b1a74098c63d535add9a1dd20daafcf134b998d1b0a538e107786ee42a0d9942

Sharing

Copy URL Twitter E-mail

General

Target
executor4james.zip
Size 10.8MB
Sample260822-tk6wsa1tgz
SHA256 b1a74098c63d535add9a1dd20daafcf134b998d1b0a538e107786ee42a0d9942
MD5 9c939671f8e0612a177a1f2114ea2d89
SHA1 0ed2deb1d83d9e7184248de4b1d186aa94e74d46
SHA512 b0af22567a6b8dae4f84a699780c65edc64a99b3be49707c4622bdf8ee00aabb238844bbae53b6df70ada2e78c41b073b27978ab56a11a38111b9f2a2e32d36a
SSDEEP 196608:2CoimQixpTuTeBXyCy5hjl3/mDzgIZB3yrJZmKhjt2EYLKsPJpry6Pt4:HF3YTMWchjl3/ggIZB8J1jcjZzry6W
TLSH
T1EFB63328A70FBA27C18A4F7D11BA63C7E1A7F09EAA7A687335C415148C73C819B15F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  executor4james.zip
- Size 10.8MB
- SHA256 b1a74098c63d535add9a1dd20daafcf134b998d1b0a538e107786ee42a0d9942
- MD5 9c939671f8e0612a177a1f2114ea2d89
- SHA1 0ed2deb1d83d9e7184248de4b1d186aa94e74d46
- SHA512 b0af22567a6b8dae4f84a699780c65edc64a99b3be49707c4622bdf8ee00aabb238844bbae53b6df70ada2e78c41b073b27978ab56a11a38111b9f2a2e32d36a
- SSDEEP 196608:2CoimQixpTuTeBXyCy5hjl3/mDzgIZB3yrJZmKhjt2EYLKsPJpry6Pt4:HF3YTMWchjl3/ggIZB8J1jcjZzry6W
- TLSH
  T1EFB63328A70FBA27C18A4F7D11BA63C7E1A7F09EAA7A687335C415148C73C819B15F5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  exec/Editor/vs/base/browser/ui/codicons/codicon/codicon.ttf
- Size 69KB
- SHA256 4946e7465803ccab735800d9236f188c2200d28b395e77727e9aa0baa443b87a
- MD5 a1cef3d530e1adb0f52b2f62994a2aca
- SHA1 074579894ad91265941fbce44d2b41c863797cf6
- SHA512 423656417849bddd0f7bf01138d9de54b334fc0ca64f28c5d679f66e38f5bc3c601a0faa166734cde4c2ec1e56983c36ceabdb3265c414fc40a7ee3798ede52d
- SSDEEP 1536:ex5Ez/D8G5dlHwkP/7BzekxVL7/b/SS0/hczE00phJgZExGk:ex5Ez/D84HwKxemVHbKSm+zEXHJMrk
- TLSH
  T12B637C06C3615E6ECD739A7E459241118995A406F37FCFF3E947BA23801E8DA0FC9E29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  exec/Editor/vs/editor/editor.main.css
- Size 68KB
- SHA256 84dd9fe14607057665030df6ccd537f0a2b03291fe419446801592bb59b071c2
- MD5 e6d9c162bcc3bdd6e0d85caa1353e9b9
- SHA1 90d25b4e4e4fa6dfe766886025b30a29302b35e1
- SHA512 3e752bbd92c82b3f312f464cad2e63ec5ff65c15f493b98059dee93d0e53caae55e9905b1111057a5a6cfa9c2d2f064c2d9f1d64a80bdfd603f445d6fe22da91
- SSDEEP 1536:ddM3/S2lRD4PfPuPjPAPdjNZBmBkHE0akfPZP/PyM:W8NZBmBkHE0akP
- TLSH
  T1136384EF26002D2862EB8137A681DFD971F9D473F9224EE9ACBC7B20954E1E50717538
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution ransomware
behavioral3
- Target
  exec/James executor.deps.json
- Size 5KB
- SHA256 b476b9b67bb39571e9d460fe5af03e40836bc9a938e3defcc1f1b337c092814c
- MD5 cc26c4ee29d9b903c116998040cda36b
- SHA1 6fad4357903023f5025c2ae3c527e6fa78513dd4
