a1f5f1b5404ac4502bf592c309db1f9871258660c9aa9488d69ecaae292b5592 | Triage™

Login
Reports

Overview

overview

3

Static

static

1

xd.rar

windows10-2004-x64

1

xd.rar

windows11-ltsc_2024-x64

1

__pycache_...311.js

windows10-2004-x64

3

__pycache_...311.js

windows11-ltsc_2024-x64

3

__pycache_...11.pyc

windows10-2004-x64

3

__pycache_...11.pyc

windows11-ltsc_2024-x64

3

__pycache_...13.pyc

windows10-2004-x64

3

__pycache_...13.pyc

windows11-ltsc_2024-x64

3

__pycache_...14.pyc

windows10-2004-x64

3

__pycache_...14.pyc

windows11-ltsc_2024-x64

3

__pycache_...11.pyc

windows10-2004-x64

3

__pycache_...11.pyc

windows11-ltsc_2024-x64

3

bridge_proxy.py

ubuntu-18.04-amd64

1

bridge_proxy.py

debian-9-armhf

1

bridge_proxy.py

debian-9-mips

1

bridge_proxy.py

debian-9-mipsel

1

exodus_coi...ers.js

windows10-2004-x64

3

exodus_coi...ers.js

windows11-ltsc_2024-x64

3

extract_co...ers.py

ubuntu-18.04-amd64

1

extract_co...ers.py

debian-9-armhf

1

extract_co...ers.py

debian-9-mips

1

extract_co...ers.py

debian-9-mipsel

1

log_avax_traffic.py

windows10-2004-x64

3

log_avax_traffic.py

windows11-ltsc_2024-x64

3

log_dot_traffic.py

windows10-2004-x64

3

log_dot_traffic.py

windows11-ltsc_2024-x64

3

log_monero_traffic.py

windows10-2004-x64

3

log_monero_traffic.py

windows11-ltsc_2024-x64

3

log_new_co...fic.py

windows10-2004-x64

3

log_new_co...fic.py

windows11-ltsc_2024-x64

3

log_polyma...fic.py

windows10-2004-x64

3

log_polyma...fic.py

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
xd.rar
Size 182.8MB
Sample260812-27m17avvb1
SHA256 a1f5f1b5404ac4502bf592c309db1f9871258660c9aa9488d69ecaae292b5592
MD5 620a0e781816c087688aeacfd522ce2a
SHA1 b14a7c83488e4e3e7dabd0fed602c73e9de658ea
SHA512 29c40b34763c15edec6967f9f29a3fff03e50d981340dba65ea389f3e14c53b839d6d4167d5978b117f9fe4a3f97646312f106dfd65d9293017ae62f9f51c698
SSDEEP 3145728:c5kki9mRic4frvvZGkwpABLn9uukA1EbRdNaHMnC/5MnUp2otijkWQLwZ63lvR4r:qNzYZfwuBL9kMGdNaHVasFtiwWbAvwTD
TLSH
T1F398338EA1859F288D3C01511A7CCA20C3BAD5A191868091BFF5A79E2DDFBDB75F5303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution linux

