d8492145a34f65d144c6b82f7293f381afe745de41d4ae4109690bb549d21f68

Resubmissions

14/08/2026, 01:03

260814-bedzpssbmf8

14/08/2026, 01:02

260814-bdtc1a1yft7

14/08/2026, 00:59

260814-bcd7pasbje7

14/08/2026, 00:58

260814-bbgles1ybv7

Sharing

Copy URL Twitter E-mail

General

Target
brbr.zip
Size 2.8MB
Sample260814-bbgles1ybv
SHA256 d8492145a34f65d144c6b82f7293f381afe745de41d4ae4109690bb549d21f68
MD5 4e309a6ea44ad15ba2c725ec2cf96ee4
SHA1 60e8a84d09238dabad5ed305da8033a7347ef86e
SHA512 5eb7d0e2164fecad1e883aafd4c7b6007bb4d618255ac5b2175af8c7d229f3aa44af044dfbf54a5a6fac18d7fb5da0377a6912e37f77c5814bb611897a5d7052
SSDEEP 49152:7C7RIsqbP7UXNE5p039ZsYSStWAH46du7oCeKRWYQWIWtIcCCiA5VSox3WWtQQwb:7QwbPoyM9ZGSBH46dID1dQWIWtI2VSom
TLSH
T161D5339F9E64A919CBF44079AD1E9E911FCB86834797E13DDB8E4E2E1361F684D03C80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Engine/Binaries/ThirdParty/Steamworks/Steamv153/Win64/EpicFix64.dll
- Size 568KB
- SHA256 ecbcd7c737624ac6b726c27194efb8864d9b1e9c31116985999352aef68e3ccc
- MD5 f074c53cc8507778d9b7b8ccf59a1f6e
- SHA1 8297ba569da386e7aa084c291330e7f0b3d1d4e8
- SHA512 4d0c2924232c513622b2908855f1e60e42dc63ff57bec7fafd3c2d298c6ef9ec5aed8ace1e7e6b2eae26adaf83689e977baea62d130926655e12fea081eb43c7
- SSDEEP 12288:aOEF/a1ugGl3CjD2KWkiIDejBjglPGQ0kisUQE:aOEFeugGYjKKWZCeljgBG8e
- TLSH
  T1C2C4AEE6F2440CA7E21BDD7CA9EB1906E661B463C334E6FB538019850F172E4B53D63A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Engine/Binaries/ThirdParty/Steamworks/Steamv153/Win64/SteamFix64.dll
- Size 1.3MB
- SHA256 802ba0bc1c83b9e61ba6cd5a1c9a651136a2e8fe01e14929f2094e3a1782aace
- MD5 2f44ee83b301b2e01ae6dbe40672459b
- SHA1 b474febd8f46308977c24bad05ee9fcd1c44a29d
- SHA512 2f0fff48c0fea44589ad7477bbd5dcb5689d85e0ef2655905183711e565e826f63068a98581e7a9b909a960c507681af0cd7f0ad216e9c97989d01a77f205920
- SSDEEP 24576:CMOLYm+3DwTzYwgYmYG0WhGxQuh28XHp5t5UR5eB3m5XrI/fFd:skm+3DszYwgugtupHjt+HeB3m5XU/T
- TLSH
  T1FC558D2DB5E247F6C839D0F9CB439552FAB47D460331BAEB065809A51E76BFA933C204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  Engine/Binaries/ThirdParty/Steamworks/Steamv153/Win64/steam_api64.dll
- Size 282KB
- SHA256 cc32880737a500b77ec7a3de1d743734a3c94011ffbec06cd14b3a967409db9e
- MD5 07d2c1aa28c8f2330c50ad7da3b8de0b
- SHA1 e71d787630b4e29823fa7da868fff929b7625ccd
- SHA512 e71357e7e1acd71af480b55678addf55267bc95f2d63ede321e22ecc4e56b318a99076c8a3b69e0480b3601905fae64f71c088df4ee775672a2285467a1625b1
- SSDEEP 3072:WjTqkh2mB9mkVi635gRaeaZqk4YJDf32uB+rJFC9R+5z65lhTbCz+hnv91vFAyNN:ub9mZOB3Zx4YUuoaRRFAymC2CPz
- TLSH
  T1D654397AA2710CF4D076C13A89561E0FF670744B23629EFF2A6053369E676C21E3B791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  FreeTP.Org.url
- Size 44B
- SHA256 485d5d193564caa0e6238dd3aec4fe0af4bc8a21163ebd931c697d62cecbc751
- MD5 5285f000e9e2e98165c19f3248feee0d
- SHA1 7438c94e9754af19a82f74be314052027ea64abb
- SHA512 23c1cb6d0ae3f59735df91c09ecd6bc25d3b42869f4f0ebd48ec3962cdb9a4208b50d85a6d8efbcab2a0f67682fe1c1c74088b8fdeb8188ff5e6ee562973d17a
- MD5 SHA1 SHA512
Score

7^/10

discovery
- Loads dropped DLL
behavioral4
- Target
  Manifest_DebugFiles_Win64.txt
- Size 398B
- SHA256 6bbfe5d5ad809e21d57498f0882d9b5d05349f1475de13390890be80b76d9ac7
- MD5 9ec5d24f974661ea2fac2617c097506a
- SHA1 9b194ee5b4f635ecc4339777a8a1cc13b77d3965
- SHA512 d34beefe48132b588a3c29ab3da51c0100d5b960278501319c3146bb9b3a1dd58139e505ae9ef1c37763217cd1bff22df7ff8b39d24213fcc3871a5550b71e22
- TLSH
  T167E02B90367624CEB1282603CE2C620BD618723F6F8B842654F02EC9EA8570231238FF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5
- Target
  Manifest_NonUFSFiles_Win64.txt
- Size 11KB
- SHA256 3489c37cb374d5351f8acf1fa54fc2b8d60dcbce447a3427bb47cba163038f4c
- MD5 d9f89e6ce373e6d3570fe073891b7a7f
- SHA1 cf5d9a8c6ba8e401429d33c149bef7acd3c6dacf
- SHA512 7a0bc11406a2906b2e2efe621855b0edff84e673c8f11c2521e1c66bae9cbffde866e9e7b89d3b7f4947eb051295ade65c4afb259d1a22f05d151c097af6a114
- SSDEEP 192:tzVdym9rKdMq8uH64ha9GOsrlwOuzzTHITMvmI9GuyrJoN0Fn4NL+HTfPN0UlSAy:tzVM5s
- TLSH
  T1B1325A9B347904DE752C1303CE2EE30E153FF73A5F9B9258A296528AB54175A34A38FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral6
- Target
  Manifest_UFSFiles_Win64.txt
- Size 19.8MB
- SHA256 3e35a2fa247b4798bfc9bef1825fcedf67ae37e3978fb9a7341f90d80f390666
- MD5 1f466cc3e94763bd4f0bcf0a9ab65cb0
- SHA1 0b6e184b47f602d45e7dbb332a5fa5acd3ae4468
- SHA512 9fce103e5b935610869265ec83178edaf28b3478bf4a7d3d1a2731147d90ae3c517f9ba6e04e950f5e9f29b38816ecc08e60cfce51c593d882ccea65cb8f1b94
- SSDEEP 393216:MUg/7eTwsP0Pig1xYJNbXLFOCnpF3NDAfEMJcFURTSZvw1TUMfQ9uU:Hg/7eTwsP0Pig1xYJNbXLFOCnpF3NDAo
- TLSH
  T19D270CB6C5FF4CE43E53DF3EA5CEB5118A447287804AA950F23416886ACA5E019B7CFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral7
- Target
  Pal/Binaries/Win64/EpicFix.ini
- Size 18B
- SHA256 106280cba2f262279bdc45081a863f28963443f7788aeb43317099f85236d4e1
- MD5 27f135033bd07cabb9fc006ba1c0e12c
- SHA1 34607d17751dffa85fe522524552eab31994f051
- SHA512 7f5026c08d56195861f89c06aabc2209c291ab93741495f292244c4141a3ea3e3b21f29623379842d654db459ba2752457e3009cd729e71ceebf1fff4d415f28
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral8
- Target
  Pal/Binaries/Win64/SteamFix.ini
- Size 286B
- SHA256 86c937762451dabc2d12774da9cd0111003284966f04708dc0bdcef16c729bed
- MD5 0b1bb45b8504f02f8e442f74c8b034a9
- SHA1 a2b1917e2b4fc079cf0e98a0eec77de0f610dd1f