- SHA512 0a5c343174b4d1876d9c59cc36d1ad4011d89a0359b80c01af1e2a203e3b5dbd0fc08d3dc3f4e9fedfe65327ecefa508017b3e79a54b030eb73794a55e3a1afe
- SSDEEP 96:tgToCg7qpJ81HUlmDAk7Z8M1+p+Z2BQDzsEi/cSO:tjmpJ6nZ8LYVia
- TLSH
  T134B14726E4644D6708726FFAA47642C1FA25633F5240AA4B78BC549CCF73FA7A080F34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  exec/James executor.dll
- Size 26KB
- SHA256 57d8dd1926ad95e45b260bb8871c052981bc047b10c8673c2f8eb0fb899d9e18
- MD5 d958a6ea08a5ebfc0b06b34000c36074
- SHA1 ee1a731dcfbb5de2d9311548d926724f9b2a00be
- SHA512 8ef20c7203e5527288c6a373425d1071a7d503bf2b4feb93ceea47e74d0ed75dc4db4f78816dd2249f32b0a5903ef30a1b42e23be640fd6559c34ebf08b02a2c
- SSDEEP 768:yrJIHRkbVTp6V6wS1WVNNnsv7MuEHOyLe:2JIHRkbVTpHwS1WVNly7MuEuEe
- TLSH
  T182C2194463AC9B27D93E4BB8E5A6118247B37927A521EE4D2CCE38CE4D733410B51BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  exec/James executor.exe
- Size 158KB
- SHA256 37e6cf8941074e65bb7643888d54e0a3f9a0b14ad45d3799a2465bf99fbc3845
- MD5 8c045630d3f92a3d95fe3ed00bf75716
- SHA1 d33ffabd4e1dd405d89d4ab50b4fdcd30ef6ea07
- SHA512 0b1875644d60eb3d958c2f790e7279a66c6e9f6378b8856f32d7d97cb48119bc993772cd6df31376e6995ecdf1410fbf82a70056264f0f14bbb229eda68d2696
- SSDEEP 3072:DVDxk88wN1nLVu7dL1Z9QnlX9rE38wm1VzaAT5sk:RHRu7F1nQnZ88Uz
- TLSH
  T185F33C13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral6
- Target
  exec/James executor.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.12/manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH
  T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  exec/James executor.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.12/protocols.json
- Size 3KB
- SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
- MD5 5e2067a92dcfcb05537479c384a89725
- SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
- SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
- TLSH
  T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  exec/James executor.exe.WebView2/EBWebView/Crashpad/settings.dat
- Size 288B
- SHA256 4660f89e6dd3e418df1e332589bad5ee415e4ffa9dea5f0c5835c396192c5371
- MD5 7e470e214fe35cafd2eee9467632cb2d
- SHA1 2d069f7281d13bb79c5942dd01db60cbb0c09d6d
- SHA512 1f59876c8e958d9550695a752582cd197f207accd6c22b567d6cbdde989adfa4661b9eb3fa26897c54fa7f1105bfe063362e4e4376dd2c55a0a0bda326391153
- TLSH
  T110D01222B1044D26D8D229730503F1C93B12C41E42AA1D26553AD63E6F244D52E52DB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  exec/James executor.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10
- Target
  exec/James executor.exe.WebView2/EBWebView/Default/BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11
- Target
  exec/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 ba823b3de79297389a9aad662e389d4d229bf3a6a0056f9ede4ee64cc49dc19c