Static task

static1

Behavioral task

behavioral1

Sample

xd.rar

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

xd.rar

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

__pycache__/mock_tx_tool.cpython-311.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

__pycache__/mock_tx_tool.cpython-311.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

__pycache__/proxy_handler.cpython-311.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

__pycache__/proxy_handler.cpython-311.pyc

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

__pycache__/proxy_handler.cpython-313.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral8

Sample

__pycache__/proxy_handler.cpython-313.pyc

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

__pycache__/proxy_handler.cpython-314.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

__pycache__/proxy_handler.cpython-314.pyc

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral11

Sample

__pycache__/scan_window.cpython-311.pyc

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

__pycache__/scan_window.cpython-311.pyc

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral13

Sample

bridge_proxy.py

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

bridge_proxy.py

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

bridge_proxy.py

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

bridge_proxy.py

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

exodus_coin_handlers.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

exodus_coin_handlers.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

extract_coin_handlers.py

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

extract_coin_handlers.py

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

extract_coin_handlers.py

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

extract_coin_handlers.py

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

log_avax_traffic.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral24

Sample

log_avax_traffic.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

log_dot_traffic.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral26

Sample

log_dot_traffic.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral27

Sample

log_monero_traffic.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral28

Sample

log_monero_traffic.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral29

Sample

log_new_coins_traffic.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

log_new_coins_traffic.py

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

log_polymarket_traffic.py

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

log_polymarket_traffic.py

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  xd.rar
- Size 182.8MB
- SHA256 a1f5f1b5404ac4502bf592c309db1f9871258660c9aa9488d69ecaae292b5592
- MD5 620a0e781816c087688aeacfd522ce2a
- SHA1 b14a7c83488e4e3e7dabd0fed602c73e9de658ea
- SHA512 29c40b34763c15edec6967f9f29a3fff03e50d981340dba65ea389f3e14c53b839d6d4167d5978b117f9fe4a3f97646312f106dfd65d9293017ae62f9f51c698
- SSDEEP 3145728:c5kki9mRic4frvvZGkwpABLn9uukA1EbRdNaHMnC/5MnUp2otijkWQLwZ63lvR4r:qNzYZfwuBL9kMGdNaHVasFtiwWbAvwTD
- TLSH
  T1F398338EA1859F288D3C01511A7CCA20C3BAD5A191868091BFF5A79E2DDFBDB75F5303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  __pycache__/mock_tx_tool.cpython-311.pyc
- Size 298KB
- SHA256 3fe68089eeb3e9523dc3b8ce01851309ae76d88d4bb2c5c9933f4e9b005b9e84
- MD5 1f42fc03db6af61eaf5dd57797acd854
