31c3aa2a29369852891abbad42ac4d25ea979a5bb0f74dd2313b4c9d5899fd37

Sharing

Copy URL Twitter E-mail

General

Target
pycharm-2026.2.0.1.zip
Size 903.2MB
Sample260811-pgz7lsec44
SHA256 31c3aa2a29369852891abbad42ac4d25ea979a5bb0f74dd2313b4c9d5899fd37
MD5 377d6f242cec9cb780155ea7905c2dff
SHA1 37c0f59dc31b8371ba8e7392e25c8420e4966372
SHA512 7204a66583bb453b73340be17f93c3506f63e1aa44ea5f9f9e04a3d5c1ffbac4c35d8283ca6698ab342a7c41a2ba6cc3ee00c6ca27060575cb9caed66d4f82e2
SSDEEP 25165824:FD5C98zhaI+HFc1ngVa4qDPuzyeDGQ0qq73Uz:Fs9eaICFc8mDPIy9Q0qq73M
TLSH
T1ABA93360FB4D33B9276500E775A24A1C9D2533A99F112FF5BE50AFB08F308A96AD41F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  pycharm-2026.2.0.1.exe
- Size 903.5MB
- SHA256 8714bd82cda11977bb566097d70451c471f73cb0682ef12fdf12ec1f3387f3f9
- MD5 a01f1ac1194908a19f9bc0bb1a3f478f
- SHA1 37946953b07cf78249d0a1d486dc9136281c9d48
- SHA512 3da0f6680aa58eeaa5f42f62494101e75ad263714588e92fb5a3928fc05b9280a99b0ac23c61064a6c35ee4a89bf7253cea4941fb02773ebc9c7e2ff6c973a89
- SSDEEP 25165824:FOul5KXs0X4a2jDzHF/WUQnoBaK8Q/n5sOJfCbQQo/S:F3l55w2bGvERJwQQ+S
- TLSH
  T1C6A9334897ED8A6FC0F50037EA430E38E6F82B399AA43511187952EB7CB7F49571AE50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  lib/intellij.libraries.opentelemetry.sdk.autoconfigure.spi.jar
- Size 37KB
- SHA256 bd950d5ab845eba05a0ab35e50d868055cbe9210a8aba78a619137701590ac6c
- MD5 d4389b6af528efacc35654f4a647f239
- SHA1 edac57ac53d1db1d48fd2e2824c786672677410a
- SHA512 0bd26eadb14d5e4f47a1c8120521bcfca918bed1aa826073b5380ee5f279557c4e2dbe07feaaaf2ce02b0fdf1ab88e16511be0b5375ce2ca2a6ed3ce7d440905
- SSDEEP 768:S7nuMuf+Q+KEGE6QcvtdPKQMoxBC/kaHka75TbZZTaBGp:S7nuMuf+Q+KEGE6Qc1dCQMoHC9fp
- TLSH
  T160030F57F1051B33ED86FFBE58630624AB18EABA801ED4159BAB12F78DDE2D47C60740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  lib/intellij.libraries.opentelemetry.semconv.jar
- Size 29KB
- SHA256 97c505c68d929a267587a8aac353ad4664f641837e8934518c56ad5874dc4195
- MD5 8b20251c7d4f54f6ed7b06e1ab283858
- SHA1 4c0655824df4ad1acc5825541ac984714bcfec25
- SHA512 760822d9918f1e6c5a79bcd4274dc588dc2632e06094e49cbda0a6a9a1366b43e141ec968bc569a110c926ad1f80fce9ab724617c4e404e797b81daa825ad469
- SSDEEP 384:S5eH0H/5kGW/zZvIybxdGVBx1E5YIYXzvH1qtcQl7/NA9:S5eUHRkGW/zhIybvaBx1e9qvQcQl7u9
- TLSH
  T1FFD2025AE3510B33ED83A7BED87323D8DB20C9750627957047E99BBF58CD258B9E0280
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  lib/intellij.libraries.oro.matcher.jar
- Size 116KB
