Overview
overview
3Static
static
3VMProtectSDK64.dll
windows10-2004-x64
1VMProtectSDK64.dll
windows11-ltsc_2024-x64
1Yerba.exe
windows10-2004-x64
1Yerba.exe
windows11-ltsc_2024-x64
1brotlicommon.dll
windows10-2004-x64
1brotlicommon.dll
windows11-ltsc_2024-x64
1brotlidec.dll
windows10-2004-x64
1brotlidec.dll
windows11-ltsc_2024-x64
1bz2.dll
windows10-2004-x64
1bz2.dll
windows11-ltsc_2024-x64
1freetype.dll
windows10-2004-x64
1freetype.dll
windows11-ltsc_2024-x64
1libcrypto-3-x64.dll
windows10-2004-x64
1libcrypto-3-x64.dll
windows11-ltsc_2024-x64
1libcurl.dll
windows10-2004-x64
1libcurl.dll
windows11-ltsc_2024-x64
1libpng16.dll
windows10-2004-x64
1libpng16.dll
windows11-ltsc_2024-x64
1libssl-3-x64.dll
windows10-2004-x64
1libssl-3-x64.dll
windows11-ltsc_2024-x64
1lua.dll
windows10-2004-x64
1lua.dll
windows11-ltsc_2024-x64
1zlib1.dll
windows10-2004-x64
1zlib1.dll
windows11-ltsc_2024-x64
1zstd.dll
windows10-2004-x64
1zstd.dll
windows11-ltsc_2024-x64
1General
- Target 9p5mtt.zip
- Size 5.1MB
- Sample260903-18dy8sca35
- SHA256 44be701a1cac2e44671e048ab0887ac868bde4f707ea8b57794217c7fa672038
- MD5 fac7fb0e1470fcba1bdbd096ca7e8af0
- SHA1 f4e7d864c580083a82e63804bd9b867dcac71971
- SHA512 eeda16bdf81d0f7682c39c60c3fcc14939984f8faf4febc110f6f925edbc77f377e459d0c7a1becd0f023ef36125c7fa21fd359c3b426d137718e867409f85c0
- SSDEEP 98304:5Guxa5HxaAuJbIoYwVK7U7Emj8TuR8wjTRzpXlIrbh+XVQfJ:5Gu0YNIuVK7U7EkyuRTdbv+fJ
- TLSH T1AD363315B1C9A284E120B977821DC9F6964B009FDB3D8F2BB23D9927D855FCA1CF850B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
VMProtectSDK64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
VMProtectSDK64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Yerba.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Yerba.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
brotlicommon.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
brotlicommon.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
brotlidec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
brotlidec.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
bz2.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
bz2.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
freetype.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
freetype.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
libcrypto-3-x64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
libcurl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
libcurl.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
libpng16.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
libpng16.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
libssl-3-x64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
libssl-3-x64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
lua.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
lua.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
zlib1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
zlib1.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
zstd.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
zstd.dll
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target VMProtectSDK64.dll
- Size 116KB
- SHA256 cd2cdc90f423c9d23ee55a242d68a1731c12cc69877de45e913646356f25b597
- MD5 5cb50b816388efa581dc9cbf17c50f15
- SHA1 7f7299786f35c9658795f5739bbc14bd50f4bfe9
- SHA512 513ec1464a2b4222115f2590579349263487ba2d83382658b17123f7688deea915e30c29b863dca75194b7f0e0c82715c590dccd919fad4dc8f0438fac22ab03
- SSDEEP 3072:dmcqYHq7Aiytzg2ScpvgJcG5sqYX6UyHdlBS:40Hq7AiyegZgJZSXq9H
- TLSH T14EC36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Yerba.exe
- Size 3.5MB
- SHA256 09f23772dfafcc8b90ac9b0c0f8879c1834548c9e28c94e0c8f55e03e3779b36
- MD5 97ba38b7e2edde28198dc4e94a9e271d
- SHA1 035c30f2d82433a5679960b046c3822f74116d3b
- SHA512 42b63f47972d5cd58a9ef0d434b0461e2a49d7847edf84d541cee26b762223fc8f1aa4e71c2795165dc9ac9123b9f5bf9a76a5c6dfa70b4cf655967a80c55417
- SSDEEP 49152:QxZ9Z24DwKtPgJd0AP23G5g+i8MeWXusAE5FC+:p4DI2Wc8MhXFFC+
- TLSH T15306CF06B392829DD122E9348EAED327F732BC540B3193DB73D96D255E972E05E3A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target brotlicommon.dll
- Size 134KB
- SHA256 a398f6173f328db8dc3e91fc0dfd9bf116e4e114d44d5e03a1eabae8f378f1f5
- MD5 7168131b2620f19a8936bc7811907357
- SHA1 e331417a964349c538e6506ee8188ca5600cd461
- SHA512 d7d375487a2e5d1218c6d1c6a8d1084dfab9b7b30580f13572dccc10a0509113b4603c882ba90557868df97885058b4c2bc6dbb5a0ecdc669cfad4e4b780416e
- SSDEEP 3072:8De4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBwz:8De4AhdNorGvHdbi09GJez
- TLSH T108D37CA1F3051736C26B227AE45A6BB9F33582B493670551B4A9026D20C3CE4973F7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target brotlidec.dll
- Size 50KB
- SHA256 373d4fa6e5a7a15edef28643beae8d05a1ddfda73222999837fd9e449f6a8e83
- MD5 2b35743ba50957f63f2b70120926c9d4
- SHA1 19fb6975e080392bc898453dbbf38c55c6d9743e
- SHA512 f4fb0b25b5c0d3a20077af25ffc47ad25b0948f99633465c0798814788463b32a37d453f89841a44796197571cd3b8b3f199b28952a8ed6ee0a98a4e911635d1
- SSDEEP 768:17VbWjlJBLxfuddHz3Y7gDn1Uu6EDMW23q/AazQxARbYs30eWR:17VbsvBxizIUD1Uu6Mj23EnwR
- TLSH T1B1338D52B6E54A5DED17C1388377E26FD3BB784D6344E3EBA1A0F6352F136A02271281
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target bz2.dll
- Size 74KB
- SHA256 9feca76e1931c2108c113f2bddf8447141366aad93024a3b978cf824a4972a62
- MD5 01dd0916dcf3060fdf72009e45e13ff4
- SHA1 722d6fd024d93e2094c3ae498b1f4bd9ad380b05
- SHA512 b632eae25f539a0b52d50dfb76dfae6fd6d5617f09bb1a0122ac389544e7f031626c2e2953f32618992ce4e9b65662b92912ea55c8b844b29bf74b9e754c268c
- SSDEEP 1536:FSu+4Fcr1hGkILsNUgVgk7387GbpFqlkXi2vsE8:nE1HNJikiGzckXNvsX
- TLSH T1CF734B4176A3AF7DC95B853D5A63070BFB31FD340B2513FF2560967A2B22AE10E7421A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target freetype.dll
- Size 675KB
- SHA256 75c827dd1edab04058285ed0d831f785b1d69446ddeb6278eb0c73337d442abc
- MD5 4dcb3b4c91db8a31c4dc620d64f255e2
- SHA1 b8a5191d55d4ccd8d2b0f00c23010057a35b66da
- SHA512 42e82a091e4884f1cf1bb8a0924da589861e59a3adf1adb5637b4d3ad2d2620eff65c9af078df9f6f49d3441eb2aa22b95b54619ef6cd62bda54868fe3a5e3b9
- SSDEEP 12288:Mq027PN0rQe7GKFCaXKD4GiGVikUEC6JRc/aZrvxy4y8Ps4WfEWmb2j3:Mq025Ve7GKgaw4LhkRKykfSZi3
- TLSH T1C6E48D82F3A405ACC66BC2788717871BE37674051311ABDB56A09B6B7F13FE16B3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target libcrypto-3-x64.dll
- Size 4.6MB
- SHA256 5527ff18dd749687d886ef7f383463b6ce7bca66c773d6ff94f40190da853ebe
- MD5 2b29fefde1095bad70504c82d37f8323
- SHA1 2e2cff1ab2b229cbc0f266bf51a2c08ce06f58e9
- SHA512 c3d52300cad66daa405a4ca44d55708131f15e32a1948018aceae1e6345d56a7c8c130f09e2b035ec8442c4070a040f6f377aea44d9e714c54c673c0d68b7c6a
- SSDEEP 49152:EZ18MKT1dSmj2zdfzg5BBa3dETE/9by4L38dsJpzWdJLjijzeZ6+yzJBeMzwPLIN:uuImBBc8RKjuozkueq1CPwDvt3uFFZC
