Overview
overview
7Static
static
346dbed7b72...b8.exe
windows10-2004-x64
746dbed7b72...b8.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3ChanoX.exe
windows10-2004-x64
6ChanoX.exe
windows11-ltsc_2024-x64
6binaries/R...re.dll
windows10-2004-x64
1binaries/R...re.dll
windows11-ltsc_2024-x64
1binaries/R...ms.dll
windows10-2004-x64
1binaries/R...ms.dll
windows11-ltsc_2024-x64
1binaries/R...on.dll
windows10-2004-x64
1binaries/R...on.dll
windows11-ltsc_2024-x64
1binaries/R...on.dll
windows10-2004-x64
1binaries/R...on.dll
windows11-ltsc_2024-x64
1binaries/R...ns.dll
windows10-2004-x64
1binaries/R...ns.dll
windows11-ltsc_2024-x64
1binaries/R...vc.exe
windows10-2004-x64
1binaries/R...vc.exe
windows11-ltsc_2024-x64
1binaries/R...er.dll
windows10-2004-x64
1plugins/__...13.pyc
windows10-2004-x64
3plugins/__...13.pyc
windows11-ltsc_2024-x64
3plugins/dr...gin.py
windows10-2004-x64
3plugins/dr...gin.py
windows11-ltsc_2024-x64
3plugins/me...ire.py
windows10-2004-x64
3General
- Target 46dbed7b72f44745dada1de14cb496fb523cb045a83cec9e153f017d2e0dc7b8
- Size 4.8MB
- Sample260814-ehmmssthmg
- SHA256 46dbed7b72f44745dada1de14cb496fb523cb045a83cec9e153f017d2e0dc7b8
- MD5 8e3803d2146a33a10c3aa22a049215e7
- SHA1 a1c1e5de85eb3a79b8f2c90675791690b9aceaee
- SHA512 e5f1f19b51fba72d202f98a2c9294120fd5a56d0caa59ced326163ec9f795636d30315e4b2093d25878c2cbc1920ca4142e9260fced78b2d05b71818942ca9d0
- SSDEEP 98304:nOvKuvOt74vvgtjFjf50njL575aO/gJ6/kULjHSkd2po92X7wZUS9:nOyX2gNFf50jl757v/NrsqoX0ZUc
- TLSH T10736332ED0F4D2CACF745A7104A717702FEB4D14CE84636263F1AF5E786E982A29760D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
46dbed7b72f44745dada1de14cb496fb523cb045a83cec9e153f017d2e0dc7b8.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
46dbed7b72f44745dada1de14cb496fb523cb045a83cec9e153f017d2e0dc7b8.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
ChanoX.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
ChanoX.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
binaries/Release/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
binaries/Release/Microsoft.Web.WebView2.Core.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
binaries/Release/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
binaries/Release/Microsoft.Web.WebView2.WinForms.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
binaries/Release/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
binaries/Release/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
binaries/Release/System.Drawing.Common.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
binaries/Release/System.Drawing.Common.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
binaries/Release/System.Resources.Extensions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
binaries/Release/System.Resources.Extensions.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral25
Sample
binaries/Release/WebView2-x86_64-pc-windows-msvc.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
binaries/Release/WebView2-x86_64-pc-windows-msvc.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
binaries/Release/runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
plugins/__pycache__/mediafire.cpython-313.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral29
Sample
plugins/__pycache__/mediafire.cpython-313.pyc
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral30
Sample
plugins/dropbox/dropbox_plugin.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral31
Sample
plugins/dropbox/dropbox_plugin.py
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral32
