Overview
overview
3Static
static
1xd.rar
windows10-2004-x64
1xd.rar
windows11-ltsc_2024-x64
1__pycache_...311.js
windows10-2004-x64
3__pycache_...311.js
windows11-ltsc_2024-x64
3__pycache_...11.pyc
windows10-2004-x64
3__pycache_...11.pyc
windows11-ltsc_2024-x64
3__pycache_...13.pyc
windows10-2004-x64
3__pycache_...13.pyc
windows11-ltsc_2024-x64
3__pycache_...14.pyc
windows10-2004-x64
3__pycache_...14.pyc
windows11-ltsc_2024-x64
3__pycache_...11.pyc
windows10-2004-x64
3__pycache_...11.pyc
windows11-ltsc_2024-x64
3bridge_proxy.py
ubuntu-18.04-amd64
1bridge_proxy.py
debian-9-armhf
1bridge_proxy.py
debian-9-mips
1bridge_proxy.py
debian-9-mipsel
1exodus_coi...ers.js
windows10-2004-x64
3exodus_coi...ers.js
windows11-ltsc_2024-x64
3extract_co...ers.py
ubuntu-18.04-amd64
1extract_co...ers.py
debian-9-armhf
1extract_co...ers.py
debian-9-mips
1extract_co...ers.py
debian-9-mipsel
1log_avax_traffic.py
windows10-2004-x64
3log_avax_traffic.py
windows11-ltsc_2024-x64
3log_dot_traffic.py
windows10-2004-x64
3log_dot_traffic.py
windows11-ltsc_2024-x64
3log_monero_traffic.py
windows10-2004-x64
3log_monero_traffic.py
windows11-ltsc_2024-x64
3log_new_co...fic.py
windows10-2004-x64
3log_new_co...fic.py
windows11-ltsc_2024-x64
3log_polyma...fic.py
windows10-2004-x64
3log_polyma...fic.py
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
163s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
xd.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
xd.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
__pycache__/mock_tx_tool.cpython-311.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
__pycache__/mock_tx_tool.cpython-311.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
__pycache__/proxy_handler.cpython-311.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
__pycache__/proxy_handler.cpython-311.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
__pycache__/proxy_handler.cpython-313.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
__pycache__/proxy_handler.cpython-313.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
__pycache__/proxy_handler.cpython-314.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
__pycache__/proxy_handler.cpython-314.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
__pycache__/scan_window.cpython-311.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
__pycache__/scan_window.cpython-311.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
bridge_proxy.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
bridge_proxy.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral15
Sample
bridge_proxy.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral16
Sample
bridge_proxy.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
exodus_coin_handlers.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
exodus_coin_handlers.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
extract_coin_handlers.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
extract_coin_handlers.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
extract_coin_handlers.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
extract_coin_handlers.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
log_avax_traffic.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
log_avax_traffic.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
log_dot_traffic.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
log_dot_traffic.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
log_monero_traffic.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
log_monero_traffic.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
log_new_coins_traffic.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
log_new_coins_traffic.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
log_polymarket_traffic.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
log_polymarket_traffic.py
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target xd.rar
- Size 182.8MB
- Sample260812-27m17avvb1
- SHA256 a1f5f1b5404ac4502bf592c309db1f9871258660c9aa9488d69ecaae292b5592
- MD5 620a0e781816c087688aeacfd522ce2a
- SHA1 b14a7c83488e4e3e7dabd0fed602c73e9de658ea
- SHA512 29c40b34763c15edec6967f9f29a3fff03e50d981340dba65ea389f3e14c53b839d6d4167d5978b117f9fe4a3f97646312f106dfd65d9293017ae62f9f51c698
- SSDEEP 3145728:c5kki9mRic4frvvZGkwpABLn9uukA1EbRdNaHMnC/5MnUp2otijkWQLwZ63lvR4r:qNzYZfwuBL9kMGdNaHVasFtiwWbAvwTD
- TLSH T1F398338EA1859F288D3C01511A7CCA20C3BAD5A191868091BFF5A79E2DDFBDB75F5303
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4240 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4240 7zFM.exe Token: 35 4240 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4240 7zFM.exe