a1e4fa5ab0c0fca3106a01ab1c5bd68195bffbe3c09d73d29882f0572b303549

Analysis

max time kernel
300s
max time network
241s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidG_85e90e2e.exe
Size 9.5MB
Sample260818-2nssbstwat
SHA256 a1e4fa5ab0c0fca3106a01ab1c5bd68195bffbe3c09d73d29882f0572b303549
MD5 79a54d06978c4dd042c5b59ac3de0018
SHA1 2aaf7d5bac1ee6f5fbea68c32524b8da6fab7c0b
SHA512 e5d783a960ac965d2c3f765799d76613d484549936cc5a9d6760c5bb269f05dcd3bc9c6736addbb772b2ffc05954162d2a7d9b175cc34e09958ecd078501dda4
SSDEEP 98304:HNkKCjXueOtXBYFQj2l2XPEQ5odAX7T5SI3inj8+ZNDdJO:tks/tRYFQj2l2XPEQ5odAX7T5looyJO
TLSH
T123A68C55E37900E8D4ABC2B8C7465153D771744A03B0ABDB1A90AEA62F37AE51F3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	VoidG_85e90e2e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
2	api.ipify.org
4	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2764	VoidG_85e90e2e.exe
2764	VoidG_85e90e2e.exe
2764	VoidG_85e90e2e.exe
2764	VoidG_85e90e2e.exe
2764	VoidG_85e90e2e.exe
2764	VoidG_85e90e2e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3196	7z.exe
Token: 35	3196	7z.exe
Token: SeSecurityPrivilege	3196	7z.exe
Token: SeSecurityPrivilege	3196	7z.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3196	2764	VoidG_85e90e2e.exe	89

C:\Users\Admin\AppData\Local\Temp\VoidG_85e90e2e.exe
"C:\Users\Admin\AppData\Local\Temp\VoidG_85e90e2e.exe"
1⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-pAlles12" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\e8f8d3-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e8f8d3-Admin.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\e8f8d3-Admin.7z
Size 6KB
SHA256 baf08d1d700cb58546e10702be68c9ec80848eed3ab897c969c7b4b5416435e3
MD5 693a3842c3c5cf2ae189d1917688d710
SHA1 599ab17e9209437b1ee4e4b7a80899acc6905d2f
SHA512 1291a512aa309f4ee08d9b8aea6791097d7e36dedc7032b6621f0cb90c6b831c04774df6dbc7be170e22d857f50e4c84ee75ced5e0f7f3d15b9d3539a7be6ed2
SSDEEP 192:drcM+oC6kCp3rp+7dkeGlCc40/YdeL/s9/Sw8txQG58:driovkCtZCOYdeI9/SNb58
TLSH
T139E18ED160C74DB99540AA6AC123516DE4A1CBE68E24BFE1ED23B041107FE5FD884799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Browser\Edge\History.txt
Size 66B
SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
MD5 be64fd54e7f4a36bba743f42b9b7c173
SHA1 246d187d57af5a80fd876fac33b96d7471ede520
SHA512 8e24b27c432d59ceaebe1047837764bf5b3567ca5b8b3848b7b142014d83daa4edb219d6ad4091e9141c2f017181bbdb116b16ad606ab603ed1ccf3924a4aabf
TLSH
T120A02208E22280CA0B2C00303A8B8008282EA00E03882022A0C00882F808A3B02C2CF3
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Browser\Firefox\Bookmarks.txt
Size 367B
SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
MD5 1e5809dc37fdb89a5f31aefd8d07e742
SHA1 7d7e459b5709f8480d7b4100ce232c2ce1e5d1ca
SHA512 e76ec273e7a47a9ef0bd69e36c44a601bc49a51005a2263c1f1d2c115c7702045e55a8d70518b750ae8fc4ad5aae23dcb116a5f322cd7f6922f52434e985128e
TLSH
T1F1E0D8A3627241EB4F018B1870297A16644B8708DFF959DEE046247244A93A440E6B4C
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Credentials\Edge\history.txt
Size 70B
SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
MD5 3bd183c888644c4d8d042b1f89302b9e
SHA1 c68b79aa7f24c055a9e5c724775d07cef3d6011c
SHA512 3ac3f114aad9105a65f75441cbaa9784f5f8325195630db6ef05215b5356cf12f803417bb60029d53076a8fb9d1246ae34201b58da6eb86988e09abb830fe7be
TLSH
T14CA02208E22380CA0B3C00303A8F8008A82EA00E83882023B0C02882F808A3B02C2CFB
MD5 SHA1 SHA512 TLSH