Sample
plugins/mediafire/mediafire.py
Resource
win10v2004-20260513-en
Malware Config
Targets
-
- Target 46dbed7b72f44745dada1de14cb496fb523cb045a83cec9e153f017d2e0dc7b8
- Size 4.8MB
- SHA256 46dbed7b72f44745dada1de14cb496fb523cb045a83cec9e153f017d2e0dc7b8
- MD5 8e3803d2146a33a10c3aa22a049215e7
- SHA1 a1c1e5de85eb3a79b8f2c90675791690b9aceaee
- SHA512 e5f1f19b51fba72d202f98a2c9294120fd5a56d0caa59ced326163ec9f795636d30315e4b2093d25878c2cbc1920ca4142e9260fced78b2d05b71818942ca9d0
- SSDEEP 98304:nOvKuvOt74vvgtjFjf50njL575aO/gJ6/kULjHSkd2po92X7wZUS9:nOyX2gNFf50jl757v/NrsqoX0ZUc
- TLSH T10736332ED0F4D2CACF745A7104A717702FEB4D14CE84636263F1AF5E786E982A29760D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
- MD5 ee68463fed225c5c98d800bdbd205598
- SHA1 306364af624de3028e2078c4d8c234fa497bd723
- SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
- SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
- TLSH T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
- MD5 acde70f73d3b71b1c4222b763537780d
- SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
- SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
- SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
- TLSH T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target ChanoX.exe
- Size 16.1MB
- SHA256 99c645868549a8865509a21f0287a94ec457adf92d7a03e3917d37d4307bf606
- MD5 b923447721bd0121c4aad4da362e987c
- SHA1 b1c759c503248b536a6e44baa334e5969398c0b5
- SHA512 d55c7311f74ddfe9948c3ec86127ae3da52c7f888dc6b99977e0e506c31a317313e182f6bee5fd528669a8a34cd725679ef9ab52e6d4e94fc399f5bb3b06110e
- SSDEEP 98304:kclRBRRkseU20gxOA7xfQdoZ4fbQsR1o/jk0J5DlKne0uY5T8GWDqxAld86fVr2r:ZlRB3ZeU205mx74bRajkANldrDWFO
- TLSH T11407F625BA5B996CD05BC4B0834B4A76493130CB0B35B9BF44D592382FAEBF52F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks whether UAC is enabled
-
- Target binaries/Release/Microsoft.Web.WebView2.Core.dll
- Size 615KB
- SHA256 4a4efdf712ceea4050eb2252ec2a9136cdcf32b9bfbb3ad58d79396f36e9665d
- MD5 46a2bad2d6b66af8279bdec2feb53afe
- SHA1 76e22a752b2720ad0329b5dcf833820bb73c73c3
- SHA512 b958cdcc84885bd67328f810163c087d45113cbc995fa35920297e037d1e1dcc41e03dcf25b060be528cce53ae46dc7fb3d43d2f12390d195978579091d1fc27
- SSDEEP 12288:v6AN7ERpkbC65sPiXqXcN/gIYxmG8WD6ptvxmgHAVxQz8tAgJrP322Uc+iKmDR57:tC
- TLSH T15ED4412223F94619F5F27F79563917608BFABC96BE78C35D8698502D0D72F8099A0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target binaries/Release/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 5705967f8bd1d711cfd48bdc9970ee491d7e96e4cd618a7ba41a534887cfbf5f
- MD5 7ab5a2afd82896ee901dee7449d80160
- SHA1 049bcb22cf05506f640cbe2d1ca734b4c6dc1e2e
- SHA512 35c762dbce73c6acb854cfbd3fdf552a47bfcae7ccd12bb162f02bacd52495eb79fda3845d34d23f0a5bb7db288720e1fe6d81c81d3007deca02d631b53e5ba3
- SSDEEP 768:klN2oOMtBtKljdCyXK8cmQYZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQS2:w2oOrsIrcmQYZDgcEST3p4JjrjaeFSUk
- TLSH T1F1034A0083ECC517EAEB2FB8B9B491610BBA7EC37EA1C3581D89B1990C737A0555477B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target binaries/Release/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target binaries/Release/System.Drawing.Common.dll
- Size 49KB
- SHA256 92200e6492e9ad216823bfde17f53177fe9d16faa5c916502b27f9cbf5a03790
- MD5 d16d4a3f15cdd595237a7b20967e40d9
- SHA1 1685c91316d0400fc4ca71201a7d872a3235228b
- SHA512 d356940f64f16d3d7645faae51be427ee5cda5c9fcfd72939607100c3deed4b68ae3f69800d059cf142631ba9601aaba57c58e5ecf03f5ea9a62eb728bb12cff
