e6489240d832d526649c28dd21210e85136c527dd3419dc547afca7db5a204c0

Resubmissions

22/08/2026, 14:37

260822-rzl4tavhka7

22/08/2026, 14:34

260822-rxnvmafc687

Sharing

Copy URL Twitter E-mail

General

Target
TurboToolsX.zip
Size 11.7MB
Sample260822-rxnvmafc68
SHA256 e6489240d832d526649c28dd21210e85136c527dd3419dc547afca7db5a204c0
MD5 28830e500663a74d8b5cdcf474ae622b
SHA1 b9bab37eb45f92a1a0f06e1144a9899720bef2c3
SHA512 66b44c69d1419d48c6b94d2c3b8bcadbd548a93cda813c04bd16b4c0fb8ba13bd934580f8e1cd216acbef54ac8314393e7f805e9d7500303cbeca87c31ecc697
SSDEEP 196608:GenmT7/Y+b448Pk1ICU6905DrXq/9Szw/AzJibdmqekcEaYLS2jjWKzPo9BFioFL:GenC848YIC90tzy98dirjiKzCFJFL
TLSH
T1B8C633F3856C10FBD5BF4A20055B255FE418F6439AC8B18FA26D7CBAE8108272C9757B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TurboToolsX.zip
- Size 11.7MB
- SHA256 e6489240d832d526649c28dd21210e85136c527dd3419dc547afca7db5a204c0
- MD5 28830e500663a74d8b5cdcf474ae622b
- SHA1 b9bab37eb45f92a1a0f06e1144a9899720bef2c3
- SHA512 66b44c69d1419d48c6b94d2c3b8bcadbd548a93cda813c04bd16b4c0fb8ba13bd934580f8e1cd216acbef54ac8314393e7f805e9d7500303cbeca87c31ecc697
- SSDEEP 196608:GenmT7/Y+b448Pk1ICU6905DrXq/9Szw/AzJibdmqekcEaYLS2jjWKzPo9BFioFL:GenC848YIC90tzy98dirjiKzCFJFL
- TLSH
  T1B8C633F3856C10FBD5BF4A20055B255FE418F6439AC8B18FA26D7CBAE8108272C9757B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  App/AppData/Installer-83.619.6968-0.dll
- Size 5.1MB
- SHA256 3e1ee0d9da3ef39008d0d7e4cc2883219d36d2193ef2fb2e76b6afae0fe3efe2
- MD5 69c69581f60c0743236c2bfe774129b3
- SHA1 9dee6c3e57df962497e2352988e36f7fd9f19bfa
- SHA512 2550d0435acecdfa109068a5da491432ddc4540d39ee47ef321a2f985976253d082bffe35ef03e81291b782a276d374f61beca74bc9163748b834a934c618667
- SSDEEP 49152:rzDPLMkOuHQVgpakSsvOTZYWQbAz8RLES:fDYluHQVKZLB4S
- TLSH
  T16636334D1AC1431EEDA14F3E85BABEB0C3AA8B174B019E30C224BA555FED4A95FC7117
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  App/AppData/Installer-83.619.6968-1.dll
- Size 75B
- SHA256 2debd2ec77f789476bf92a74f0053e389a6e4c4e509370518690fa0b15f248cb
- MD5 5971a7ff02b8f490d3a8e784d48c7ec7
- SHA1 1f6c66170f2fd1edaf8da6c5f1855af8ab5cfa12
- SHA512 38e50dc2705d1fcad4edd16031da25d0621982325223f9bd3b4f9babe7b06642bf4e55235c67f33ec826506e503f97414cf44f270d5734bf319d0ebb79934d76
- TLSH
  T1E3A022B28F80C228F230C0C0BB88000338A3C02082880EECC0E8808B03823CE2F208BB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3
- Target
  App/AppData/Installer.83.619.6968.exe
- Size 17.6MB
- SHA256 c1c84e86807e1a0f0594fae6883f904c958710e8dbeb760249fcc59eec9e9949
- MD5 58b991179f8d4da130a15fbf7c6a5dbe
- SHA1 bfd37182cd581be0f605fea0e15d5fd39fd3d1be
- SHA512 46bbdb276f0fca102748a9f3e524f2588190c26986622a9caea82d444ad7e9bd7da953d40269346e46b561ccf35c577fccfc4a57930f7c47047939bfbedb97ac
- SSDEEP 393216:ouwsDosgM/q+Yv5Yr+ecWxkN0StzZX1zVmEAI9:TDosgM/q+Yv5Yr+ecY6zZlvAI9
- TLSH
  T14D079D13B6D301E1E9A3567004FB622B5637AA12873089CBF25C3A546F732D17B377A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  App/AppData/license.txt