- SHA256 facad97d925df5c408104a0a7c46ab6e74db143498b68bcc25652929ed93be93
- MD5 5dc077879223030062bf14a4649da211
- SHA1 433306cd9a00f8f44d92219b14a66945e981d1dc
- SHA512 a1dfef68dfe93a915e25e7dcb8e9614a0d8905cde60a65d8d14ff8df409f23eaccc99c21af6b1c081b5611617ead1caa651e84d625a7cf64e6c902339461d6de
- SSDEEP 1536:+SXVRwlw9vfMaqgZQ4yiqfsSItYjAqJj/eI0iOdXcofAx6tmFWuBgdtZBOk/OVYM:ha8bObDj3dPOdMUtmlBg9S
- TLSH
  T184C3D83AF15A0553E187EF7C04921B2BA332C814D4C7F2CA5B6CED43DDAB6994C1629A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  lib/intellij.libraries.protobuf.jar
- Size 5.3MB
- SHA256 3cec9c7197d1ab9de4f57b7955c337a5f7194c2542af2821b460e615f4f2ed63
- MD5 44a7537b421082758c1ae8270074416f
- SHA1 75690826804bec246ced6140007a3a77f33dd726
- SHA512 156c755ae1511dbe889fa68bb02828f466fc48f8e10a8deeca40d0fc1da1fa4e83258bb02f3b99da70ae89d1a5eb12acc871d79d3d92aa367a7e74e28cb5b153
- SSDEEP 24576:n2PfXMBt4JJAhn2y17+DlM1Wi8FctuKcGQkbArWLI7Mc1HQJETc/vyjl8vytEpcp:n2xg/vvvy2pmCQM4vnv62SeKG11
- TLSH
  T1B64665D3FAC18A77E4C0DBBA18659B0B3FFD4920CD0AB24156A4D9167EA1DC5EF122C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  lib/intellij.libraries.pty4j.jar
- Size 292KB
- SHA256 a9d8fb5bb5e7e54553c51f69278c86c2f62db14195a6962c7156a0418b28528b
- MD5 93ce6287c8f1166f52893f40714f8448
- SHA1 613eb74118ccb3253fd3c4cbc043eb6a23307136
- SHA512 41b14bcd65bf16f8c916bbed68b5ea4bffca65810abfe243ca30f0a5b03e61fcf0bcfe6e6cb0fb4e185ae2d6b9bd9c03055e0e11d275cd7425290337a150d34a
- SSDEEP 3072:WoVFkLcuAYM04fJhYqTrpeG5b0zrXsKOCpUPcsj2EfPQPN7/7YLZIZ+i1mmTnYl9:ZXAwMqTrot3nsAnM4kj8s
- TLSH
  T11A54D617E1854763F990EDBA06E3030A273096309D03DEB19B96AC52BDE37839B95FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  lib/intellij.libraries.rd.core.jar
- Size 1.3MB
- SHA256 389ef8940dfbbb5542a1e2539ad27fede9bfe25ae36d49bdbeb51e3e2e30cb8b
- MD5 9c9899baa52a674a454389e6c47a24a8
- SHA1 86a4e6d10e5b24ead1e5f286f9f13064d6bb7e36
- SHA512 afce65d7f557af99572b3f51d22cb57c4ad915f544bf1dab1a990764f5dcb575c791443790f6b9d11a225d43e8266a4be11dd666b496574a13c7a61dca87d092
- SSDEEP 6144:M/Kzsc3wvotO7NhT1B7T9OjwdvhurMV292nFm0Yw4M7aksqYysV++gJwWShouBgN:Q/oBVl9++9LBzvQ6IMDM
- TLSH
  T147559703B310AE72CA91BEBD340343A48738DEF72513B042DF55456A6EE29C7E616BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  lib/intellij.libraries.rd.framework.jar
- Size 1.9MB
- SHA256 c586323b2690e0ec14f193004260603e7468077fe5a897c9e1d8b1c4b535c20c
- MD5 9d1cfd396c39eada74ca17ceccfca952
- SHA1 b04f1291a03d8741a1373a194094d797ac35b646