- SSDEEP 1536:cStZK5/tfRisE5O/rKzLHRgkXeC8SwRiJQcOzZ:fZi/tfRpE5O/rKz7RaCWiJQz1
- TLSH T166330842B3FC461EFAF70BB079BA94165FBBBBD22E62C79D1054400D25A2F5085B1B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target binaries/Release/System.Resources.Extensions.dll
- Size 109KB
- SHA256 a3a48530a0c0f6a22887f68e93b7c1d7d4bfa45c2d1dc492612e0a2809c6f396
- MD5 cae3e5f124f08cae595ff5c5eea93393
- SHA1 4a248e03b49bfb3931db3fa86a766e420299a94a
- SHA512 95151621563ec8972232a57e91ac047c0688dea1d63dd637a7344234cb22c624fffef13c12f08298eeaeef24edf8178a5ee7ba00badf8ea79dd85280bca805a5
- SSDEEP 3072:jCpthbzqr29+w1DvOvddmFaXiO1mRIKTkwboqpPJ6Fu2e:0Xbzqr29+w1DvOvddmFaXiO1mRIKTlU+
- TLSH T1EFB3F70173FC5729F6FB1EB9B9B451114B3AB9526935E76D088510EE0AB3BC08E70B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target binaries/Release/WebView2-x86_64-pc-windows-msvc.exe
- Size 43KB
- SHA256 17256227c353b58b465a24b7f4f1c79da6edd5704e3fc7db89e532eceb61718d
- MD5 165c60f3ad3ce8709f432370c99fa0d9
- SHA1 54821b2350b4109f93d01f02c45f4cef8967ecc1
- SHA512 7b038491fbb5a9f97d46e0b471b10716628c487524c510cc2abad1bfb921bee84618ca35a268644bd60cb0be6b4193ad493912df2076bed9e16f144923e31a26
- SSDEEP 768:JQygvk4qPsnJF66669hqPiPplIjv6VQLtvTha8m9A1IBgqqVtu5sL+0YJd8yofis:JQygvyPsJJqPiiv6VQLJTha8m9A1IBgJ
- TLSH T1CC1318491AE95826E3BE0BBDA8718164437BB41B6C31D28F0ECE90D51FE3F1999213D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target binaries/Release/runtimes/win-x64/native/WebView2Loader.dll
- Size 161KB
- SHA256 1970ae5e398666304483203dae64f8bc3327811114ae38bb3484ecbce1386b41
- MD5 075e4272f2815b3b6bc7caf0ebcc65ae
- SHA1 6ba407862fedc14fde92d4f4093249d2ba371ea6
- SHA512 6481605b96e4eb61443ae4bf0b51f4a9dc7c792742385e15418c9d06f136247fb2e81f632d30357cd0cde988a64c264a1bb8384cdf4a7d1fb94b78990636b692
- SSDEEP 3072:Wz49om6TlTRTEAzThTNTmA9r6b3oohrjmx9kAiACZ5AalK9TIjEtJ5/a3k:WswTlTRTEAzThTNTmAETRnmx9kAFCHEz
- TLSH T120F35B5772E9007BE16A8274C9A34A12E777741107509BEF03A4477A1F23BD8EE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target plugins/__pycache__/mediafire.cpython-313.pyc
- Size 4KB
- SHA256 27f28e8cfa89daf765ecac5a2979bf8ee63cbe9a5f53e1185c1b4296b4d261b4
- MD5 4c9066b060f34dca3c01f218096214e0
- SHA1 f7f91d16cd502a6bec63bd0817d0c2bf6b7c3018
- SHA512 fb1b17b523f4f1877e2d42326db853b05bb4d5ebe1dbb070ae197ffdffdeb27bb5dd06ca0a09d28bcb3d4cc04093fc90fce85ca07238859751e66d87b3902e40
- SSDEEP 96:GRAa2fCLJv2xnAB/0raUVJ7Szsgc4Uya+1Ke8wHB/LSk:q2fsJ41umhSzsOaWvNLSk
- TLSH T12091D64380E04A67EFA49175D0F80C24A3FD6ED2B200C323B61E92B65CE7E69DDB6305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target plugins/dropbox/dropbox_plugin.py
- Size 1KB
- SHA256 a4acf9906a7302359da776b940cb780768c8963c75e82a9950de041779dc3c94
- MD5 8a51c7489a24e76c73aa669e1589b0bf
- SHA1 dc848c46f88c9bc5e71b6896db6b21f3601acf72
- SHA512 19974269ce016a39dd49305037b000c38c47a3fbda2d271b7ce0ebaf8cb1320690710a8db65428daa8ee2edd98d6d7827473cb7c878cd42db9e4f33ce36d826f
- TLSH T157217B672C84602303F7646C0C9A8890F16617635279ED52F9EC85647F70076F7F6A7B
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target plugins/mediafire/mediafire.py
- Size 2KB
- SHA256 286d5a1ea1b889b492637d21b097aefe8e4a58498715d4d3a0d719c92f478d3d
- MD5 90550fd16fc751b4d221e1bf9ba4f640
- SHA1 cb3b4d7228fb612fc5f0738c18a951eb2cf49214
- SHA512 56412cb73c984b5786153aade32387ee696efe49f9b63bc65dad143910e3a781060f13fee2e3ba0d7cbd1c3e23733abff5d85c249d956121d7f2d411cb1e4568
- TLSH T11A5130639CC6241B86F3C08DC9397861FA43955326344412FAFCC6B97FB0822C298AF7
- MD5 SHA1 SHA512 TLSH
Score3/10