Submit Download

email_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Credentials\email_clients.txt
Size 205B
SHA256 81e583d70205da3a46cb8fb3de871482fa7052aef5def139582c3a1cc53a0530
MD5 d8c2776f64fb6b3d9ee43355c54a391d
SHA1 8a05fdc61f77eac74cc76990ce1f5dc36bd091fe
SHA512 51d6b1008d2bf38c2cbf278cd2ca00ed4bbf91c1a6cae12d1ac69ccd65145ca169bcc9a9cd3609d4576b201bf6a7e4aee4c581439d07af17d47b33c69fbb3700
TLSH
T1D7D01281032F9023A930FDD07610C5F83BD6450A31832AC30089DF0C81574A217ED49F
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Directories\Desktop.txt
Size 915B
SHA256 29307ac08641cbb6f48e28f01683a73bde5825544d1f736cfff028531f162748
MD5 87dcade037becc86a37628b5dbc4c94a
SHA1 f1e6fda953186eb6fcdfcc9c192538958c1f39bf
SHA512 03b003fbd5ae2e87acc358cc88decc7930c72c0c045a4915f964a342c72b6e5cd634c9c81c2acb2aa5096fd5867ecb093c717e797960c490515ae51fb33c73e4
TLSH
T123117ACE6036EF1A2A614ACD0321F45722C84DCA4E84EBA6738E88D76185609A039D5F
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Directories\Documents.txt
Size 1009B
SHA256 11a7e106340f61555256f732196b1eaa6417489b1979cca36cb232739b4a8f36
MD5 32082a5fca1c4d3dfb2873d86ef1c57c
SHA1 6722d17a408652ad87c496f0f40031ea5491059e
SHA512 09874b787fb89d7a8c0e003ba1d260a0dd4f3df73e440e33f89992caac7f4293f1450c064a105a58dff0db21c87d89dca450d818ae7e5cf6e25b821117980e69
TLSH
T15B11218D1039DD2F19539AAD4741FEA706C50ACE9EB1FABF379ECEA54142910809A80B
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Directories\Downloads.txt
Size 1KB
SHA256 fc28b1d81026a63095e218bfdad90cf9661542b482f85c58007dc1d311b85500
MD5 1946cbf5f1eb85b1bdc36dba73fb28e8
SHA1 9aeb2c4ce3a7134308a9d8d7069af408159dd880
SHA512 ef1406a67cadb378d563ea3b82c8e4b379ac35f9567ebdd107c99a04b4b09ffbf2947d17c1b3513e1081f53e5e32d778b55b2c18ccc82d7b7b9690f3127a4bb3
TLSH
T13121EBDBA879DE2B1F963FA50B61750323C412CE1EA8E6D936CEDCE0510128A84A8C57
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Directories\Music.txt
Size 581B
SHA256 f85b7ec6b1229e4c02567ab801ecdab337f781ea985afb4d2a9b24a63e325705
MD5 2d6979e0f75a74dc722fe29ab3a95e06
SHA1 3b8b8d48cd93670a9f1ce18694e393b3d3798802
SHA512 51b0c9e762337978c3e52fe3baf52cfb6c7ab692df3c18511c4975a696bec1863d6c2b57994d93ea155e53a038317134eb6d64c4256b3ca13770e6f10f631043
TLSH
T1FAF0ACC9889ACD3A3A9121921FB178C316D14EE95E69F2F83BEECC700305A0A0489C05
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Directories\Pictures.txt
Size 658B
SHA256 044ed397e9731e7e6f9a6bb92ab113771a44841368ccbb222757ffacf7a797e5
MD5 c4c77385f6067147509b6383848d3425
SHA1 51f953f6dfb3968fd31b79d8f6dfd00f9c89c9d8
SHA512 66350eeacd1bcc3af4e58ce12ba23ce3017bf1abe76215e1d2b8590d62c2527b5f807c3040643ea34ecfe1e379c6ffce7841c305b6b3f460a51eae0144641598
TLSH
T1CF01490E3BB9DD118E6B2DBD1F2472C782C115DA0E12EBBB32CEDCC65915904E5B2C82
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Other\Bookmarks\items.txt
Size 467B
SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
MD5 98dea30b7155d5ace37749f44523438c
SHA1 6f9e7de66f62d2792eefcc130d844199d1dad0f1
SHA512 8d105b4804e6aadb379961a181effc9c6592f182ba34de63fde293d88d2591215d0b9634dfd483a63af381f989188214f91ce583e9903634fa21f343d64de519
TLSH
T156F0A763E5F1C5AD0F508928F5143109168B670CCBD9517EE046383269B63D810EC3CC
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Other\Email\items.txt
Size 239B
SHA256 bd6fdab270746df78bc75a0b4187f0a3cf839b7135f4c98b487209c8ec100281
MD5 e157c37890a8bec7018062f10784803d
SHA1 6aabbcd8a6cb2bb6bc96ee0fea76de429a83baa3
SHA512 f3da15484df6fab0e7d4142aeead643d689ae63f70a4115817997a47d050b53e41f787975b698e8308e23bc3774e83c79136ded37bd7f2ad3916b48ec598ee9a
TLSH
T186D0A702D96DD1235570FC992E50C6E03BAF080E744755F784E6E74861331DA42EC1AE
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Other\Environment\items.txt
Size 655B
SHA256 f1567d3ee2cf227a41b0bcc27e16174f5619de6410637a3797cb17ef0fcbccac
MD5 5dd934222e55509d745209f7e0d6a2cb
SHA1 ff18fee2c7aafc329f6788877400529aaa48d13d
SHA512 db83d9e14a50e3e444a1f114a6be7adf57c7a53ce63b1f6235ac3e1d1074a55a6e0903bc6a11149cc8bd376596cf2173f547bd29e7dde7d695756078bd45bf54
TLSH
T135F08166ECD0F1BE00F0E23D5D9311088979281CE948273BE2B3661F3E3403C97C9689
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Other\Fingerprint\items.txt
Size 429B
SHA256 9e7737d1f5923c1ba87fbdcd5e7917a6da014aed163310bd0562cd2277407bfa
MD5 78b283cc28e045e27ec8a797daa825d8
SHA1 3f54a15708f459ab927e10cb938b6a20c20ef3ec
SHA512 6c49e0dfaee05b68f7ae437857dc8ea41c2a4aade3cb3565407449ecadebce15b12a498c33bf2d1e118c9902ecb6f36f4c69947da8744b56ca45a326a6edcd00
TLSH
T121E0E522DAE4C0AA1C6095280C169554076A355FC058427AC0E7507A3E3109C97DC30F
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Other\Processes\items.txt
Size 6KB
SHA256 1100676cc5cd8e4551cf306fda182163ef74a15fccacba33f4017883cef7301e
MD5 d240f921b0df306bc7a88092edec6c3e
SHA1 b9182beac3ed0aba5d7432e57458af2d33e569ee
SHA512 dc5a919c5b23c09668631e6326e0fee42de4181ccd1282c723f4ed7908ffb9bc4f534f70a5582c841c7cce06b6acf1942618b5f9ac5cefc5c658359d9a2d7e07
SSDEEP 192:V258+xeqqbZqy420Vh14E5CVaVTnR6qVGh80VTu0tVB242eLGVzh2AnbbLILkhgh:V258+xeqqbZqy420Vh14E5CVaVTnR6qg
TLSH
T170E15F21E9ADC09F157481B719B1400316EF1D1DC009C5FABEEAD8797E3464EE2EAE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\Other\Software\items.txt
Size 2KB
SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
MD5 28bd85dc25bc0c55db6291d1db885a12
SHA1 0b019bf7c9e28d7be0687733395b2fbae6111517
SHA512 d7a38124242a0f1c39c434c6c1e936ae2c09436a398e5aa733d904849382e393a0c14880e790effc1e286a284c6d4a38dc670087d120a6487f6b80734f74f03c
TLSH
T1DE51061EDBE4C0BE5F20AA939E321C30225E259FF6508A36C1EB152A6E332DD45EC755
MD5 SHA1 SHA512 TLSH

