6ea7436d958ca1c9b2037366b6e40ac362f4f771f7fc368031ab8851b7b18c25

Analysis

user interaction
yes
max time kernel
300s
max time network
226s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidG_013d128c.exe
Size 9.5MB
Sample260812-d9dcrshr3v
SHA256 6ea7436d958ca1c9b2037366b6e40ac362f4f771f7fc368031ab8851b7b18c25
MD5 cfa4a46e61ba51fd0e5297517c2c59a8
SHA1 c823737d841096e45f83ef8ee225302a950bde82
SHA512 3ed7ec02640e2fb0f8685c6ead5faf8e9312a1a1c357c5428ee0d96cdd44a32a9badaebba7a93388b7ffc19db3a9d2d5bb775f8d57a0e017fe63c89fa305506f
SSDEEP 98304:nkJJPu6KZ6o1sw5H4BftoasojQcx91XyO6Yujw+Bm:nkJRc6isw5H4BftoasojQcx91XH6b0P
TLSH
T1DFA68C56E37800E8D4AAC2B9C7465153D771744A03B0ABDF1A90AEA12F37AE51F3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	VoidG_013d128c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
3	api.ipify.org
1	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1560	VoidG_013d128c.exe
1560	VoidG_013d128c.exe
1560	VoidG_013d128c.exe
1560	VoidG_013d128c.exe
1560	VoidG_013d128c.exe
1560	VoidG_013d128c.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	928	7z.exe
Token: 35	928	7z.exe
Token: SeSecurityPrivilege	928	7z.exe
Token: SeSecurityPrivilege	928	7z.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 928	1560	VoidG_013d128c.exe	89

C:\Users\Admin\AppData\Local\Temp\VoidG_013d128c.exe
"C:\Users\Admin\AppData\Local\Temp\VoidG_013d128c.exe"
1⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-pAlles" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__7btcict\d60a86-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\VoidG_013d128c.exe
"C:\Users\Admin\AppData\Local\Temp\VoidG_013d128c.exe"
1⤵
PID:2152

C:\Users\Admin\AppData\Local\Temp\VoidG_013d128c.exe
"C:\Users\Admin\AppData\Local\Temp\VoidG_013d128c.exe"
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d60a86-Admin.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\d60a86-Admin.7z
Size 2.2MB
SHA256 46d4d910f3e97ebb7b8bff866556cae6dfbe870c8e02c98827c7cbfc208cf747
MD5 1a29d0d16938c5b07c1e3f5439a30e9b
SHA1 1606bd6dfbdf8cb70fae6aeb3caa38fcadeb2b95
SHA512 65984376731434aed5598e71d3cdef072c4231f8a1947ac9f2c4493d8ee2ea664a70db953e19fdbe0f3d1ada3e16dd41f46d2e9cd761bc9854d91b4b7c8dbfdd
SSDEEP 49152:7AuPO47E9I8H6VlmpvZvvBqcKAMHx9VxiLBNppw2:7z7gIvVMWsyiL1d
TLSH
T16FB5330545FA4782C1B5056E0861F1727304896D3AA4C9E94FB489FFE296F0AEDF329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Browser\Edge\History.txt
Size 66B
SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
MD5 be64fd54e7f4a36bba743f42b9b7c173
SHA1 246d187d57af5a80fd876fac33b96d7471ede520
SHA512 8e24b27c432d59ceaebe1047837764bf5b3567ca5b8b3848b7b142014d83daa4edb219d6ad4091e9141c2f017181bbdb116b16ad606ab603ed1ccf3924a4aabf
TLSH
T120A02208E22280CA0B2C00303A8B8008282EA00E03882022A0C00882F808A3B02C2CF3
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Browser\Firefox\Bookmarks.txt
Size 367B
SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
MD5 1e5809dc37fdb89a5f31aefd8d07e742
SHA1 7d7e459b5709f8480d7b4100ce232c2ce1e5d1ca
SHA512 e76ec273e7a47a9ef0bd69e36c44a601bc49a51005a2263c1f1d2c115c7702045e55a8d70518b750ae8fc4ad5aae23dcb116a5f322cd7f6922f52434e985128e
TLSH
T1F1E0D8A3627241EB4F018B1870297A16644B8708DFF959DEE046247244A93A440E6B4C
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Credentials\Edge\history.txt
Size 70B
SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
MD5 3bd183c888644c4d8d042b1f89302b9e
SHA1 c68b79aa7f24c055a9e5c724775d07cef3d6011c
SHA512 3ac3f114aad9105a65f75441cbaa9784f5f8325195630db6ef05215b5356cf12f803417bb60029d53076a8fb9d1246ae34201b58da6eb86988e09abb830fe7be
TLSH
T14CA02208E22380CA0B3C00303A8F8008A82EA00E83882023B0C02882F808A3B02C2CFB
MD5 SHA1 SHA512 TLSH