- Size 34KB
- SHA256 b5cd774c1d086cebb073999a7a93d17cb81525540d5f6096c044a949d0bd91b1
- MD5 4e9137b92abd5e5ba212cf667d833b2c
- SHA1 10c6e817fbb788a2d005bf60dcc82893bdaba8cc
- SHA512 90b5200616c05b34f424b79b0d91a3ed3b7dfb6f1dd8b11ad5d2378d23354d2814de2303263a8dd5e2561cc301d8ef9a7576168cd2d483533ed6b122fe3bae9a
- SSDEEP 768:O7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0u:OVtNIq1uzZY13
- TLSH
  T171F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral5
- Target
  App/AppData/put.exe
- Size 8.4MB
- SHA256 c2814a5af7b14404b606e1e2eb988526e1d9d8f0d4839d70baa963779b7b9069
- MD5 d7c4a288d063917a6ba060bb7c55259f
- SHA1 d7383f5fbf5e96068a1dfd0cef4c41d06eec6cb7
- SHA512 7a57c1354fc706845e86e8a980c12e0425378904243b3a4f130791dbcb193a324f56aa323a731cb0db703a5ab8fe6281b6d267453a793db488b47396038d0b0d
- SSDEEP 49152:4PU+pr2U+XnS/FKU8ymWXLPPn5/1oUGds9zsAK7bWmCpd/8wc+zBXA3SzQWKewVr:4PUYinCLYbWbF88SmM0DpxF4WzEdr
- TLSH
  T1C3964A07EDA925E8C0ADD1358A729553BB767C490B3123D32B54F7282F36BE0ADB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
behavioral6
- Target
  App/AppInfo/Launcher/Installer-83.619.6968.ini
- Size 285B
- SHA256 4410e77c8e513a7ae176c11f2d766472db91e3362ac1668d073b62c00766cb33
- MD5 9f3cf5c31aac5f7f0d3edad001947efb
- SHA1 5a0315281a63a17e6236ac9ac898104213f37117
- SHA512 243a69455655ba708db0578d9bdebc63e171d3bf22d1046918fdecf51958a72eb08836d7f5fe2a4783e00cbb44a0f52e14cc07b34225e67ad2bb9c81c047e21d
- TLSH
  T198D0EB012AF4E272421380F017B38E3241861082E884A0F65A235A4E9720C2292DC3AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  App/AppInfo/Launcher/license.txt
- Size 34KB
- SHA256 b5cd774c1d086cebb073999a7a93d17cb81525540d5f6096c044a949d0bd91b1
- MD5 4e9137b92abd5e5ba212cf667d833b2c
- SHA1 10c6e817fbb788a2d005bf60dcc82893bdaba8cc
- SHA512 90b5200616c05b34f424b79b0d91a3ed3b7dfb6f1dd8b11ad5d2378d23354d2814de2303263a8dd5e2561cc301d8ef9a7576168cd2d483533ed6b122fe3bae9a
- SSDEEP 768:O7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0u:OVtNIq1uzZY13
- TLSH
  T171F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral8
- Target
  App/AppInfo/Launcher/splash.jpg
- Size 17KB
- SHA256 cb2d94a72b06cc98340db78a89bc17691eb64562d593a585bb08366b05fdc74d
- MD5 971cf4c0c99eb76f18786502584e6dda
- SHA1 7089e150b8e0a09009306964727c827b3ece94e4
- SHA512 d887bf02bc1250083815b2d0ec5af90f305e602948f8e25c644a759ade554b3d79fdc4bdbbb822e05db7f17216e2cee994bad3d3fbf3da1ce9c2d141f81efd4a
- SSDEEP 384:m3zlFEdILeVu/gy2l/bIeewGPaLqpRoRlq:m3zrXeVUgdJbIee7yLq3l
- TLSH
  T16882A0A59F01AD518ECD57716440EA23946A6BDE136FE10328BF9FB87F9D710AC4309C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  App/AppInfo/appicon.ico
- Size 88KB
- SHA256 f4e2cd6d28e98e0624feb064b92ccdc438dca91bdf6358fde48faed94ed90ca3
- MD5 9b6cf5c6f65a252caf85dcfa6ba0e7bc
- SHA1 c2e08c9be065a99c0d6f8a34ef44a959c0d94110
- SHA512 0a7c376d3798a2dcd18e954172fcffac399fc1c306c24ce324009a16bef98f1862ec60f699f432a70579a166315fe9bd8de35384c946208cdad8c95ac6ed1a09
- SSDEEP 768:/5oqOMsN5v3ImgzFK3gkA2uFo5LEfocwA:/KqOMmM21zQfojA
- TLSH
  T116935B0072C7D1E2E52B4BBAA460D2B231EA7DA4BA77529274CCBFDF38F151B6611341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  App/AppInfo/appicon_128.png
- Size 11KB
- SHA256 7595f8fcda88faac9e780daec64537141dd1cd7debde6e61ff23d4d847588d8a
- MD5 8e29b69e420d4683529549857d3bfaeb
- SHA1 d92197b4fa9808748e5e4d7f886546781e3e2ed8
- SHA512 e335db5ea1a077259875dc246febe872a412ffa4aa0bcea8b0fa01065b056bfa7dc72157e04291253c88c98451997c94680baac370ae6c0629bc09b4e04d89a7
- SSDEEP 192:HQoPMkbVT2RSDg2nnvt88sCiLc8G+CD70Z7te5ffz6aeKuB52xvNzbAN0:HQzkbV2Urnnv6MT7ZrZeHB52xvRbA0
- TLSH
  T10142BF95FBFABB6DD745F68100B2C09F8313A5198301C531A43B88A2AFF5C86AC21DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  App/AppInfo/appicon_16.png
- Size 724B
- SHA256 06f6a637890d692a72860f612e7c035af6919b19e75e290cf20d83bbb2faa7d5
- MD5 b61c6bef055f70a9071bcea3aebfcb0d
- SHA1 3dcc6758cdf9ba7027ee3f3bec3a4d17fc968a83
- SHA512 ad07e9cf637d2056e8dfaf592577e52c0aabfc00fa5bee5ba6c82f8307926ed2f1acf85385c6c50093bc2c068d6b86ba92f8705c47fb1ec67e50538a6de3be3f
- TLSH
  T1CF0165925196B5AE87BF258CCC006411BE72843F47266C15F32A84944C28290D2D47AD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12
- Target
  App/AppInfo/appicon_32.png
- Size 1KB
- SHA256 8f0eac6ae9f575b12f0b0ee13cd842198a01cfcb793c4de35637ea8019f4cbb9
- MD5 ab3a4b1972c4caea8668e32a0836be1b
- SHA1 2c488d1ea90914b8254b0b0977c7944764a92fb8
- SHA512 adb566c760ec95faade5154b146da5f8f05739b13f5af31e7587e4759ebc08e8c367721f7568763e7519af300d649977ac31fc4a4ab06fc1bf368f01a8419ec2
- TLSH
  T103413DD7D22099D78E69391700453001DDDBAA503C33944D1756689F7866399944BB36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  App/AppInfo/appicon_75.png
- Size 7KB
- SHA256 ea78ca5fae638cebf7663be92e212c4ddd8ce713d186b81ddd6e5704a47a5384
- MD5 c692296206b9f1a8a8b3380be1f818ac
- SHA1 5a9bf201eb18f07e8ab25a2c628286168641f491
- SHA512 94f9a38f2361d7d2b782543b196f559e77fb292c030e53a599cf812e0be8519d45980b2da37b1baa2a4409c317e9dbc8883a8eea18f0b05109d3fdad93978727
- SSDEEP 192:TjfTuzLxylK053Fuhm6iNziIFVfPnHfM/ZDz:nbOQFuhliN2KtPnHf6ZDz
- TLSH
  T133E19EDB98085EEDF725E47ECC5115F8DCF1901714D9BC9078A8E3A12B176AB10D96C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  App/AppInfo/appinfo.ini
- Size 347B
- SHA256 9c0069c6b08819db660e389e0f92fed4770f0d015b9fa6b6a22684e99a830bde
- MD5 e80e8326161ce64ee1055bb9dbc9e18b
- SHA1 c4562bdc1c2d8dceb1c4d7d9b255f50a87054d41
- SHA512 d039d6937c33b89e2962d666219e7152046492f996e6f0d589096ca0cb7737eece70da1498846ecef6733d4780abb3c27151d1eb22ad95455166fa5568f6501f
- TLSH
  T10CE020913E4BB73C637C23692AA54DF5B3EF2118130480CD60E5580B0721C54485D47F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  App/AppInfo/license.txt
- Size 34KB
- SHA256 b5cd774c1d086cebb073999a7a93d17cb81525540d5f6096c044a949d0bd91b1
- MD5 4e9137b92abd5e5ba212cf667d833b2c
- SHA1 10c6e817fbb788a2d005bf60dcc82893bdaba8cc