Submit Download

Antivirus.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\System\Antivirus.txt
Size 31B
SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
MD5 e2da04c91dc82476ba3aebdaa6f40eb6
SHA1 abcd50cd2dbabf56fb88210f5083ce94d5bb34f0
SHA512 735c51ad836d453deea37e2e5f44d05006bdfb433149495e503161131ec32bb01389405bb65a3207b45799e27b694708031b98a5f675346d8cbb1ab2188607d6
MD5 SHA1 SHA512

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\System\MAC Addresses.txt
Size 34B
SHA256 88f855a5f4e136e54ad0e290906c8b38564e86a516e5f8e3fd427690ab7be17c
MD5 379409e409f45cff6afd7af09d6f39d0
SHA1 226138c8274cca3b0469811b08870ccb18e5188b
SHA512 3d542a837c718824745ade9bfc1511e5ef9de57580e8e0ad78f9630168285574a7d2c399809ed6e98f2e8755f9d8889223e33dc484fe67a7442d360d846e7b5e
MD5 SHA1 SHA512

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\System\System Info.txt
Size 724B
SHA256 0a6bcfd7c7bd5b1f283019bbece79716f5d0b0b6a7a372a5f4889d877dc57d7d
MD5 8db7b51270fdde98ac03a523f20a735f
SHA1 d1e8d62845686e821576ac49cdddbbff1e686925
SHA512 e8688a521b158456160bd29edc62715670d35ec22946019dcc056daf0d4e86f30827b319fe5b17c173cda2da1deb5212e8c6a8ee3db88acd476adffbe1da8ca3
TLSH
T18A01B8E0628C0002C36F63F9131A575636F559C7259BA86872DA82C82EE3586979A141
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__1dxy7hjd\organized\System\Task List.txt
Size 2KB
SHA256 88f1b5af1aa3ca25a1147638405095242e16aba37e68a13d69735e34226bb014
MD5 1219db6334d2ec93c1fca0e70e945ca9
SHA1 f2a13aff3e422467ff7423e7ada729eb1478833b
SHA512 bc6c5b4457d87c934c0a7374ceec0b6c8e0b16091e8eac9500d506c8b496c28b8361fe3d2bf0f6805f89cb2b8062aa7be68468e41a66d5b8d18e05b3a2bfd02d
TLSH
T1F241820BC49FA2DEE6D520EF3E61265F5BA7052C008F5CE9B25215EC28B0D1DDA4BB1D
MD5 SHA1 SHA512 TLSH

Submit Download