- MD5 151c3622045db00f17de39887565472a
- SHA1 cf0e1def4c6750fdf3fd514eee9b935b0527b0e4
- SHA512 21c18b8a0f4e05fc6ad98fff0b2fd818601b795084429f25bdf5784b10b5f17ddee2e6e3cea0385a4ee8690918fb1f7b9808c89a01b6398c93d6e33f7f8e19d7
- SSDEEP 768:DcaNb2/itGt3JrbYbSQzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFc:Zb2/D8mQzZDgcEST3p4Jjrjae+SG2auY
- TLSH
  T115034C4043ECC527F6EB6F78A9B496610BBABEC37DA1D7990D84F0990C737D046113AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  exec/Microsoft.Web.WebView2.WinForms.xml
- Size 40KB
- SHA256 6a8ec199373824fdebceda7b3d780d0b31c82edceae04d92391027c971dea6c2
- MD5 2d0b324efe8342a0897839ce920b06e2
- SHA1 bd6d049a42e9ca3612c2bf050ae3384d543adb0e
- SHA512 a038256a72ceaa5ea63ad5192598330f478a3cce56db89608f5e90779e8583ab97b151a0ffbd7035768e5a1f8f2d03358c17740bca769e4f63a1f1d5e535564d
- SSDEEP 768:3OsdyK4aSPgPxW3uyCG4yCGdryCG/L+GZiyCGRL+P1xb9zU4QPgcRJFXCfPgKehh:3OsdyTaSPg5W3uyf4yfdryf/LzZiyfRP
- TLSH
  T1B9130C01A28DC72249E21ACE19B0E4D4FF2D677775D6EE11384C4B560F73EB0E2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  exec/Microsoft.Web.WebView2.Wpf.dll
- Size 82KB
- SHA256 ce832969c0b54092bf46e5978cb55955130abda33a27c65a65b3f6af4801bc80
- MD5 cd3e6295962a09805c23d25547b821fc
- SHA1 2744d3610eb4d7134553927ada84670f04f9ebf5
- SHA512 0edd4973f3dd2251ebe27dcd68ac9ae89a0f3e8da044784e1c61d9d565079984730a3fd58f6a8d31ea22845b7eafba0af0fe77035490e17a8434e7a397e6b670
- SSDEEP 1536:Ih6tArbn5BTtWQZZHIPL2/GCbhJ8KYYUDHfy7yEW30bfc4JAyr4YeUqTHhvU0sd5:Ih6irbndWwZqjOJ8aUDHfyy30bfc4JAq
- TLSH
  T19A836BA417FC8C23CAFE4ABC697041940FBDEBC36A12D78F2589B5D9589338125523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  exec/Microsoft.Web.WebView2.Wpf.xml
- Size 139KB
- SHA256 3c68c150d60d39fbbe8b0801ffe773d353b211988eca095671bb3fc8192643c3
- MD5 0e53e7896c101c01cff3c53acb02a5c2
- SHA1 66c1690de7e2a7c99877605c9d909b119ff5316c
- SHA512 05dd727172bb5c99a3fe8277c60bbf1562e1edbda803a087de1295ebb7e30ca5551253e201fc3768b35bc05f5e1a4c6ac04bf6a8f0e8dab53e498fd3fb0781e0
- SSDEEP 3072:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtLryDnLfryDYO/LPm8RLP9R3Ly1vb9QUXN:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJty
- TLSH
  T1AFE3EC10A28CD62248F657CE2AA8F4D0FF2C266735D3DA15304D5F161F77AB1F2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  exec/Newtonsoft.Json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH
  T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  exec/QuorumAPI.dll
- Size 662KB
- SHA256 26f18bfc5c733634f728d0dd5ca44858ed90b8430c54dfa4bbeeafccfabfa270
- MD5 caf801fda57dfcfb4b05b536e77f123c
- SHA1 1ab4f32fdaf176caa9a8bca4734680741153828b
- SHA512 41035244aca318deb9cd656f4b9cb2609e84568b19f56af104eea6cc153e66a7d055af38bc6b75ad851a0659a6cee4268e05ab76bdccf827ed6bbf77bbfcf4d6