- SHA512 112f4bcb124f94840a2160d3876c778a0573f3c565103e62ba856a4476becb48718cff45d836d8d04c7c884779b41eddc0cd0aeb9b27cbff02e8819c55ae9bc1
- TLSH
  T1EED095447B256375D520DD6C35E395F39ECD15A8310F0D14F5471D4F274AE98513D01C
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral9
- Target
  Palworld.exe
- Size 178KB
- SHA256 6f7b1484cedea033b6f2ebc17ca86e52428121affb82cd8e93c0cd46436878c3
- MD5 9c7bb7132cc48fc31806f8f3101c576f
- SHA1 5ee2712afa8de184e888dff0e02fa447fc020cc4
- SHA512 c9ba4634acca6e24bc84b27b4eb3cbe72689bddb0c6289d5b5480424168a934c1429c04ade91808176c303466de71868425d6210a596224458c71b85ec0866ea
- SSDEEP 3072:ro6veDO++M3Qf+2vhDOSmjIZuVgNkCS5Bn0j3Ocd5vE:8Ik/+MAfNhDxmHqFS5Bn0jE
- TLSH
  T1DF048C0BB3E131F5E077D63488E1054AEBB7B87107609B5F079446AA6F232919D3EBB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ReadMe - How to play online.url
- Size 55B
- SHA256 85b84f183b8ab69b33a9a632c82f6dc1f8c2b63d9e0d398b796a70c4bcad3195
- MD5 981da601e55137dc7f421eff38277900
- SHA1 eb18947f32134fa4641f9a3ba6b5449a22f97157
- SHA512 65044c2e9fc316fb9abf6ffcf9f45edba183d8ea08d83c472e5c1a5b98b44938dd9a81ee1f3df0271a0c143f5c6cd8cfd7c014184f862c6459e3dcb0ee8c215b
- TLSH
  T1E8900277414DC056C302088D8095D824A9422594449BC45AF5549A19D84E1E56A8461D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  favicon.ico
- Size 15KB
- SHA256 0344024fa74bd58cabd5083066b79ff2fa9efee380f5c1fb456f07e1c86646c8
- MD5 b32f6c0c2f5f52faa59069d1c17844b3
- SHA1 0906b72a709a2070c14ad20d2feb0fac864a830a
- SHA512 5d7f26c43dd1f53e38d0127c3468929b8d6ca9bd4555a29bee2c891cfb97c143949a0e5d9763273b24fb71fe40bd91b783c26ad0d7616d4e2c59648f2b9e493c
- SSDEEP 192:fQK07dhoEZSyfkXUiGTiJdNhHmi3xyehvZCMFbrlboq/tpglG:fi7dhoEIKkXUiJjhHF53cq/cl
- TLSH
  T1F0625C875F329B69D438ABBC5C16DB42697FA841F3C921375340B2259C16FE71E0E8C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  installscript.vdf
- Size 399B
- SHA256 c9aaa625aca8a5e1437953b72f0cbfe80836022c51e4333c6e27bce05ef350cd
- MD5 ef6707ed09cc22c95fdfe1cc7f8080e3
- SHA1 6ccefa783f3a189a4de0455b34dbfe183f573033
- SHA512 a63c347ba5a69087e16958feac37e0abe52512f097651d931452a935b0acf2bba5a52a9c7d0c520e8825f53219a0f0c14b75593984351c05b8b6abc5786eec1b
- TLSH
  T1EFE0F1895805C89CB072B22DCB33871C011622519A913CE51CC87FD5D3125398D479B8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13