98ee10105d4a4c1491332b62ffd60632b8646e075badd7a439efdd749b9f6db8

Resubmissions

22/08/2026, 19:56

260822-ynqfesbq2y8

22/08/2026, 19:48

260822-yh6kfsbp9v3

Sharing

Copy URL Twitter E-mail

General

Target
Key2Joy-0.8.0.zip
Size 167.2MB
Sample260822-ynqfesbq2y
SHA256 98ee10105d4a4c1491332b62ffd60632b8646e075badd7a439efdd749b9f6db8
MD5 f8edbaef560f30013a8079d30fab8744
SHA1 b06ac415ae488a6c424ab2f1da814d84f2fdff07
SHA512 ff4db6f149611fc3221ce992275b3d337189047f7f38141dcc372c9003a6cc244a0a82cb3b1d6f3fa8e2dfd2c50cece5e08c6db0e767634ebdd14c2ae9de3e5a
SSDEEP 3145728:9VLM/sIRcU3fe/2A/hyQmLEGM3sysP2ALM/sIRcU3Ge/2A/haQmLERM3sysd0:HLM/pPfeOA/MZwp8JZLM/pPGeOA/QZwy
TLSH
T1B48833A881F46DCDC8753C32B07672262B78AB66C463517712BC12A7EAD3BB97741D03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Key2Joy-0.8.0.zip
- Size 167.2MB
- SHA256 98ee10105d4a4c1491332b62ffd60632b8646e075badd7a439efdd749b9f6db8
- MD5 f8edbaef560f30013a8079d30fab8744
- SHA1 b06ac415ae488a6c424ab2f1da814d84f2fdff07
- SHA512 ff4db6f149611fc3221ce992275b3d337189047f7f38141dcc372c9003a6cc244a0a82cb3b1d6f3fa8e2dfd2c50cece5e08c6db0e767634ebdd14c2ae9de3e5a
- SSDEEP 3145728:9VLM/sIRcU3fe/2A/hyQmLEGM3sysP2ALM/sIRcU3Ge/2A/haQmLERM3sysd0:HLM/pPfeOA/MZwp8JZLM/pPGeOA/QZwy
- TLSH
  T1B48833A881F46DCDC8753C32B07672262B78AB66C463517712BC12A7EAD3BB97741D03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/Melanchall_DryWetMidi_Native64.dll
- Size 60KB
- SHA256 6f7f395e4f99c8717e027a7946170128ebaef248d6e5001bbbdab1cc880f2029
- MD5 d2229bc84ecc55e5e39c969cde2baf7e
- SHA1 5ccafe07c99994a577a8b808b1385f4d772e822a
- SHA512 e640540d3ec616d78ca67ba93b40d7a40e0e7646a773419e3861799e03c40333afad6c6e21e1786e66932e90fd3aa3548ee5cf4d71556e571f3dcd1c0fe2fc6e
- SSDEEP 768:uVoOsCS6EsqdVZ/osZFjo/rkwddVu6y/ibAlWgm02:ms3bTAEjiQwjVByaclWH02
- TLSH
  T1705373E27F948D9BD945637C62DA8262373CFDD14763070722283A315F13AC13EE969A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/Melanchall_DryWetMidi_Native64.dylib
- Size 104KB
- SHA256 2732100f3cf560e6e657b212410432e7e0814418e52aa2d95fc706589b57847e
- MD5 82c31679809567ee8b1eefc78aa7e826
- SHA1 20cc4a1b6815e644d69cf25d43357ec10a7aec68
- SHA512 582a5e44e6ff9865f282173ddf28e1b0dc6b9de0a12752980749ab0c4161dc6b9e1c0da5c0783887adba607fe1620c5a28399bd8c14160bc33e0c9b81df2ac49
- SSDEEP 384:Waq9ejSoKxU/nEksmnlXv3cUOj34dMjN/gQxNHGZF/spVyjN/g+8/dzctCO7Frxf:Waq99344QFvA/u5Fr+a0VsV
- TLSH
  T1ACA3FAF25B8CAD2AC18F6374855603C1F432FA1711E2461EA78C5F91EE257C4369AEDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4
- MD5 970b6e6478ae3ab699f277d77de0cd19
- SHA1 5475cb28998d419b4714343ffa9511ff46322ac2
- SHA512 f3ad2088c5d3fcb770c6d8212650eed95507e107a34f9468ca9db99defd8838443a95e0b59a5a6cb65a18ebbc529110c5348513a321b44223f537096c6d7d6e0
- SSDEEP 768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
- TLSH
  T1C6C26D16E35C5317CFBA2EF5E570D6432A35E78A2C12E72E1148E2A51C97384AB31739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6 behavioral7
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Runtime.CompilerServices.Unsafe.dll
- Size 17KB
- SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
- MD5 c610e828b54001574d86dd2ed730e392
- SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
- SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
- SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
- TLSH
  T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 c792bfe3f43c894e20339252d159a96a20ccc6e13322b2d382570ff97939e501
- MD5 c77ae3414d78c1f082c65415fae69661
- SHA1 3b35461d86a774535ac226ca9706fb50332de20a
- SHA512 08941ba8be5031cc4e363a916525437c62b409576c91c10fc72795faa10bc989f0d1797b576802e208dfe4305a4447c0299e2755ba92f97f531de1f56fd5865a
- SSDEEP 1536:4OO7OOOc2yIDmBkKQh3rt7jUGyRG/mz4CRLf8ocVW4t72bfQZHzp:fyMmXQh3rNjUFG/mk8f8owW4s0ZHF
- TLSH
  T1DB736E16A748C71DC71E153256E085619BF0DFAF1323F7822845B82E2B733C9FA1D6A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Text.Json.dll
- Size 568KB
- SHA256 1f2452eee60a8c4ef3a894ddbac663f91ebba3eefee54e1b7c424de1f82e6b6b
- MD5 962630bd48df30b2704db18658887f7a
- SHA1 b57d63dd1442a9c350fed5eb0b509835809523fb
- SHA512 2182418471c12421bf885f31e6b2120e1ddb4ffe4c16baf527b10bc307c48ef037e26a2a3a8d4fc37b7f5bf2694c0330ef6fb7cd07ea5a638ee978ea85b8868b
- SSDEEP 12288:Wo+rY8ZyAVNXL1VPGSEhOiUHsHEg2A9fcRne:WhxXXrPGSR529
- TLSH
  T152C46C6023E89A2BE6EE0774A03550148B7BFD2AE3ABD74F114499FD1C927849D913F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH
  T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  bin/Key2Joy.Gui/Release/Plugins/Key2Joy.Plugin.Midi/System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH
  T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  bin/Key2Joy.Gui/Release/SimWinGamePad.dll
- Size 888KB
- SHA256 91cb5de8211cff262bcf9ab4f1629d47215d7169d7853173334bb9136e223147
- MD5 bc8eb70eb8a3bfb86ef6c92502d5acbd
- SHA1 097eda781f08042561da8ae050819e4f345418de
- SHA512 a17f509a35614670ec62e006e892f45e93ae8e9f8265a47928739718c5d001f5823279f38a1430ba5ac5b51f6c1a17b201eeb199b1d793c92055ce6ff8bbdfe7
- SSDEEP 24576:Xy3tdHmOHb6ep2BabJ3kLtd8h3tdHmOHb6ep2BabJ3kLtd8:ivHmO76egBabJyQvHmO76egBabJy
- TLSH
  T1C6150206BBD81172E5F74AB15BE626A31972F6D31B015ADF21B883921F61BC0ED32347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24 behavioral25
- Target
  bin/Key2Joy.Gui/Release/System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  bin/Key2Joy.Gui/Release/System.CodeDom.dll
- Size 33KB
- SHA256 fd9de6770340b32d1a57e21833620f5f440638ce518a38d55712424162b847e5
- MD5 a36b2872171540035cfde705a44a0c49
- SHA1 e8fe914a84e3e9b7a6e3faa4be6f002c1e281e5f
- SHA512 fdeb93f68bbadd28892ee864b7d7308a5831dde5a7f9f58496f6bdca7ecdb0311bb27e0c93320fb3aa1f1fd9375d50a40be9918711508e3ffc555ccfe8644bc3
- SSDEEP 384:56qwpvR+I6Fi82PR3P8f41AE2YgqNlBxehzsCtZ7U6rtk2qByauvWeuW4/hljHRI:56/v9825UQSE2YwhzZesIDjBiV/9zZKi
- TLSH
  T17CE24B1557EC47BEDEAB0B702977819A1FF5B2D33821C32E164894091FA2BC88672736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  bin/Key2Joy.Gui/Release/System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  bin/Key2Joy.Gui/Release/System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Manipulates Digital Signatures

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32