Overview
overview
7Static
static
3volt.exe
windows10-2004-x64
7volt.exe
windows11-ltsc_2024-x64
7volt.exe
android-15-x64
volt.exe
ubuntu-22.04-amd64
volt.exe
debian-9-armhf
volt.exe
debian-9-mips
volt.exe
debian-9-mipsel
$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
android-15-x64
$PLUGINSDI...dl.dll
ubuntu-22.04-amd64
$PLUGINSDI...dl.dll
debian-9-armhf
$PLUGINSDI...dl.dll
debian-9-mips
$PLUGINSDI...dl.dll
debian-9-mipsel
$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
android-15-x64
$PLUGINSDI...nu.dll
ubuntu-22.04-amd64
$PLUGINSDI...nu.dll
debian-9-armhf
$PLUGINSDI...nu.dll
debian-9-mips
$PLUGINSDI...nu.dll
debian-9-mipsel
$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
android-15-x64
$PLUGINSDI...em.dll
ubuntu-22.04-amd64
$PLUGINSDI...em.dll
debian-9-armhf
$PLUGINSDI...em.dll
debian-9-mips
$PLUGINSDI...em.dll
debian-9-mipsel
$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
android-15-x64
$PLUGINSDI...gs.dll
ubuntu-22.04-amd64
Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - max time kernel
30s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
volt.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
volt.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
volt.exe
Resource
android-35-x64-arm64-20260325-en
android-15-x64
Behavioral task
behavioral4
Sample
volt.exe
Resource
ubuntu2204-amd64-20260127-en
ubuntu-22.04-amd64
Behavioral task
behavioral5
Sample
volt.exe
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral6
Sample
volt.exe
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral7
Sample
volt.exe
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
android-35-x64-arm64-20260325-en
android-15-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral13
Sample
$PLUGINSDIR/NSISdl.dll
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral14
Sample
$PLUGINSDIR/NSISdl.dll
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/StartMenu.dll
Resource
android-35-x64-arm64-20260325-en
android-15-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/StartMenu.dll
Resource
ubuntu2204-amd64-20260127-en
ubuntu-22.04-amd64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/StartMenu.dll
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
$PLUGINSDIR/StartMenu.dll
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
$PLUGINSDIR/StartMenu.dll
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
android-35-x64-arm64-20260325-en
android-15-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
android-35-x64-arm64-20260325-en
android-15-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
ubuntu2204-amd64-20260127-en
ubuntu-22.04-amd64
General
- Target volt.exe
- Size 11.9MB
- Sample260828-l4e86swvas
- SHA256 b2bcd9fc8f7eaceab0a6e826a794344084675950bc34f94f2782e551eeed9717
- MD5 0b1bc8a763f0d63ad5a4b4a6a33b8727
- SHA1 72a06d2a8f7ea6b050b8cbaa2e19c814a8ef4e77
- SHA512 d771f5b2dd82add68fdb80a0ad561911fe2fd5a8d91e90494289208dd336665191d4009cbb555309449fff00117c111e862da8ac4f4324db2168ed48c8159e22
- SSDEEP 196608:dNqzBRu8y2QrvVdZkSTZ30JD2P3mUcc5duViZH0mw9FkuNHuLCoWChTvk91oFcI:dNMH4VASTpEkIc5d1ZUmOSWORWCBlv
- TLSH T199C6337F67D9E487ECC58531B184A2F1A035ECFB446862B36F4ECD028E6E570750A1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 15 IoCs
pid Process 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language volt.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe 3620 volt.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsyAFE0.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsyAFE0.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsyAFE0.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsyAFE0.tmp\nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH