e6489240d832d526649c28dd21210e85136c527dd3419dc547afca7db5a204c0 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

TurboToolsX.zip

windows11-21h2-x64

1

App/AppDat...-0.dll

windows11-21h2-x64

1

App/AppDat...-1.dll

windows11-21h2-x64

1

App/AppDat...68.exe

windows11-21h2-x64

3

App/AppDat...se.txt

windows11-21h2-x64

3

App/AppData/put.exe

windows11-21h2-x64

7

App/AppInf...68.ini

windows11-21h2-x64

3

App/AppInf...se.txt

windows11-21h2-x64

3

App/AppInf...sh.jpg

windows11-21h2-x64

App/AppInf...on.ico

windows11-21h2-x64

3

App/AppInf...28.png

windows11-21h2-x64

App/AppInf...16.png

windows11-21h2-x64

App/AppInf...32.png

windows11-21h2-x64

App/AppInf...75.png

windows11-21h2-x64

App/AppInf...fo.ini

windows11-21h2-x64

3

App/AppInf...se.txt

windows11-21h2-x64

3

App/Readme.txt

windows11-21h2-x64

3

App/license.txt

windows11-21h2-x64

3

Data/setti...gs.ini

windows11-21h2-x64

3

Installer-...68.exe

windows11-21h2-x64

7

Password - 2026.txt

windows11-21h2-x64

3

Resubmissions

22/08/2026, 14:37

260822-rzl4tavhka7

22/08/2026, 14:34

260822-rxnvmafc687

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

TurboToolsX.zip

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

App/AppData/Installer-83.619.6968-0.dll

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

App/AppData/Installer-83.619.6968-1.dll

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

App/AppData/Installer.83.619.6968.exe

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

App/AppData/license.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral6

Sample

App/AppData/put.exe

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

persistence privilege_escalation

Behavioral task

behavioral7

Sample

App/AppInfo/Launcher/Installer-83.619.6968.ini

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral8

Sample

App/AppInfo/Launcher/license.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral9

Sample

App/AppInfo/Launcher/splash.jpg

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

App/AppInfo/appicon.ico

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

App/AppInfo/appicon_128.png

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

App/AppInfo/appicon_16.png

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

App/AppInfo/appicon_32.png

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

App/AppInfo/appicon_75.png

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

App/AppInfo/appinfo.ini

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

App/AppInfo/license.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral17

Sample

App/Readme.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral18

Sample

App/license.txt

Resource

win11-20260513-en

windows11-21h2-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral19

Sample

Data/settings/InstallerSettings.ini

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

Installer-83.619.6968.exe

Resource

win11-20260513-en

windows11-21h2-x64

8 signatures

150 seconds

discovery persistence privilege_escalation

Behavioral task

behavioral21

Sample

Password - 2026.txt

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

Report Analysis Logs

General

Target
TurboToolsX.zip
Size 11.7MB
Sample260822-rxnvmafc68
SHA256 e6489240d832d526649c28dd21210e85136c527dd3419dc547afca7db5a204c0
MD5 28830e500663a74d8b5cdcf474ae622b
SHA1 b9bab37eb45f92a1a0f06e1144a9899720bef2c3
SHA512 66b44c69d1419d48c6b94d2c3b8bcadbd548a93cda813c04bd16b4c0fb8ba13bd934580f8e1cd216acbef54ac8314393e7f805e9d7500303cbeca87c31ecc697
SSDEEP 196608:GenmT7/Y+b448Pk1ICU6905DrXq/9Szw/AzJibdmqekcEaYLS2jjWKzPo9BFioFL:GenC848YIC90tzy98dirjiKzCFJFL
TLSH
T1B8C633F3856C10FBD5BF4A20055B255FE418F6439AC8B18FA26D7CBAE8108272C9757B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TurboToolsX.zip
1⤵
PID:4228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:3144

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2026

Terms | Privacy