- SHA1 80e519e48dd554ede9dc15543618f6dc8b16d848
- SHA512 54df2b6edc6f8858f24f4c15f31e51628039c8dff5a3909873909a335add7c03e5ee85f2ed49b39c8ad2fff84debbd4b4d30ed55aabf6b6e353c63c31f659119
- SSDEEP 6144:q8aGskMYYIF5LTMIBBG7VT5K8e/WcWOW+JA+1M1WBAWGZSUPsRycFE:W8YkRTMIBBR/WcWOWp+1M1WqU0cFE
- TLSH
  T1DB5493857B23D67BF926B3B64412270AB3BAC5F4B351C71726A6D039AED1B742C604CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  __pycache__/proxy_handler.cpython-311.pyc
- Size 1.2MB
- SHA256 7904464bb147444a81b80616c5a1ce27f691229044fa7e9700799986e364e9d9
- MD5 a1ca2a4c4637dff8ce8202969f87eda9
- SHA1 637703d467ddd82f9f9a7851aa1f32c8667a712a
- SHA512 45a9f9f4d0ac44aa056f167c0cd8e0c245ae51b47bc2c5dd40a4bea205310b2bcda85039423c6eb4bd9aca8c8021828e5a4475dab8b7cf3b6e050a10bebf85c7
- SSDEEP 24576:I1kDWfvN5ZoFh5G+8W5LC0+xDEYxCTVb62GNFqfDcB:wuWfz+L5MD1CKFNB
- TLSH
  T14B55E4A57722D67BF826B3B9C402260AB379D4F5B340CB13366EA0262FC57742C615ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  __pycache__/proxy_handler.cpython-313.pyc
- Size 982KB
- SHA256 8c5979e25cd8847436349ad645db8c3585789a058b6ef85fc64f4354658f443c
- MD5 ec6f6311016e3292f33a49669f9e3f8c
- SHA1 2ab2ff7a1b7b4b1633010eed47bdba28d1f25fb0
- SHA512 363148c589087b15a6a0716a723c379854e231d284e0d70f581ddecf55b0f153cf8363d1d8230790a9f94d372edf90ee55511df5f007e15c84efd55075b73d3d
- SSDEEP 12288:+g5QoGVIkV2rJr/cpS+Fh5GtRAFbI/Hxs4xk3dcpQdSgmhV/dmwo9UpvLb:+g5QLVT2CFh5Gt6Fs/Hxs4xk3dcVHN
- TLSH
  T1B025075AA9215952EF21B13480EA8500B37D7E87B245C673360F52346FCBBFACDA634D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  __pycache__/proxy_handler.cpython-314.pyc
- Size 1.1MB
- SHA256 94cd54853a93847c69573e7b304219057e9717f60c1c209311bbdd93ee2e15d4
- MD5 44145d0e8ca2840d8883d702c7b96e41
- SHA1 e251e0ddca1832247a703dd44b4a2c0c9a9e7ff6
- SHA512 1e223ebe2c985d2fb5b6afc045815b63d2b99a1dfc67ada75c9389e618826849fe07ef5184dd4b10c3b99ab87ccac346ea10a066b638475846d19d399d2de549
- SSDEEP 12288:Sj5nL3wrr/cpS0Fh5GdtF6iniAA6SEC/kZVSpTjZlH1EP1SeGKoU7sv:cPFh5GdtwCA648Zw9+P1JXw
- TLSH
  T162352AB49924A56BDDCDB13831D6A9D1E7718146B200CB47F42C8C787FCA3299BA533E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  __pycache__/scan_window.cpython-311.pyc
- Size 40KB
- SHA256 d986cdce11f1efc1b310037c7aced81464f82c580682ec7c534132a200addb78
- MD5 3a28e15302b8e0387503ba0ca7fca486
- SHA1 7c9f2eee631288e6e5825e439447a809fa910551
- SHA512 57c0a08d2de24ad42f686ab98f0d87a56e69ffae4c7d6048305c283edb2dae9a6fd70d3d36bf181f39c6699897843157cebe489b398a839bdb7025154fc00309
- SSDEEP 768:VIZ0xM0gp5zMmcjTP5Z1gs2609veXWpl90PMK2yWP:VIZ0xM0Y9TcjD5jgs2YXWpD0EK2yWP
- TLSH
  T12503A2956B22D67BF867F37B942B161AB3B989F0B740CB17661A8175AFC53342C000ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  bridge_proxy.py
- Size 5KB
- SHA256 3d59e2ecece40487f7f0bae7462ddb57bf6dbe5fa8167e5a1754d910544d7388
- MD5 5d76f45aafd16508c8c7dae798bffca9
- SHA1 10a8c7610dcd31f25fb1db46fa6b011fac1c8c4f
- SHA512 1d502204308069d50bede1b212b56301cd37bb3226f9815ab622094603529c17913bc4604ae2aaad80415a1603c1fcc1554b0b7c371f2bb3b2c9837bbbb14975
- SSDEEP 96:WAFXYz1d1HoJBsEdY6RUlIKPwaT4eXyH2+AjvEv4vKNMPmqemXQ/vEu3bNPwDYGC:j4M9dY64IKoaT4ghj8QCuPmqbXQ/8ENV
- TLSH
  T103B144105C6C34C942338D5ED8A3ED95F35F951BD2BF6216B2AC82991FB08A1D1B4DE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  exodus_coin_handlers.json
- Size 71KB
- SHA256 dfde0cbf6ddddcd90c9dbb21c26fbd93f667e47b427c6070e06a0ffe6a988c64
- MD5 994ebde88d6d2807732d6644f01c2895