- SSDEEP 6144:nk5XtKTDAj1w1ySrNKD+E6A/zUGU+h1PABdUWohKJ5Xxjc:nSXtK/AScx+E6qD1ydUDoV
- TLSH
  T13EE4EC03AE94EB09C969353EC2FA197C27E1F5CB1731898EDF41765B2CC62A68CDC146
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  exec/System.Management.dll
- Size 72KB
- SHA256 f515ca5c944c332ab706ff0a7c2e53e66d0d9d8a663e9b2691b35129ee22559b
- MD5 1c71e5310151ce1e9a3a92797776bdad
- SHA1 fd452b874fec4a9dae61a3710fb32749dc7d701e
- SHA512 2a4f18c77449c2d06a3ab6807338f73b03b1faa332e78319829ba3a2b6fd98bb9a83c5e29b47d55e4ce7f0dfdcd8524fa592a0f3ca8ee09daae2894b681265a8
- SSDEEP 768:BrEP45HksbMU3se5c/0b/9nLZV1BCUkVoV0lP7H0CkkiSLJKdbY8Mtuo0eDQP9zu:bbz5wulNV1zkSQzHxkxS9yc8no0nzu
- TLSH
  T12773C410E7E88378C8E707B6B5B3A3214F74B5C52F22D61D292A611D08EAFC15765E3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  exec/bin/Quorum.dll
- Size 2.3MB
- SHA256 548bc003d52e694b6176b3fb5595fddf07ccecb685eb712c730dc657b382fd48
- MD5 3139b471779a494d4680d9a0515b3459
- SHA1 2f67cb31ecbfb7c275251290818933e33507bdf6
- SHA512 e21406a945fa4664119c3303a084ed5af5cc738fee2d4d6f376898cfb537ce6355266a3ce12712a187e917c511924c75c57c19591459b3884758c16b8f403f3a
- SSDEEP 49152:q+jqPOu2DM1P8daBpcU5TgySscBxFkUXDBIhm1R:ce8/WbTFhDDP
- TLSH
  T18CB58E67A59900ECD076D1F88A1B5513E7B27C4903306AEB02E0B9652F27BF58F3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  exec/bin/libcrypto-3-x64.dll
- Size 7.1MB
- SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
- MD5 b47c9988a203a596803837c128853517
- SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
- SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
- SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
- TLSH
  T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  exec/bin/libcurl.dll
- Size 637KB
- SHA256 8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5
- MD5 8c14feded4b94c4b72af1f710f236778
- SHA1 62dd8f17cff9916faa792a8188f8e82ed6edf9c8
- SHA512 c0222d788aef2be7eb205f923302a79b59ec6018210944cf6d807b073fcd2c08182f42e4a1766b7e42e190ac4ebb090f6afe026a52e5bb11f585db180bbe0fc8
- SSDEEP 12288:EzbJ84IyhxblduSGHhphyfiuEkatR5YI80OdnmqKENG:EzbJ84pjbWSGHz1uEkatR5YI80Odnmqt
- TLSH
  T13CD46C56B3F414A9D1A7C17CC6538227E3B2B0542361A7DB12B4CBBA6F13BE2573A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  exec/bin/libssl-3-x64.dll
- Size 1.4MB
- SHA256 bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57
- MD5 754fff93ed112eb26bd4a6b0e8300deb
- SHA1 de9edf5c9ac80b1f26dcc91d89791065097a7d23
- SHA512 05d215d1e0cd65a98cf55a2a5e123992e5719006eb346261c0c03a629cfe2cde910765a1a87a3f5a93d2371ea9c15d677277b903d55c24731bcc7c7eed87a71a
- SSDEEP 24576:CV6b+rLptrBSFH+tK8olR+WmXWdEVB36eVE:CV6bedt9UlIzWdEVB3a
- TLSH