- SHA512 385b1922f77384d52fed1adb2faa52685d7142ccea335e5c2ce268706da96416ae3dcb4ccd89be0f74fb5322f4d879c38e3ab387e54e22bab3acc49c6093568c
- SSDEEP 6144:MNYFHcULQcu5cjA1oFwK5L7IvqZSm+y1es9XG1I3OQBMDxLPqmqqjIHtwkoXlzzW:lHk+Jes1GOCFcjPq9lResLc44
- TLSH
  T10395970B73246DA6CDA2BDBC75014258E768DD63B903F1D2CB16466F68E2C83A531BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  lib/intellij.libraries.rd.swing.jar
- Size 149KB
- SHA256 7c82655d8185a07f9ae5edf97fc3fbf596b739f744141e692ae6896c5c980a17
- MD5 ce60f0fe4f0f691e778e8679bc249d96
- SHA1 f3820c9e70049690d26ef332e0d57c2ac1b670bf
- SHA512 bb0f5ca6e8d9fdf71589ff4c0292e927f48f6c97d0aab19147704c90929a468977d03fa64b240741be1dc5b6812c8375718856dd119d7cd70d9c95a35ea189e3
- SSDEEP 3072:MbCOAHcy6idhqDyXuo4vh4b3tpi4q8tF6imhBunhPtCfQuThaMiPHq6iCqDq3g7i:MOcy6i2yXuo4+3F6imhBunhPgXa6dy80
- TLSH
  T190E3421372101F23C985AF7D2517D2A4E73CCDF62662B042CF7209AA2DB6D479A71EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  lib/intellij.libraries.rd.text.jar
- Size 145KB
- SHA256 ff34b605ec30d73268f8aa47b4a64991cb7f904b76f7b3e9a75475d6e4b7a0c7
- MD5 ca4327b8dd13aebd6a92be6d2958cfba
- SHA1 35db4929f368f8b74f42a87c9fdfeba0e65b4044
- SHA512 f7cfaf87d1811b97f0bbef2b994f87a8a13fa3ca49552eac7727c0e897f4c3e1d98d33e1b64cc4ec33fa9a2746c057ebc22e9195c6f0ffa2aabec69994798d79
- SSDEEP 3072:MaKlguFuNSiAKvIZzycLh9lkexFC8PqpT+K8OIXvMF9DBM+G9lptQZ0cBM32q:MrhgwtHMox
- TLSH
  T19AE3741676016E79DCD97E7C2260925CC33DCEE2B493F283D65A442E1CC588EBA357E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  lib/intellij.libraries.rhino.jar
- Size 2.5MB
- SHA256 d4d1f951133fed93acb3a5f1bea591872a57ae6b9539cb4296853009c5383df8
- MD5 e9b39651861d23cfa49f3411ef100519
- SHA1 c592253f87fe65e4614a34090fe43b81f09b1b53
- SHA512 00ce7ab6b44e6dd2323efaff9c374e19f2ca9dc48b3adf41ff7e8351874643af507c044b430ab6621661656cd129cdc4ff5069e5cfb985165f91fa0171495d0d
- SSDEEP 24576:CD5GFPWwUA7Qx8Rxo17gbGSsIWhbgXvMMCN4HbbA:U5GETCXEMHHbbA
- TLSH
  T1CCC5B71FAD10D683E244EEFA28B1D324922171704DD3EA55CB85685BECE2FD90DE27C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  lib/intellij.libraries.semver.jar
- Size 132KB
- SHA256 982bdc603c7f310a4ea2212b4bbd58b5b0b4b3b348c092388302ce833d730e25
- MD5 a571bc9c5c9ca226ab83eedcbd23810c
- SHA1 2b7e886613b84581a62b5d9ee1f6050bb3dc8f69
- SHA512 8b06abe3e5220ff5391aa8d8facac4d61ec82f255c7f2aa2ac0fdcf55354824ad549edb399894802c433580ff78e528a159a3db98d2cea85ce43ef5ce347c7a3