- SHA1 25c7dde4834d058f57e7bb911c0604903f90f0a7
- SHA512 aac2cc2d87c67feb48c9d201927fd2aa0a3831cb91049fefe570dd2973dd40b2b4f9ef1b49130d150f2cafce4c30153013968a966a1d0827a5ec50b345274b51
- SSDEEP 1536:9h7Rg1NmOlMAFNAvOPbmOSuphC2MAwDOs7IeQZtc78/pG6CW:Ng1PLHPbMOs7w6W
- TLSH
  T19E739772D376A9704830D4C4B83A1204E500C6AF6855E055B7FCEF4B3F6A85999EED3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  extract_coin_handlers.py
- Size 10KB
- SHA256 bf8b476c028a478a7e2346f64d468ba9cb87f4fb40c7008d9d866bfd5389a734
- MD5 8bb913e1fc46285e0028b568d3e48e43
- SHA1 98976addadaf57cff37056e55d327bb3139cdde7
- SHA512 6b07f83f973a26492212b9ccbdfe66e3afa2e8ad35ccf1e82d71983fb376252659d8038830842304a0123cdfd572ccee85555236bd3c1d6558f85c8830c96520
- SSDEEP 192:9rqE8cb0vOLba7sr0khfD43+qaJflfwCPRb0AA60DkEzAo0eguqdDZHzd9fl3qRg:pqgiQhfs3MJdExtq3fsfN6fNRf/fxzdb
- TLSH
  T1762263D3CC45AC2201F9E56D796A5080FA09BA9B15FD3723FA6D274C6F31026DAB089D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  log_avax_traffic.py
- Size 2KB
- SHA256 6643f1eb18c05aabcee645ab3a4f049c45cbb8c528fd059c34543c1c964a0b24
- MD5 68c2a48ecb5a455ee2d756cf0b659037
- SHA1 af01b4a2ded9c52e11899b832a4d81b26df3b86d
- SHA512 c001e9101cbc089c8219d23a49a9e67fb48369966a6a4dd584f5b3d05bbd3a0b331c18912e326d9f47eb198e627994aa0970d4fe3659ca43632b19e1a902f1f1
- TLSH
  T1BC51EB625E499863C330C29D8C16C2F4F314BF1BA1926C337C0D17BC5FB89A886A80DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  log_dot_traffic.py
- Size 3KB
- SHA256 aaebc1f352fe22966d1d245da750bf4224505ddaad40d69c1b5b51944d4d95b9
- MD5 bf6c78bc4e011873952beb8aa6aeb444
- SHA1 520878dac37476347ee72e57ed5dc00666476d80
- SHA512 fb01571dd60ca91b7e5c6dd8a7234f84572f849fb6541a7ff70ef5ddc2d6fb6e3e91acdff995c76eebe36a162c212d748b3255da0cc98f8f384ab96672c889a9
- TLSH
  T1028151610E054823C335C9EEC95AC1E5F319EF1B61B17D337C6C4BA42FF44A449A5AEA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  log_monero_traffic.py
- Size 5KB
- SHA256 f48af920e193d6b05eb388bb8a89341d9e8d8c05c28a9ec4ceb009f4f5c98246
- MD5 2ddecd21c3f13e476c8ea308d008c640
- SHA1 929e5ef799f8ae84a26d44d764c7a05a819a17e1
- SHA512 780549076bbea52be208239dd2f11f90d163976a71168d6000f35be9536c691cbe3b373d8a0e6f6cb9bcc52ecee04f05a39b733668151cc044cd37a299968865
- SSDEEP 96:SU6dYeUP2t7Bk/rk/y4kMFtBwp0ExU0roAxyypI:SHMkW/A/ynMjWpXUNxv
- TLSH
  T13FC130520E569D63C338C69D6846D0E8F314EF076592AD363C5C36AD2FFC96485E81CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  log_new_coins_traffic.py
- Size 2KB
- SHA256 bdca1ba2289d17f6ac11c5d37f3129ab3ec460fb948f2d7b735352449570dc88
- MD5 2058e3054e89277da918d623bb9bbba6
- SHA1 4d29559133f7a1c2ec7404dd07e5aab136b61099
- SHA512 5ce41c0a5c450da0db0a150495de2898d2075ded868afbdd2ecf114e5360ef4568555eca90705ccce0eafac6d56f6409b558579858e530e8429d1b3d911da08f
- TLSH
  T1AD41DCA2CE422C23D374D18C6815C2D8FA14F78745924C63BA7DA7A81FFCA6445B81CE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  log_polymarket_traffic.py
- Size 4KB
- SHA256 9dce50a88a8d29ac38c2da24978f45c38a23beed73eb7c7e7ff2ee3bdd5ea0fe
- MD5 584e24d282700ec6a87f6abb68d62c53
- SHA1 de8fca23f4c97b1a7093b3aa717bda70e2f3dc43
- SHA512 6f42a7c6bc88afcb094b46cc6037213fca31ce831395e636b671645baa9110fb52e81372608e2a069308a313c799bd8908892962e552833ed7a26383efc6522f
- SSDEEP 96:Ra2DR6pP369xaox/y4lSyUMkOq5KWAm5lDwfARs5Pq57mCQ52Oyxp41/:R7DR0369xLx/yAIOq5KLm5l0fSs5Pq5c
- TLSH
  T13F91F162DE559C638335C29D1D52D1A8F329AB0B3291A9333C1C57E82FBC5A141E86DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy