c34902282fbb48cced8c86b085b8d0858818f78fa59146e26274fd878697de67

Resubmissions

28/08/2026, 15:04

260828-sfyh6syzdt7

28/08/2026, 15:00

260828-sdmnwszcjc7

Sharing

Copy URL Twitter E-mail

General

Target
optimizationmaxxing_0.4.4_x64-setup.exe
Size 10.9MB
Sample260828-sdmnwszcjc
SHA256 c34902282fbb48cced8c86b085b8d0858818f78fa59146e26274fd878697de67
MD5 422c406ad0ec1d49f893345f96941c5d
SHA1 9657ceec151785a3abdd70336fcdb57e3dabcdbf
SHA512 64c4e91ad98a74f8eadb10d0f0faf8a46068e39fc1c3bb20b974e01fb4121dd7a10b433fc575dce60573bb2caf925f8bd18a924fe8f4d4276ae17ae51909e833
SSDEEP 196608:GhIjIAD9cf6PjeL6UlyPeQAt79QPpj1vPd0RPugkwmh6YpPB3WjrxvIGmnq4Jvtf:GtxEPsJ0ppdztVppWjaXqmVhHALk/j
TLSH
T19CB633C3D81282CBE53B8D73E67A6C790C093EA639C21516314CB79D58F7258926FA37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  optimizationmaxxing_0.4.4_x64-setup.exe
- Size 10.9MB
- SHA256 c34902282fbb48cced8c86b085b8d0858818f78fa59146e26274fd878697de67
- MD5 422c406ad0ec1d49f893345f96941c5d
- SHA1 9657ceec151785a3abdd70336fcdb57e3dabcdbf
- SHA512 64c4e91ad98a74f8eadb10d0f0faf8a46068e39fc1c3bb20b974e01fb4121dd7a10b433fc575dce60573bb2caf925f8bd18a924fe8f4d4276ae17ae51909e833
- SSDEEP 196608:GhIjIAD9cf6PjeL6UlyPeQAt79QPpj1vPd0RPugkwmh6YpPB3WjrxvIGmnq4Jvtf:GtxEPsJ0ppdztVppWjaXqmVhHALk/j
- TLSH
  T19CB633C3D81282CBE53B8D73E67A6C790C093EA639C21516314CB79D58F7258926FA37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  optimizationmaxxing.exe
- Size 20.7MB
- SHA256 f5a6db34cad5ba967f1ada3fd8a707e960b08341b6ef1f89d50e5722bdf2f0db
- MD5 41a367c342e1f6d1ef7f2a7626939066
- SHA1 d0a2b347bc40ec3bd1422fecc6930c6a83b4a2e6
- SHA512 ec3ef09f51c92987db4b59ebdeab5f643d17af27bf444d138eb6e94589b433e5515b8f4cde38f75aabd73ea1f9e0c29bf37dcc815f4dbff951482a6171d648da
- SSDEEP 196608:gcejYlVQ0wyH/71KOJar0CR4zjD0yWyRckIZIjI:p8Y30yH/71hEr0LD0yW6c
- TLSH
  T17B2718257A5A996CD09BC47483478A720A3134DF1B39B9FF4484A6393F79BF46F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery spyware trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral9
- Target
  resources/lhm/BlackSharp.Core.dll
- Size 38KB
- SHA256 d246573905b8b4ffbd5dae02c5cd8e0000df630056efa2131bd706db57b90928
- MD5 813bd34aea0dfd9a5c4ca85432485481
- SHA1 11574c55c10973e5909fd9b986970fe79f6e0347
- SHA512 f43f78c37d47d5d69733ab89c2a47f29fdde9fcce482a40c7a0c595705438fb052b177983d8cb6bd7e064b562fe1ee91573eb2448db7e05b28bf96d1ad20928c
- SSDEEP 768:L/T8PPFu07X2noLfgtAw+9q0ENPfQg7r9GUVmxJHvJ+0pgTD8U37yH:EPPFpX2B+d4VmHxJpOC
- TLSH
  T1B4035B85A3988733DBCE1279E5F512D54772C642D673FF5B3688A0AAE8133D846023E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/lhm/DiskInfoToolkit.dll
- Size 997KB
- SHA256 2803e801098fe485d39f34f5b7056e33cdcd24547005d9bfdecc639a0ee664a0
- MD5 7d4d64f284e6dec994869b1ed0417059
- SHA1 d9db67a15023079e3936a11ce714c63d5bef4980
- SHA512 0a1818c48f31b0d26b7be6b0436ca115c6f70c1cd9ca4a2fa1af9a75a5f191a03f3eece2cf815d3ee670375181e2c301b5a0917ef19f91a432a7853ac7188f7d
- SSDEEP 24576:UsXNJcSCNMDiCwK75ddgP0oZMNHmCkhcJuzLpHmrpC4Ei:7XXRwK7LG8oyH0vpwC4
- TLSH
  T11225CE3453E49716F7BF6F7BA9B2881C49F6F83D5E22C74C9C85014E5863B80AD127A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/lhm/HidSharp.dll
- Size 256KB
- SHA256 d86690efde30ea9179f669320f39148853793b743a98b531afeaf30598e22f54
- MD5 3876a747858ca11995f25a8a4a8db104
- SHA1 4094d7e274f9d87d8c93f3a8aa14606dbf3994d8
- SHA512 c67545f6ca74dc59690e12b00a8c0ddb848926c414f8d8af14a2290f5ed647a481542f90c7b47522c1ba32116ebd3f16a49315a86c8a8d7508759ab7335add78
- SSDEEP 3072:E1lZKoJKw/ATXA2okJSY4tvmWB7pbDXQrKsbiffsv0JKdyxCCqIZ2nyreCoe+:ERJ+TXA2okMjv3BlYKYAs8iyXWyCCoe+
- TLSH
  T13C448D0D5BEC862FDDEF4735B43298148BF1E495A212E7AE15ACD4EA1C937C089413E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/lhm/LICENSE-PawnIO.txt
- Size 1KB
- SHA256 b25cd2121ce5d81eb5fc067e1d4b53105586567811e7114b75f7ee8206081d7a
- MD5 eb80b8c6fa0986164321d8333211419f
- SHA1 695a26b9a733cfa98b7a79509de7c9fdcde8d700
- SHA512 2e3e964125517b8e11aae37bbd2f6fcbcc6a67e18cc0dab2ca77c0e65c7f27ffc2fd1444321660229d3b02328fb7247689e4c7cd8a35133f18997c0ab59a8d69
- TLSH
  T1B8214E6F166160AF1AD711D4A51AA4CED9D54297FEE60054B27E836C0B3E3F1B3E80E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/lhm/LibreHardwareMonitorLib.dll
- Size 1.2MB
- SHA256 efdb5923de1ca5c2178e90620d19d8c45e5c13a8928e8791d7a9fb211482f0bd
- MD5 1f8a5055959053af201e7e4265e17e88
- SHA1 9cd220c61a8b58d0d20447aea1dcef6b1828f793
- SHA512 36c5646ca7d309ce43e60fd1bd4528e909ff59e31fb51b9cb72fdae63264bc50afeffb454f20c7b19890f88e6babc3039befa205faf984d69b044b07b366f43e
- SSDEEP 12288:qLAYDyNTwRKU4lRIxh7DK3SVkW+DowxIeD1SxS7SjEv1Gy7:quUJVHzbe0xuS
- TLSH
  T1A9451914B5DC4E36C49E1A7268B16A055BB8BC03CB59BB3F30883B5E08BF744AE15797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/lhm/PawnIO_setup.exe
- Size 3.3MB
- SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
- MD5 956e73fc2a40945bc66af3a3ff963371
- SHA1 096660b9e3aeff0547dfc621c03953852afd4629
- SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
- SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
- TLSH
  T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/lhm/RAMSPDToolkit-NDD.dll
- Size 243KB
- SHA256 a1ab5d8b01ac322ba94b4e0d2f926bfe1497829602de570375fdb5dfbdae651e
- MD5 d66b11fb2e1257c39630ca635cd207ef
- SHA1 2f9d9ed53b59f421dc38fbd86862d3d4adb39a03
- SHA512 29cb585b1b2c227e4ba64a565cffb5dffbec9c50f95944353d9472ed8b8638abbcb1e839e009996166ad671e233ce20ff14c3b8aa99a7c399bb744991e28e4b4
- SSDEEP 3072:7vfR8QTyXwsXdNUHH5PTBc1Ox6xLd2Uxr2ETaHG7qv8iDjf8QoooYe3KpMQ38koT:jpqfNUHH5PTBc1OgxB2caHG7g8eLdo
- TLSH
  T1B4341D3833F96B0AF1F6FB75587641214F36FDAB6831C26E2910999A5970DA09D30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/lhm/System.Buffers.dll
- Size 23KB
- SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
- MD5 902760412abffbd10be14842e83f0c09
- SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
- SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
- SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
- TLSH
  T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/lhm/System.CodeDom.dll
- Size 32KB
- SHA256 11f84778b7d021da6c5f57fae1427317233fe262a1e2c447332efc404569a9f7
- MD5 b5bfafe83adcf54cd007d1c4a4598184