Submit Download

email_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Credentials\email_clients.txt
Size 205B
SHA256 f98851768243ae20f6e1d6991a9e74fe51d120aa4598341675dc304431f5f7b4
MD5 6d1bc2075d982dbe1f42e51a5450bb11
SHA1 470932d8a65bd774fe2055b4c651584bc870c221
SHA512 7c129250425ff2959c7917fa861f9a23cd00e9d2d8f04c35884d7da3b3379b739686c2585a1b4304071b3dbe9e0dd90448962384715e99cce9474e7edd38240e
TLSH
T1D9D01282037E90238830FED43610C6EC3BD6414A32871AC3108EDF0C41071A217ED8AF
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Directories\Desktop.txt
Size 863B
SHA256 f77dfd9761322eccd4228eaf85632180790e7ca116973de39e56dbbcd3699c28
MD5 7f0888beaa5d11b09b8acc0b73b9d9e6
SHA1 41f7acb9c92163dd2e18cc1ca700a0e5ea8f0156
SHA512 5a736445a849411fb85b895195b1db5e967a1357c5a3891c7f923a3e3c352901efba74158c59cb35b1f97c3a5cf9e8e50211d58b23e22f1ddab010b9a65afdb2
TLSH
T15B11128B1534CE1F6EF135B90770700741C92ECA4D64F6613BC5CC76190673ED411006
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Directories\Documents.txt
Size 1KB
SHA256 074105ef894d571c1ca1f0ffedce67014906249293508a112a25e30a78df084a
MD5 a6028af160d7fa7c854ff452f0f04111
SHA1 5f501ca9b7120127ace243289d6e419b156e1f5c
SHA512 cd35a30ce2366715b1d7396836b39791ba99b95f32752452b55cb90b3114467abe72da0b25c36504b79808f5ebe0f0062b29beb1db26e9d30a8025d4978678b6
TLSH
T11D21F0582879ED7D1A52DDEC5F30F86345CA04CE8EA1F5277BDEEDC04A89B199000807
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Directories\Downloads.txt
Size 1KB
SHA256 4fdeb90ebaddd632632026c08744e8d4f11f1ab4b3aec8cac7956b1af82b7aa3
MD5 d455f8de423a6a94752f0825e59162de
SHA1 01e81f5edfb88824714737f26146df7c62e45493
SHA512 93a45bf71008812b4a9b48c54d950f45fc44e5f0eeec4906bf2a48899a13bfd81d965bf602e9f8f7c9da18b95b6760a35bc6431ff3e5ea2f335e34e5c7ad0d38
TLSH
T19C11EFEB4134CD1F15663F6D0751B14301C81DCA5D2AD3FE3ACF8DF4820AA656464853
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Directories\Music.txt
Size 791B
SHA256 b01e6ec0a1f73bf5659b6986e85c09aa7d599f4ef6aa98239754a3b5b4d63a5c
MD5 fa5089c8f9a9d47fcb318d58da1e92f4
SHA1 6365be01b8e4725e78cccb94d0bdeaf58b95288d
SHA512 695396ea0ba272f7b0895b55e94d9cab09554e403af4a14d5f30c0f03ffa7a5dbea6c45ffe1e06bbbefdb099873ac9840fb8638f0a8279ec1e02106e2bb966c4
TLSH
T16701BD0B943CEE3FBD917DA9172471C301C918C52EA4E87177CFC960A726B8D5863887
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Directories\Pictures.txt
Size 1KB
SHA256 fefc103e213caba4b3088a982cea8d510c01ebbb50b08c172f7b5691f2105cda
MD5 08a8104c70e340bd25e47d9ecf5434e7
SHA1 683c3ec7ee364c4fd387801fae3ceeed79a845c8
SHA512 c20974ecdddb4f75a5625c565d2229fce05985ac54fbac00bd3c85f740ac4e2601331f5a2a93d1e966df995cb6f8481896520ad12fe076a424cd2998514a149c
TLSH
T16F21E05F7A2DED204A261EB52B787487C1D0D4DD8D47F97272CEAC93BA1260E4731443
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\Bookmarks\items.txt
Size 467B
SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
MD5 98dea30b7155d5ace37749f44523438c
SHA1 6f9e7de66f62d2792eefcc130d844199d1dad0f1