  T1F1656CAAA7B8019CD5B6C17CC2934B23D2B6F4162370A7DF0A658A781F63BD5173D384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  exec/bin/zlib1.dll
- Size 88KB
- SHA256 f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76
- MD5 68cf6f98cb8b227814a59ff3f909a0af
- SHA1 0383a4d7a74417d3ec90526e61b7637256e0bb57
- SHA512 b59f9eeededd1f76f048b57ae753f79227aead32006fc649532a9bae3f441515bab85338d25b26e5002c54c65d661c0c3048f5c3c1ded6274638ee950afb4744
- SSDEEP 1536:QvkS6XmTzqbKxfXOTBpp/foyUaDmjGI23aIOcIOZhhkxBJNJ5:PdXozwBppnqG3oSZfkxBJNJ5
- TLSH
  T1C5936B4AAAB412A5D6F78178D8D207ADC331701407A44BDF9648A7691F23BE41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  exec/logs/2026-08-22_16-20-37.log
- Size 4KB
- SHA256 0e4204408a487365914abce5d269c7f406c00e107ae70745726ff81d19ebc9a1
- MD5 aceebf517e3e5bd563745c133349a996
- SHA1 fc6961427d6f8a60ab3ccd23b93bd6d32b026aa1
- SHA512 09cd78337f5aa58b5857d0c0ecb024c8c984907c3b59064daee4e45aeb529898d8a01a6d9aca462654c58021a27cfd58ec0c59e6c9493f47b4430ae9235a8215
- SSDEEP 48:o2hFSs/eyJka91JF88Fz/gk/ZPhiCA8oGq6bFME9EXbEOtWqy3ydy7Hy3By6sOyJ:o2hRe4kKxFUk/ZnA3pUg9bTen8rQ
- TLSH
  T1EB91ED5E2AF732735772A384DC016DCD36B2706291991F90F340404C5EAAC5E56DFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  exec/logs/2026-08-22_16-24-44.log
- Size 3KB
- SHA256 55aceb4a92fa489d09810e929b3566b808c66f6da5c0b980638c20cc93136edd
- MD5 e3ca91fa86b241f3f21d59740ac73977
- SHA1 8b289bb4bcb8ff8f787a7b7696e3d9e05cd9d9f8
- SHA512 2f17b0b0ac07982b1f79db62fd4e2f3523b88e1d20849c9b6c587d83bca6a00ef5109e07321da5589f731af26fbcfffd6c53504e5d9122121e66d14771d4327d
- TLSH
  T1FF6198992EFBF073973297C9EC615CEC33A271A3859A0ED4F344504C1A68C8E47CB698
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  exec/logs/2026-08-22_16-25-16.log
- Size 3KB
- SHA256 cda60060d0e36a871b9a1cdc86664f13d971731ce76b716ef4ee7f4b4772e9a4
- MD5 1d6dd9f660ddab048b84fe56fde5d001
- SHA1 204a1073a0920f6f9f7e19191c5bc26d6dd8c223
- SHA512 de70eb8f504109ec0e854f1e570493d7fb9d4b8592673d4bcecfc16ab07a86d70b8dec781188358a6e55b59ce8cbb783ae9f0b1c05210691dd42a84c1b57cc7a
- TLSH
  T1766179991BF630B3563273C8EC15ACDD72E2315586EA2E94F341700C51ABCAE96CFB09
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26
- Target
  exec/logs/2026-08-22_16-26-10.log
- Size 3KB
- SHA256 4d85c061f25effcc54ee2137e5a2fdf6eee300fcbfcba5442e5147f308dfd7e0
- MD5 de40666d3696470b8b2104f843b966d7
- SHA1 12ea3f8ed11d70a60522596156a958c4b9fb3933
- SHA512 7c8ad1544a2dae459ef09f523a80ad76e8c86b443c1d005dc5e342c863a4be1242682b860acc502c118ea4d98e8ff8b0adb0cfa1ab16003312cb366f9d9d4a06
- TLSH
  T1AB61BDDD5AF6B0776631A2C8EC419CEE32E130A1519A2EA8F300921CD96DD5F67DB70C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  exec/logs/2026-08-22_16-32-02.log
- Size 3KB