- SHA1 4cbb375a0efc2184921277c57b434d619d9201d3
- SHA512 b76b59deb6fd7a0c3168e456f5c552579ee8485018bac3048d818cba2e002e5a108f34c5e1bcbe18db5539fe33a3496d7d9d7cb9baee293918562cd532d8f65f
- SSDEEP 384:+qwpvR+BUhi82PR3P8f41AE2YNqNsBxehzsCtZ7U6rtk2rBy5vWQZuWHlNacDR9x:+/vs825UQSE2YkhzZ/2/9zg4P9J
- TLSH
  T11EE23B1557EC47BEDFAA0F7029B781961FF5B2D33822D72E224980095BA2FC85532736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/lhm/System.Memory.dll
- Size 141KB
- SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
- MD5 bd7f42207f4fdb9c7eafb0013abd7334
- SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
- SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
- SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
- TLSH
  T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/lhm/System.Numerics.Vectors.dll
- Size 107KB
- SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
- MD5 a57f205ce75d4e4a19020e8b627469c4
- SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
- SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
- SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
- TLSH
  T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/lhm/System.Runtime.CompilerServices.Unsafe.dll
- Size 18KB
- SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
- MD5 cb5b861883d2bddd9833c9fe956406f7
- SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
- SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
- SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
- TLSH
  T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  resources/lhm/System.Security.AccessControl.dll
- Size 35KB
- SHA256 ff14c5f628b9a6798d173aefbba0a43d61e66f715108e2576ac0d3dfab9071d0
- MD5 527595c86ad17045a101d567d7d3279f
- SHA1 83014e2a98f7597b9a26e424a0759e5a3d2ecff1
- SHA512 9ebaaca1623bc8e2fc8df158f338b5e415670fa53e212bb38771e7e25af9688301cc4aee055c5b64e33f8aa24729ed896e0be8e2dbce54386583c660476c5dda
- SSDEEP 384:zdlIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWI:ZlM7Ke5/WBkyN1hhMPS
- TLSH
  T157F2E602A7FC1229FFBB0BB07E7999151D7BBAD63D12C50D1155910E19A2FC0DAB1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  resources/lhm/System.Security.Principal.Windows.dll
- Size 17KB
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- TLSH
  T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  resources/lhm/System.Threading.AccessControl.dll
- Size 33KB
- SHA256 f2ea3a373dd4964e9e98ca9f3d9d3de21ca4dbe870483a2765892b0cafb954a9
- MD5 f2d128f2b52ccde5058c2faa660bcb5a
- SHA1 0e127f8e34fc476b041092f60af5ad223b9ea172
- SHA512 0c7ade32b5c6414ec32492cca13d0d4a29bdea2f7cb7040cf5b7e55fb4cca806d26e2bc1b4c08e5bbf6bb2d9337e768046a81fe2498583a9b799dfa3a171e9b5
- SSDEEP 384:aMjk+UJLZSEey2P7WX9W47zEGbOVAUrl2Yd5zcNnKmEcK6T73WAJOWvlNSifX7RR:hjgJLZSm2s9NgSqTf037NfF9zAgJ
- TLSH
  T183E23A12A3FC037AEFF70FB0AA7491552E31F6D21903D29F5149B00E6A67B808A71776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/lhm/read_sensors.ps1
- Size 8KB
- SHA256 62e058109e7b935aaf22ace9d9f65042280be636ead42ede2ef1d535b17ef493
- MD5 abc238785689879ae477ff7bac8f692d
- SHA1 79aa2430bf524b573d38175c44912464df26ed31