SHA512 8d105b4804e6aadb379961a181effc9c6592f182ba34de63fde293d88d2591215d0b9634dfd483a63af381f989188214f91ce583e9903634fa21f343d64de519
TLSH
T156F0A763E5F1C5AD0F508928F5143109168B670CCBD9517EE046383269B63D810EC3CC
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\Email\items.txt
Size 239B
SHA256 1c0e7066dc228c73f5d0014723d2ca5af9460a2f5c92d9abf1eedd73ec79710e
MD5 e35659b415df465cc89d5f6cec62bbf6
SHA1 c172bcc60c2b024d27f9864d677caf6fb3d2a5ce
SHA512 d1eb135e57bd4e4a8a50151e51017f65f91e298a1bbb564fe0da4bc354943486919c0058f21d5ce3112bf3cdafc76ce0783d44656cc04a1b681366527c3594fb
TLSH
T111D0A702C96DD0234570BC992E50C6E03B6F040E754755F740E7E74861331EA42EC1AE
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\Environment\items.txt
Size 655B
SHA256 5c0ea19cc36ce24f635998b0da74860eadb3f2b13bae9116226bb9fe4a35f614
MD5 5ce2d29198432c074718b002fb6df268
SHA1 577e1454d8bb8dcd54a6495e7c068b46b2ad7a77
SHA512 8dc7a37b3bb612be3c0344cb2cf84b9b03dda316da24d8e78a0f2ed41748d08db73ec3cd92050f244fd6fc3bbaad49842d3aaadf3ba2b2dd520f8d1aaf5427bc
TLSH
T14DF08166ECE0F1BE00F0D63D5D831108897A281CEA48273BE2B3661F3E3403C93C9689
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\Fingerprint\items.txt
Size 429B
SHA256 644271df14052392c95e61b8bd2bd19d9480ac6850c4af4541a7bc68a924c2b4
MD5 6e10ec5d0e4f1104bd702bba3fff7413
SHA1 76b330fdaeb13bb2777876dfe35663fa7b5ae2bd
SHA512 5f118d553cbdf48935dbc871d99af8a7b61e7dde8b95e15de9e449b60a2e2d3e49ab587cbb14470041f2a1882f7114d8f5a4a889a9cb8d4a794bf4d1eecfca6b
TLSH
T180E02222EEE8C0EE2DA0A82D0E129699033E351FC045427DC0EB607A3D3215C97EC30F
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\Processes\items.txt
Size 6KB
SHA256 109e1946a29543499be94a88b4228fabc32ea4eee43c0244890f7af525d0f79e
MD5 70ffd2f47aaeef906ced1ac341138fc1
SHA1 0d8cef3b710478969d4f8c0d9c9ad5e40b8e3a30
SHA512 08fe826d412e03fe4a7918082c32d3ee299dd8e4d82cba1d1761d65a449982709f56767800bf67ea5c077c6ca78bd498e597c5c1beb739e05f13b94548b0acf0
SSDEEP 192:V25d+xeq2bZqy4q0phJ4x4AVFVTnk6qVGAW0k0HT+042G2ELGhxVShF6DLYL4kAG:V25d+xeq2bZqy4q0phJ4x4AVFVTnk6q4
TLSH
T1B9E17E21E9ADC09F157481B71AB1400316EF1D1DC009C5FABEDAD8797E3464EE2EAF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\ProductKey\items.txt
Size 88B
SHA256 f6e3c61f1b91066d5981a4b932a9f573d2d678cef5d02453b2558622b270fb71
MD5 e4857f3979642857537fd1cc63813acd
SHA1 c15ddf9e4a2dd339f36e7fa640c98ace8ff5d79d
SHA512 141d2a8e3b4feddd9f9c2d5a33da65194213d13efdc6d262cebc981fab5f9ae009381d2874b7b60d8b9372f99bbd3ea31e606bab2fff4e026fa0c9c206b4a506
TLSH
T1D7B01240C85DD146F470001214B433C0101E342B44C4046850B0D1D9743204D836422D
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\Other\Software\items.txt
Size 2KB
SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
MD5 28bd85dc25bc0c55db6291d1db885a12
SHA1 0b019bf7c9e28d7be0687733395b2fbae6111517
SHA512 d7a38124242a0f1c39c434c6c1e936ae2c09436a398e5aa733d904849382e393a0c14880e790effc1e286a284c6d4a38dc670087d120a6487f6b80734f74f03c
TLSH
T1DE51061EDBE4C0BE5F20AA939E321C30225E259FF6508A36C1EB152A6E332DD45EC755
MD5 SHA1 SHA512 TLSH