- SHA256 8724f7bd02eaf8df601955d0f0c89b2a500c4ac280d00564f8aeb1c1092325c7
- MD5 240337eb44743e923daff65b5c5675f6
- SHA1 52e9095d6c78c4851331a0a5bf77d2bbb4d82288
- SHA512 b12f140ff06e2656e64fdbc8d5d603ef8131c644bb017b04adeffcf872cf3f4e28d572adbdaef029da54c46eeb687d5f2a7f2c7b61f709fa92e0f26e31430fa9
- TLSH
  T1C571AA9C1AF674F396316AC4DE016CDD33A664B6A3A28E05B3404C5C81A9D5F8ECF70D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral28
- Target
  exec/runtimes/win-arm64/native/WebView2Loader.dll
- Size 147KB
- SHA256 b0bfa03347a00169903c4ef0c27579dd9e85236a6dcd637a941d20b86eeec8fc
- MD5 12db910c012c9149e66537eb41831c1a
- SHA1 ae7fca10d962c00e6dc96543d754d701d71d80c2
- SHA512 4ccb2254b1c55024079b74f79bea6f007a54383497c730afecd45cff75a48a7078b20f2ca5e84eb1866bb464ba7d5c52cc03b11ca6955076d4207051d90c3755
- SSDEEP 3072:FuUEtKBPDFhOcaG9GQqJAyT/nCneEtJt3BCwW2M3:z7bF1gLnZEtJtBCH/
- TLSH
  T1ABE3199367DD1843E6D6E73CCC678950273BFA788930C95A6152020EDE1FBC5DEB4A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  exec/runtimes/win-x64/native/WebView2Loader.dll
- Size 160KB
- SHA256 a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90
- MD5 96a0434c6a4c91accf292267f0e2fd6a
- SHA1 e5ab2a171d8021572cbf695cc868c70547312132
- SHA512 b886d96b1a50cb6647a79681762d6d2bfcc5d5a07f735aaf38dfd803faa4c48eeb38607b98a481b35e388fe73376dfabc7c4fdfa3a77473dc2f9463b6e3f9a15
- SSDEEP 3072:NXBGnzRbA2eNug2CPrFyg8c/d9U9sPTtno6EtJ7mqRXV:XI95S/1rFyg8e9nfEtJ7j
- TLSH
  T1E0F35C57B2E500BBE167C274C9B34A55E776B8121B60AAEF0364473A1F237D0AE3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30
- Target
  exec/runtimes/win-x86/native/WebView2Loader.dll
- Size 121KB
- SHA256 cbcd9a820b23aec9d68a95fb8cfd8c7d48e5bac1129faaf87aecabf4409a2ee2
- MD5 9322bb0ee84c0dd7bb7d3f7cbffc9142
- SHA1 5b90e001d5ece9854378a9f8f0be7bb4229119d7
- SHA512 141200f2ffe1c2d0584fe84caadb6875a741569cf17c3c159ce9555f9cae595b5dd79b854106f116bed4d18ebbb8349f869c7dfbf6515f8eaf3647b5c464983e
- SSDEEP 3072:UVoqhGzlabA1n+eqp42LILtiCVbApT5n/6EtJY8o/3p5pvHNEo:Qoq4oReA1ELOnCEtJw3ZfNx
- TLSH
  T105C37C00B5E08032E4AF15781878DA659B3F7960DF608DEF2B9815A94E35BD0DF35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  exec/runtimes/win/lib/net7.0/System.Management.dll
- Size 288KB
- SHA256 a7e248c3e6f25f4673e2006fa77f4a4322a3c74c2652dcc395178329feb7ff28
- MD5 76e0aaa7182e77403bf6fe2af8d90f28
- SHA1 d013c5d649f9ebce5bee1c8b774f3290b1f1f532
- SHA512 8e161a375fe174d9b203c2a098c92aff411d8521eef133d5174ae7409c394157f7a067c2a9dfe3f76cb02acbed52c33a11579b9a1cbee75e4092e6487d1a7bc1
- SSDEEP 6144:TMbKUVLmD7HP9ab+T5sBFzPnQpEZFAc2Q:45VL2Z++tw92Q
- TLSH
  T10654195033F841D4C47FAABA903161958FB4736BA60EDF9E1452FCED1AF1B81960326B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32