- SSDEEP 3072:MGq2WiOuCqFjIlrE5nj6EcW6FPTJuJ/kK/PqBzHZFXt/aON57p:M+oPYkT
- TLSH
  T1C7D3C68371603913C598FEBC5BD2926003BAE376F906E5E18BEF04A3F8931576B93954
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lib/intellij.libraries.snakeyaml.engine.jar
- Size 648KB
- SHA256 4cacc0c285125a5648d2648eeabb3e89d7af7335bf3f32aad05ef06d8d1ca939
- MD5 dbf443e5b369e1f88fd7104299b5a26b
- SHA1 1139359c58dceba8d147a4f25ad8691538ae2bd2
- SHA512 04d09a27ffdf375357c4473e5c7954c5c0c68b9851a17415996f53345b011f5350a237a20a750ab7c7153674251bf797fcd4e6ccc688e46e75b09813b7500cf5
- SSDEEP 6144:sexzo6Y9mnua8Em0lb0natjGGEJrm9Rpfe4h4wezoICQsL73rKONvcLlcw85eUef:l/ICQsL3BHw8HGpN
- TLSH
  T10AE45327F2F21D3BE248DBF8A85053311128636379CAD306BA8E5D52BFC7D51BA0E585
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  lib/intellij.libraries.snakeyaml.jar
- Size 716KB
- SHA256 af096a1daee50f8011cff49692cf6ffc93836f73966f2e65c156b78955a8248a
- MD5 928ebbd62aad4169d21f3bb0d940145f
- SHA1 82bee9cd4967ae30e0a99ac0a6a6d5f82a0e456d
- SHA512 7ecbae770de3d3f9837b9774a2cf200ba185e4f7edaa33c0c1771ec5d0d1087a4ab2732c76827b35ab0f2b4965a66668f6271dadd45bab1033c96b6f1f1dc6b1
- SSDEEP 6144:sixyc3Eje6YSFmWYB/xv6nazVG0GJC9opRHjjQwwTN2QI3WdSmoOs/zg1i0F4V//:pmWNc/HOs+2WeQTzgg/O7h
- TLSH
  T1D2F47217E271790FF2C4AAFC1C5052015220F22361C6E353BA9DAAF6EFCAD5189DE18D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  lib/intellij.libraries.stream.jar
- Size 855KB
- SHA256 9445f5786523f9abc738fd9f007e0647e9ef5fd4c0c7e0ba232393de821c0e7d
- MD5 ff800ab9dc94918818fb627645dcddb2
- SHA1 516c05a67ff267a0bdcc8ece76e6d6005b450e86
- SHA512 1e228021af4bb4087d05fb84d907a32205cc572e2b64224bc9fba32b8b465e895b270d0d8d6730cf5a5317bbb6006771ad204b6846258c81a154829562e448a8
- SSDEEP 6144:60WB+uob70YbiDmc2Ep5IxTKma5HtC7O1AwIVruuGZJe3Qlk5eRLjcUnMrQO0WBt:J3n/TKmP7HwI8uGZJbDxjP2h+g
- TLSH
  T1A615311BF04A37B3FB45EAB8104B037461A4D1329D03D151FA089895FBE31D7D9B6EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  lib/intellij.libraries.velocity.jar
- Size 1.2MB
- SHA256 a2edbdf7336f2d2734035aeda6103b1376309b053e3f1f9a90a82cb806b2780d
- MD5 41689fa0ec4a4e25b9b6d789f0fe7da2
- SHA1 976843ba24b4e84aa87d0f2db5fe7be9930b5563
- SHA512 4c049a421c9667c385fa11854fdb146f971c9f3d2041e3065c5360b0bfac4e5b315f649e74043fb5af1d9e242603a2079ea289ec8ea3eeb72f98a37a1aadaa39
- SSDEEP 12288:wuzPgIzThzCabzie/pmKy1yDgg3CU7DG9YccO0F:reLyAk3
- TLSH
  T17345C703FF419623E642F7BC9C6346409772D062C143E7C67F9C59ABAFD69818E066CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32