- SHA512 22ef58a96258c193b7d8d0ebc4d1490efb52a0237e3ec136b6fde184b341133fcbd27ad6e2c815dcf00229e7f14f09e2ebc741fb4fe2b602e200f35860950b38
- SSDEEP 192:QBnu9LczAP9AER4DXE0Ie3pP06lkSeQn7hiBEpLWv6HKZZoZ+F7BIAEMxc:Q144zAPdt+R57hiBEpxI7dxc
- TLSH
  T10D0275A5AA14163105F207B6EF4F9047FD2720B762525100BB8DC388BFB6B658636EDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  resources/lhm/read_spd.ps1
- Size 3KB
- SHA256 b6bb1f0cf893b5c15e9958bf5c69c58b348d49be86f58b5d1dc1497875962e95
- MD5 a3701ceb09e9475fd165c8432af8c524
- SHA1 351fc5ab0f0a3e64a5b8b609c8a52c1de1f4d126
- SHA512 641ab16f5c4b6653f94a34ea61029fe5736e1afd5c22ed89395c165a380408638f3764a13682e396c5baf686fb92b64cc816f23c060419f0f035340753a72f35
- TLSH
  T1AE81A33A792506BB25F723F2F98B1245FA42512BA1700A4035ACC2D56FB6878CB70FC7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  resources/presentmon/LICENSE-PresentMon.txt
- Size 1KB
- SHA256 67325e1b19f5c8fad351906722b9fe86c91ede5a142c887e81837a1f19951ad7
- MD5 17deb13adb1a63c3205b9f2ac961a4d9
- SHA1 c259b1db4836d08c1c1f3d862207bef6aed24318
- SHA512 206402fbaf909737743faa2148a1fe12faffc1aec70d6ee3cc21ab47b44ecece7ea74b4a9d33a3dd42d2a38c11d17eedc1e22482163aa5cb0b7f61a4c9d6bcce
- TLSH
  T17E21845FB69103771C4A47A15669FCC5B23BB08E7E9F0984346EE209532A01DDAFFC54
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27
- Target
  resources/presentmon/PresentMon-2.4.1-x64.exe
- Size 905KB
- SHA256 d74183e7ae630f72cd3690be0373ecbfdc6cbb86578148aab8fa2a7166068f34
- MD5 4fdd9a07e94d4406aa64ef1dc25174fd
- SHA1 a3715ee13982ce97d39a031207ef2f490e20461e
- SHA512 61e6fe1afd542cb05d5cdbd1795b4ca750b43fceb67cadcfedc8e85243c0cade9e4f7e31a6a9273c8ef504875dee935b20baba349210cc165e0135f4917aa379
- SSDEEP 12288:83xoNatqvEtmLjW0nJTUph0lhSMXliw9M/f0tsOVY:83xoNWbtmLTZqh0lhSMXlK/fNOVY
- TLSH
  T129158F19B7EC01FAE476C2798E668903EA767C45073096DF03A086A63F379E05F7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/scripts/clear_standby.ps1
- Size 4KB
- SHA256 9522a1526e677a97849716f1d13f8a720cf479e51fc4bdd6ea2436e3d1369200
- MD5 634a8beaef9344196553653834a3a1ae
- SHA1 d9c7a0adf544bedd69386f0c3dfc2b2e7ed6979d
- SHA512 8d2ebc28adbaae199b5923a488c7c578cd32e13920c593cd86bdcc8c28a47f6e0890792bb67a62fff4a24486e68c62671741d27c304f6c117468eab997568ed1
- SSDEEP 96:B4pLH/EYFTtlNjSojhgvp8IicnJ0tJakN8mlar/ozo9hDYdBzY4e:B4pL/EYFTtlRiB8IVnIakN8mQriGOdBe
- TLSH
  T1A3A1A7D5632D51661CB153A6BEC8708BFF13006F096EA924B89CC3A01F3A112E3B5F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  resources/scripts/hide_launcher.vbs
- Size 942B
- SHA256 c047b60cab78025e8841b6f0ed22a97d251b4973bbf1a8198a8508cf23bc6cae
- MD5 39cc50924793d13079d1c7ef90cfffde
- SHA1 c60c91c45e59af40aea91d757be987ae88a08cb5
- SHA512 dea64536003c73867d61db43404cf48fa387ac81adf2b3a009a15b65d2a7ae937ddccb1b5dbcd267eaa6775518c27dbe88935acb871571c67f9b0b299a5a63b3
- TLSH
  T14C1144129C8E42B84E36220F56AF9958CF5774246314A1AD3E95D62C783027BCEEBDC7
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Network Share Discovery

Checks whether UAC is enabled

Network Share Discovery

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30