  artemworld/.gradle/8.5/checksums/md5-checksums.bin
- Size 21KB
- SHA256 89b7b97a1e0396f7e7c0ba4c9cd3034e29f94c2d1733bf3469fee3278f7d8f96
- MD5 af6de61292b9e44ebd0baba006ad4b6f
- SHA1 9385f4c916b49c1f839cf2fa1f15e20042355962
- SHA512 c2cbd2a183f16fdc79957163023ccb50080e9d896641940adb73b5ca59053e5465a0155e63047797ba371f59bf7612a0ec741b668c85b6547f228951b56c4fda
- SSDEEP 96:j3r8QFhg3UUlWpOkQLpZerDE6vuUHWdUD+7:j3r8Q0xlPJ+wCuUHna7
- TLSH
  T1EFA2A0163B486405E507DAFB218D23D2E6A60FE3EB467F0C0A20FA1C967424F4B5ED30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  artemworld/.gradle/8.5/checksums/sha1-checksums.bin
- Size 26KB
- SHA256 605bf2128e96d509adb853c878c7aabe2c25a8b95103f6b19438a8982c8bbed7
- MD5 dad7f5abe74ff6918594a651d45978ac
- SHA1 682636dec18db09379598a2e94750591b36b3bac
- SHA512 adf3b559376227eed092b44a2fd0c008f424e35492dc47275f31d39abb50101264ba82dea08654b233eab3a0c1b530c93c6b160335e4310e2f0b6b26a285bad5
- SSDEEP 192:j+mhF+5Btq32hz76q9gutM+YLI+RD6uSkTA6Fc+sV:yQF+5nDnL/ODtTA6F2
- TLSH
  T1FAC26A0EB32C0034C9A755F4DE4F42DE2A315C97F9556C71FAEDF468BA721613A28B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  artemworld/.gradle/8.5/dependencies-accessors/dependencies-accessors.lock
- Size 17B
- SHA256 d3604c6f08ebd8f6b5dccfa1dba26bad291a8c26a2ee8d6b351084dac2bf3795
- MD5 12280718dffceb4211bc822bb9be0b8d
- SHA1 a63399309fa2f50927c321c5b9261f1b11575740
- SHA512 0be6418ee1d2d10b6f7ae0363b2592c057311aea90ac27debb9ff886e686f312b9b6aa60588b65a6233d61bdd19c3e78b7e21b8269d719f6db8f63dd87298a50
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  artemworld/.gradle/8.5/executionHistory/executionHistory.bin
- Size 2.9MB
- SHA256 081d47a1009274fa187b824fcab42a04c185c670b4d21b9ce10a09c341e509f4
- MD5 c7c06e616912845fd6d6709f77472120
- SHA1 425fd87d37259c876a8ed7e55f76ec8cc60a9d89
- SHA512 094c2451f9b2ae5cbdce734f2b9698c34df59550712d5d4d28e0f6f6313b317d33139908afe710a5cedc10792bed60027b0d4a9bba2e4331550a9340464c3f2d
- SSDEEP 24576:QNOBNaIHRF5V4WG2Tsk0QGV4WG2Tsk0QgV4WG2Tsk0Qq:0OxNANGNA
- TLSH
  T1EBE5295698077D99A92D722944F3D02EC02ACD79C8B47ADB635C0C12B3CBDF9F0DA586
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  artemworld/.gradle/8.5/executionHistory/executionHistory.lock
- Size 17B
- SHA256 be3e7f9b3b55ea4c3eb01edcca1fa1ccb38b8ac6e21481bb01f1c953866aa3ca
- MD5 7dd5abd26f9bae5b1b3f255d1f718b7f
- SHA1 da8a1388b3451b8505e3d48154c17cf673848aeb
- SHA512 676d06d93c3feded1b8a8a0def849358c0f449c0b53abb5a2922aa28c7ec41b7a2b98bd95817dcb1059e48b5db735c890bc41b6a61647cfd006f6eec5e1bf9ad
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  artemworld/.gradle/8.5/fileChanges/last-build.bin
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  artemworld/.gradle/8.5/fileHashes/fileHashes.bin
- Size 454KB
- SHA256 0db2f18c51c0c542e4a412601ece1cbf9f5348b4f9d200501fa7d6272bf4d336
- MD5 96a9663f118acbdcf53d3d41c35cbe37
- SHA1 37e81f5eb1f674fa1521e385e5a2bafb3d4a597b
- SHA512 e573bf838c080d47e05a21aa6b7e8276cbcd00435acf37756ba870c859773c186ff0f6a7fe4adcd84d7f82cc83dcee4930442c1e5bc39e209a8582ffd18859cc
- SSDEEP 3072:QfUp4H5AHYrdp37zLL9cOghChqYBfUTapGs7Q2jDqdg3CUCmcIlEZYxNHw/d1Snz:Qvtrz7zLLWWUm7XMsPJVdAw
- TLSH
  T1ADA40405A315A506C867EBF7858E03E4E1E60FC3DB44BF4E55A4FAAC0A3995F0B6ED04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  artemworld/.gradle/8.5/fileHashes/fileHashes.lock
- Size 17B
- SHA256 b697ef58ed23e3c000bd6b123e8797736bbbf78c74a7393e47b92b16ee5c951a
- MD5 379e8b1d611b7b5375c0395550182a97
- SHA1 2025a838f660918a7e28eb6a0323f4c7c1fddaca
- SHA512 b3d8185ac65fc3bbd6cb3a1fcbb850f437002d9275fbd3c2683277a1692d25b5f6257205418a51fb6b531e4f27f8b8ed400b38ec19b85867c7d9a2e70b77abb2
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  artemworld/.gradle/8.5/fileHashes/resourceHashesCache.bin
- Size 374KB
- SHA256 38ddcfbf42d7b42e0651923aed2041c01ce934bc70a06a54d33642c91fd85fb7
- MD5 1a74ca76f4723c438201de5d3803b3e0
- SHA1 fa4afe8aa6076ac1a31c11dd9f9f3de8b2b575c8
- SHA512 f0d62251e5194db9f82795c3057ef00de02eba60a141f7f80bb8cceb9fd02f99516390248015ff6f06f820ecb8cb69510c698216bd9e08377b0391b34744e21d
- SSDEEP 3072:TzuvQHZe/GPDZP4h6hhwpYSTIb79gE2KbqxzQrGSZiBNG5h9AeHMEHmMgvll7:hHZeePDVNhuW6E2K7rZiBNKzAeHMAO7
- TLSH
  T10084CE72E34FF53BC19A46B08F9E042F64161D239759FC6671F5BA18C0BBA24ADB5B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  artemworld/.gradle/buildOutputCleanup/buildOutputCleanup.lock
- Size 17B
- SHA256 758c720c84fa6eee06dc1aee69f4da9ebde9aad628deba4cc3d3d09fb9575273
- MD5 818b425ecf3caed87f110f328ac77bad
- SHA1 43ea161f549405e2736721d8db1aa2c7fccc21a5
- SHA512 1b9aae90cf8467937cf277e1560181811b8fe4b8f05c770b8a0e958aec6cea56c22365bd71694d84cbc0078965762ed23188c902bcb59ee405a1536c7dfe0164
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32