cb5a11239edbeb88371388c83bc442b51ab6bada4465238981ff9b5f0375aee9

Resubmissions

14/08/2026, 03:31

260814-d28tpstwes8

14/08/2026, 03:18

260814-dtk3nseh647

14/08/2026, 02:30

260814-czm9jsbk7t7

13/08/2026, 03:39

260813-d7xnmagf337

Sharing

Copy URL Twitter E-mail

General

Target
the glue.rar
Size 12.1MB
Sample260814-d28tpstwes
SHA256 cb5a11239edbeb88371388c83bc442b51ab6bada4465238981ff9b5f0375aee9
MD5 cc1b78befb35871c23be3ff637ee8690
SHA1 84ebbbbdddb7db0995db10b9807efd3ca60d4ffa
SHA512 f4a2473eeaef04a3977ed121590ea892a148f818aed4c2c55df85d7b7a6df7e536588835b8b3c4beb8d532ef49345e338d78d4837c920ed64b371d4474058c27
SSDEEP 393216:dKZziOANtGpiH+tQ72U3UZ/Rk+iDoOxOT3y:dKtiOAbmGS/R7iU3Dy
TLSH
T145D6338122C886E8EBDCBDAF1B83F7D4D7123A56425AC1BBEF338D584D01D63618946D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cytomic - The Glue v1.5. [2021]/R2R/Cytomic_KeyGen.exe
- Size 920KB
- SHA256 5bb660213f7e3e11dd971f45431df96108d1509d33ed15713e2ce4fa03689000
- MD5 9394d0d3ea80b7bdfe0937451438d21c
- SHA1 f86b92eaa347421848476298f9fdf34f2995880d
- SHA512 1daecc3b1d6ed11b9d08f343e975182ae59340878642720ce6153b2f7edbb785264ee67d616554142c43aab5960c1ff936a184856322033f5fda731ce64374cf
- SSDEEP 12288:Uc9t2SllJ9iob+HZ21bJ2+Pm8i0Xn89QZDswqJhkESqdGopdDOXok5L1SMpB58RM:UcLjlfJDO8hXQa07NGuaXpvHpBgM
- TLSH
  T178152312F5940693D47A53759CEF9AA1E77F9C120633308BA3E6BE3657F12970227203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $TEMP/R2RCTMKG.dll
- Size 81KB
- SHA256 b2b9ea01d188bd86d522a93c344cf6dced125418430682c1c4282e2dadbad166
- MD5 fdf5eec6cf7fcc37cdc8a375e53ca742
- SHA1 15cca4451ea175d19176183b491ebcf69b89a899
- SHA512 acb3ded689cf5020a52905d19a319566944120f271cb6bad1f214962816a03688e86d9f0b8cf15e112480cc67bf1d2825d4a7c4da7b94f6e73fea79a68bd1ee5
- SSDEEP 1536:0xkrOBaezyvq+lrfFkQYNInp2ibbb+S4A3:0xkrAaezapTYIpx
- TLSH
  T1D3833A4434A2F771E52B117D735B472B5F7FE9702111E8A7CBB80D469A22B838F25293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $TEMP/keygen.exe
- Size 542KB
- SHA256 0056e0a772fb7af02dad4721e5c12028c9b10859738899a77eb477d709679a06
- MD5 12d96a6d04d57ac3a8ac8ce1c23de9c4
- SHA1 21f7a29d7a110f663fe08feb17bb1916f916bea2
- SHA512 0209227f42c5658e4fdbf61760c023b4cdd86d42590c28850835232b1712b1adf200a36aa5f0e71926e4b21f926b4d3c521023d7f4056be72231892d8e4030d1
- SSDEEP 12288:bc/kEPDonR6Y436vRrMAPMB7PKIevTYAfm0vVLbzvf3pVP+pBcJ40c5MdW1ypPDl:SLonR6Y43CMAPMB7PKIevTYAfm0vVLb9
- TLSH
  T17BC429A112A698B7F3E845B9DD35AC965B31338E83F7C8F37640669CE458A90F1BD301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Cytomic - The Glue v1.5. [2021]/Setup The Glue v1.5.0.exe
- Size 11.4MB
- SHA256 c55d3ceaf948489e25e1c44c3ef273b155622bc8d947db220ac770929c6fe420
- MD5 371b68d3a1194623987318b4c9f7d3f6
- SHA1 d334aec19ebf047b692ff23a56b430c27ee00d6c
- SHA512 cea6e09197a5d4a459cb796a18c87f0e0d451ef26a6712c2814dfc1352ce91382f873dcaaa2a5cfa1af6126b49b8c82f966156a04a66364c053766a07008beef
- SSDEEP 196608:gcqNmpuaEMZhgvGMDtyiMDKmQzWRw7Q7M8iqiYw8rhG4HYPGKOneOQfygvGJLE:saJguMoiMpwFF8iq28rhG4HYPGKmeOwD
- TLSH
  T131C6332762C74470E5A24E3A899BC14E5D5B76EC0BC3531A0DB1CA4E0EFA750EDB8763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10