General
- Target BTMOB v4 OwnzTeam.zip
- Size 86.1MB
- Sample260812-xd722ssgqf
- SHA256 5f366ce64e9cedec9f18a6627b7372fcb80f888f241be77261108e19db4292e2
Malware Config
Targets
-
- Target Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Nots.html
- Size 19KB
- SHA256 1f0528e739f8c904ba0d73633206bbeddeaf025323cd144697970b536fde6a9a
Score3/10 -
- Target ObjectListView.dll
- Size 434KB
- SHA256 0b94b3824761723400dc0357e7d490085a5ccf3415e332155c5b8d6c7bfb8788
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Resources/USERS/58521420470604124/AppsManager/AppsManager_2026-01-17 15-11-41.Html
- Size 43KB
- SHA256 204c53e926dc64c7826dbe803ce119c90790b452cd1ca084c0f5a6a71bfc2515
Score3/10 -
- Target Resources/tools/AdbWinApi.dll
- Size 95KB
- SHA256 d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
Score3/10 -
- Target Resources/tools/AdbWinUsbApi.dll
- Size 61KB
- SHA256 25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
Score3/10 -
- Target Resources/tools/aapt.exe
- Size 1.6MB
- SHA256 aa18b5646881ff3b8ca9879045a1b4a44e2d5b24fbe14486fc8236789de8237a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Resources/tools/aapt2.exe
- Size 3.7MB
- SHA256 fb89f3b5406a5fa3a0849b057063c4205d0774c7f363d055048e35313e070b79
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Resources/tools/adb.exe
- Size 5.7MB
- SHA256 348179b6593cf255bed4f79df4f298a8d449230f596ae033e29f5d28647803b7
Score3/10 -
- Target Resources/tools/libaapt2_jni.dll
- Size 4.5MB
- SHA256 a439a9bc2981c5f11a2bb75578f66f2b5b6afa328af05f8139321ddfe8322fad
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Resources/tools/libwinpthread-1.dll
- Size 76KB
- SHA256 3f41452eb1e3aac78fd29e83a530154ff8ae66f2e70a9d54b92ed49b57cdf2fe
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Samfw.com_Odin3_v3.14.4/Odin3_v3.14.4_Samfw.com.exe
- Size 3.0MB
- SHA256 681ca9899151eed596fbe7b271af5591e0f6ff84d58be153eea464bbc2fb52e9
Score3/10 -
- Target Samfw.com_Odin3_v3.14.4/SS_DL.dll
- Size 2.4MB
- SHA256 66047e604bca2ef6562059279a33865b80554535a051fc58919a1227674f4d2c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Samfw.com_Odin3_v3.14.4/cpprest141_2_10.dll
- Size 5.0MB
- SHA256 63ac87ea205aa20d2ca2de8cd151d4fa69f76506c1e2e15464ed97311873ef20
Score1/10 -
- Target SuperSocket.ClientEngine.dll
- Size 41KB
- SHA256 9863a8ca0fd55fdf1de8d64cb89d034fc009a58220d45c5f4f83c6cdd0c5cbfd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
Score1/10 -
- Target System.IO.Pipelines.dll
- Size 82KB
- SHA256 f19d78c5cffddeae66a79d772fa0ebb30c101912fe7cf7541913308b54cf79cf
Score1/10 -
- Target System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
Score1/10 -
- Target System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
Score1/10 -
- Target System.Runtime.CompilerServices.Unsafe.dll
- Size 17KB
- SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
Score1/10 -
- Target System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 fdb1e5eb6ca30808e5d2d49799b85107db77b37c1517b2cad37a8f877d5f6aca
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target System.ValueTuple.dll
- Size 77KB
- SHA256 d6fb0dcfee1490a8168117ed1b55758f11db38475417b3668d19f89dcb55cbdd
Score1/10 -
- Target Vip.Notification.dll
- Size 18KB
- SHA256 f9dad39071be70c609f5f602d93ff77c9ffb25ed30aabf1d576f51ecc671d7fc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target WebSocket4Net.dll
- Size 60KB
- SHA256 a8550b9c7b6895c18e73b903064511b99982bd9928c7dcefaac14b592d201b73
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target block.html
- Size 32KB
- SHA256 de2817893baab1205aadaab3dc5195e9d1ab2e43ba65a7f83866ffe693698ad7
Score3/10 -
- Target ddsview.html
- Size 39KB
- SHA256 de89a3b7b9e0c2a5d5492e9367f96beb8ba73c43876f8ca7e6d0c803d812635a
Score3/10 -
- Target runtimes/win-arm64/native/WebView2Loader.dll
- Size 136KB
- SHA256 027128c9584dca50d36318458964bc88eba8578313857998ff300312ca7f2101
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target runtimes/win-x64/native/WebView2Loader.dll
- Size 162KB
- SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target runtimes/win-x86/native/WebView2Loader.dll
- Size 113KB
- SHA256 27e15425216aa919f6c3b1dd6132e305911582362074bb06b2a68c49f8ec053e
Score3/10 -
- Target topcli.html
- Size 168KB
- SHA256 b6169e4c55d668dfe12391452bba23c87eb22bb2bd6db7684d4176de631067d3
Score3/10 -
- Target upview.html
- Size 15KB
- SHA256 f19907b4ecc71f60e1afa9ce70eca7901fcb3bae32f1d5afee11bd9357bef3db
Score3/10