- SHA512 90b5200616c05b34f424b79b0d91a3ed3b7dfb6f1dd8b11ad5d2378d23354d2814de2303263a8dd5e2561cc301d8ef9a7576168cd2d483533ed6b122fe3bae9a
- SSDEEP 768:O7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0u:OVtNIq1uzZY13
- TLSH
  T171F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral16
- Target
  App/Readme.txt
- Size 75B
- SHA256 42241d10c9c6aa8e38f9a4097ef722fb362dea7b0bb1253dae76b5f3bc5526e5
- MD5 aec5dc9a01419df4765ced7418ac9a44
- SHA1 774dd61136220f0508f28aad63d821d946175083
- SHA512 fa094e125a799aacaff6978957438e5d84222c534b6dd33813c94cdfc3b533c7a872ef8046078a3cf4939bf0b3b238a7e055e03544e4a348976717a0e80b5732
- TLSH
  T169A0247175C010430347157C170F5050031500CC044730503000C1C05D3505F03C145C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral17
- Target
  App/license.txt
- Size 34KB
- SHA256 b5cd774c1d086cebb073999a7a93d17cb81525540d5f6096c044a949d0bd91b1
- MD5 4e9137b92abd5e5ba212cf667d833b2c
- SHA1 10c6e817fbb788a2d005bf60dcc82893bdaba8cc
- SHA512 90b5200616c05b34f424b79b0d91a3ed3b7dfb6f1dd8b11ad5d2378d23354d2814de2303263a8dd5e2561cc301d8ef9a7576168cd2d483533ed6b122fe3bae9a
- SSDEEP 768:O7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0u:OVtNIq1uzZY13
- TLSH
  T171F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral18
- Target
  Data/settings/InstallerSettings.ini
- Size 202B
- SHA256 31504c546772c62d7b50ec7299491febd518796e1bc3769dace80d6970a99462
- MD5 e0883ae11936a52a2f449b357f35482b
- SHA1 3eae5732ebd0f7e7c9f96e9b97716ec9dc4b4619
- SHA512 602035d0e968855a2e432fa62f8baa3e29d904ce6a13275a5ddcbc1c8cf5fb1e6eb28cda012ae05f12a69e50adef5ea4f84c526f7709f3ddcbb4c6565714977f
- TLSH
  T1E9D0235E1382661E03C5B1BDC75BC05401D9543048860338D7F3168111B6F365645C47
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  Installer-83.619.6968.exe
- Size 221KB
- SHA256 bf0e870e0b9de578ab72a4b8cee7b12e23bc5bdde92748e37df72456ab11308e
- MD5 e900661b57ac262f1c1470a9ed925bc9
- SHA1 28cc926e6988cbb6de13ddddcfbbdf29299221ea
- SHA512 3c0f1385ab4796f6226afe7ece957924d26aa3bc82264e6b8bee289d22364206588e342e153b8bd3972f7ee1906e5d3b955e3c04cb9360e1b38216be303a520e
- SSDEEP 3072:wweqOYEUXPn5PzQqOMAUlHYPHxwAk5JXb0NNoEdjrgqQQmvvpPC0G:hEUXtzpl42jJXktjhmXFCZ
- TLSH
  T13924CF0066D7C0A2E8B70A726471CA723AF6BD106977954B724CFF8F38F26479918713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
behavioral20
- Target
  Password - 2026.txt
- Size 1KB
- SHA256 abf4ddb5fc34a413c4dbbd276de1ca51caeb7e5030aa2f5d1f5ebae18ecfe16f
- MD5 1ae193fb0da7b4d9fe2f0b100d949dc6
- SHA1 438aa7ae304098e5a298956f76fcf72f7efda2b1
- SHA512 371da4cc7df6ae9e4fd26bded183ab081a9c358d1c0455bec8c251f41ce3a18f34df4c9a4878ac3f9e793998dbe003343f92e7e3b8aa764d3ea170d86f5523c8
- TLSH
  T11E21001BBC1625A352BEE17125A439D5D6FFE39EA162C812BC3C50001BA8B3A827E416
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Creates a file in the Startup directory

Creates a file in the Startup directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21