- TLSH T181265B6AABA81188E4BAC13CC1934617D2F1F826577097CF19A156790F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target libcurl.dll
- Size 584KB
- SHA256 4fe44fecc8c32f2da4d0bb9f03ff1fc5ebf56ac96a08fd955a29a06acb7b00c5
- MD5 432033671b5c826b0972519e61577820
- SHA1 f71831f756c4b5aa4f0ffac0ff1b9a9db4ea7506
- SHA512 7a5d6fbfcfe02d724576803bb7e727bddcec58732b4633c3f6d72925baa765d3a770297beec42bc1e760596185221966b95c65fa975be092587930410b628c2b
- SSDEEP 12288:Ms+KDmRRE1Q9Tlgy+Bnwzfddht2ei8T9zZO6pBHeY+MPjBZV:MjkmRR0Qd4eZ52eHZO6pBHeY+MPjBf
- TLSH T112D46C56A3F410A9D1A7C178C6578627E7B3B0541320A7DF17A0CBBA2F13BE2673A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target libpng16.dll
- Size 203KB
- SHA256 6010037f78315a41fb3784fa04123b32655f074e16282cfdfced08907f5d3ff8
- MD5 ecb46d09956ef505b9f685b5eb72ae22
- SHA1 e78a29bc1742137b5bc5da895f7f3e52e432abda
- SHA512 25c13959f9d1f351508b3e1f11678ad68a7a6d4082ed039e93235916820faf0c6bf744c169b61213e1c644d7fb5719130fa6947aa9cf3190f5361627846dd05c
- SSDEEP 3072:2QHq/8oeA3ydWdJ4Q68TRnp0nEvptyKsQYq2Sj0jmx8WA+4m:2QHqJwWdr6ionAKKYq20xh4
- TLSH T1AA148E8BB56504B5D993C03C8557E02BD1B2756813649BEF1BC0DBB92B13EE87A3A702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target libssl-3-x64.dll
- Size 537KB
- SHA256 96dde73df4a2df72d5fc788e1ad99c6adf388cd42c2f874cf8d6a883a3654bf7
- MD5 5ae31cfaf71fb03d07a2caa4f5f80ed0
- SHA1 a9dec69c227ef1c6b3fb6c5296695f7f03fcd46d
- SHA512 8c571de5bf27e8ac83be213aa290128db95039dfeaa2fb80698e77ba0a2b3b6630b4aa08a3402585891923b162824b5227b28372a47c9a84de5f9fd0ba2b4f86
- SSDEEP 6144:LFPdnNGPhGpJbSOnhB6giIY2Nrv+LUAxb7lW519ivM01sQi7E:plNEGpMOnX6giIn8JWN8M01sQi
- TLSH T19DC44BA9B3B4179CD892D13887538613E7B6B4563370DFDB0BA48A790F23BD4263A344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target lua.dll
- Size 235KB
- SHA256 94c34777b3df185226f0d729f7f225065bd7de42b1e6c2bd7fb85d0858e9daf7
- MD5 11c035fd57284b212bda6df5f5182c1d
- SHA1 f561475f858628831c6856efd6fcca003ef33b43
- SHA512 f9b0e0250966cf0367eb31f6d708116d496faddcc0b8b5164d07eed6e70f332e2137f10009e5f48829ab766773f1c5736ad8b1b7ce129866487bb3e876d5af12
- SSDEEP 6144:rsNNC13ppdc1zQLxgfu6uT5+UkLFsa79nFbAv0THazM:oa3lmzygfu15+dLFsiToM
- TLSH T14734294936B80CA4DABBC0798A92460BD3F2786407B1D7EF17E147A71F17AE46A37710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target zlib1.dll
- Size 88KB
- SHA256 cac42d58a553b6847fa331faa2880e78241f0fea14d652039716e2cd523dbf1f
- MD5 df5024f63e2d41fb34cb86e0fb0bea5c
- SHA1 6aa10ef1433f899bfe89a8f4ac0d6ee2c893afa0
- SHA512 d3ceda45bb33995cffa78a210d8c5c93a24941cdb064d2d1e578f7dd6e68a9c187e477f89ed86cbe717178a912f48ea9452fe46e38d366f5fac416c488f5f422
- SSDEEP 1536:0FQ5SVDXNVLIXUcZEpmrfJ7wl8FO6IOcIOZuo9OGubT:YkSZ9Jf8Ep27w/ISZuo9OvT
- TLSH T1E3937C9A6AB412A6CAF34174D4D30AADD331B01007A457EF8698A76A1F13ED41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target zstd.dll
- Size 645KB
- SHA256 8cf0a8722a419a58edc2dd25345cb0abd08fb2473c9aa537b0374b6de89f0e54
- MD5 5cb9c7639c07be306eecab2c9645a197
- SHA1 9fdf20b2405bf5638dfa2b29c305ffc09c9d480f
- SHA512 2bee29193ed70da24fbcf136d546337109cab2b8ce7134358fff2bfd79aef579ef01ac6e5a4a3b86f153ea1b1f0025970bf3f941fbd6523a36c0607befe3605e
- SSDEEP 12288:6fVVNiRJzd15CvjnWPL2KUbDsmMauRqoSIs0P:6fQvd15CyPLVOsRqoSI7
- TLSH T1E4E48D83F69541EDC07BD079C6664327EBB2380613046AEB83A4EF652F17EE55B38391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10