Submit Download

Antivirus.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\System\Antivirus.txt
Size 31B
SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
MD5 e2da04c91dc82476ba3aebdaa6f40eb6
SHA1 abcd50cd2dbabf56fb88210f5083ce94d5bb34f0
SHA512 735c51ad836d453deea37e2e5f44d05006bdfb433149495e503161131ec32bb01389405bb65a3207b45799e27b694708031b98a5f675346d8cbb1ab2188607d6
MD5 SHA1 SHA512

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\System\MAC Addresses.txt
Size 34B
SHA256 f55b9fbf00ebd0c94c36a60a0b5d6e58ee7ac4e8ea13d800977432c3fde2179e
MD5 1d7b88f7fdae9dded6d6be1e31d8f9a2
SHA1 acad952ecfc238c2e4821beff089d9ca9375689c
SHA512 98f9c3ef11b797904f0a318d3d123a01ca85d853b2cdec6a8f2cac34ed40a04ac7f39ad51d3fc78dbd6e594c7fd8e0ca3fa1b98988b95c25176514309bdfcc75
MD5 SHA1 SHA512

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\System\System Info.txt
Size 724B
SHA256 b4f3166a9f2969ef174dacd0b440fb6605babdba4c04c96e22067b4c956ef577
MD5 e855669419137f63b801c7b161a12bd7
SHA1 e63b873de82288d74b46af8d788f5a3b772a6232
SHA512 605bb54f6b060d46731f438b14b7b630598e84d786c31ac3b26f0bacda0e05ff8b7471d70d823b4ef4bbfddde6c71ca927ea9b64d81a65f3203164bb45cc81b5
TLSH
T16A01DCE0624C0002C3AF63F5131A5B4736F669C7269BF92C71DA82C82FE35C6D78A145
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__7btcict\organized\System\Task List.txt
Size 2KB
SHA256 f47d91cc96787d6dc107436108bcfc03378c242114c91ad3f4ac6daf67899d55
MD5 fcf13e0bb36039fcf33a824088a9b62c
SHA1 473e0a61e88c254b08bd38317c2658f3e077d945
SHA512 6fb1bb57b17b76bb3b46829ef09567cc734d50df75f3212e9f13a8859e7f4b620f0e23ccff913eca0f4139f0f576d9deb5f875d41b2a334acfc40e94126bc719
TLSH
T13C41720BC85FA1DDD6D501EF3E61164F5BAB091C000F6CEA728216EC69B0C1CDA8B71D
MD5 SHA1 SHA512 TLSH

Submit Download