2326830502c96a3e195eb0f1a599fea1a5f6d4f62b6c0d8b8854551fc5fd3422 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

XIDRF_leak...GL.dll

windows10-2004-x64

1

XIDRF_leak...GL.dll

windows11-ltsc_2024-x64

1

XIDRF_leak...UI.dll

windows10-2004-x64

1

XIDRF_leak...UI.dll

windows11-ltsc_2024-x64

1

XIDRF_leak...ld.dll

windows10-2004-x64

1

XIDRF_leak...ld.dll

windows11-ltsc_2024-x64

1

XIDRF_leak...rt.dll

windows10-2004-x64

1

XIDRF_leak...rt.dll

windows11-ltsc_2024-x64

1

XIDRF_leak...in.dll

windows10-2004-x64

1

XIDRF_leak...in.dll

windows11-ltsc_2024-x64

1

XIDRF_leak...RF.exe

windows10-2004-x64

7

XIDRF_leak...RF.exe

windows11-ltsc_2024-x64

7

XIDRF_leak...ph.dll

windows10-2004-x64

1

XIDRF_leak...ph.dll

windows11-ltsc_2024-x64

1

XIDRF_leak...CL.dll

windows10-2004-x64

3

XIDRF_leak...CL.dll

windows11-ltsc_2024-x64

3

XIDRF_leak...rn.dll

windows10-2004-x64

3

XIDRF_leak...rn.dll

windows11-ltsc_2024-x64

3

XIDRF_leak...20.dll

windows10-2004-x64

3

XIDRF_leak...20.dll

windows11-ltsc_2024-x64

3

XIDRF_leak...20.dll

windows10-2004-x64

3

XIDRF_leak...20.dll

windows11-ltsc_2024-x64

3

XIDRF_leak...10.dll

windows10-2004-x64

3

XIDRF_leak...10.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
XIDRF_leak_patch2024.zip
Size 72.8MB
Sample260905-pg6z6a1vc1
SHA256 2326830502c96a3e195eb0f1a599fea1a5f6d4f62b6c0d8b8854551fc5fd3422
MD5 ed9d7f87fb0259b754887d8465d3a7be
SHA1 aeb5ccb81d5ea6973a7087424b8232e7ff876e0e
SHA512 a06247766a125ee2b4446c23dd8463b5ba37422e3f51f56c1e14e0e1122ca88eb9e4a1ada736f6833466c3b2c13691cec3fe169c0da9c6e00ac105fc29f06d0c
SSDEEP 1572864:tkc+mTXt808IwC62ITYB8NS7VFvjbJmyWX2tZzbXF6E9scKc8Jl:tT+mbtvJwD2ITgOoVFvjbpWSvscKcwl
TLSH
T14FF7339C7F58F647EABF39F980949309FDA3450D4E3E0C6322D54E38AD992AD661C780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

XIDRF_leak_patch2024/Emgu.CV.UI.GL.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

XIDRF_leak_patch2024/Emgu.CV.UI.GL.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

XIDRF_leak_patch2024/Emgu.CV.UI.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

XIDRF_leak_patch2024/Emgu.CV.UI.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

XIDRF_leak_patch2024/Emgu.CV.World.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

XIDRF_leak_patch2024/Emgu.CV.World.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

XIDRF_leak_patch2024/XEReport.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

XIDRF_leak_patch2024/XEReport.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

XIDRF_leak_patch2024/XIplugin.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

XIDRF_leak_patch2024/XIplugin.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

XIDRF_leak_patch2024/XiDRF.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

6 signatures

150 seconds

discovery persistence privilege_escalation

Behavioral task

behavioral12

Sample

XIDRF_leak_patch2024/XiDRF.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

discovery persistence privilege_escalation

Behavioral task

behavioral13

Sample

XIDRF_leak_patch2024/ZedGraph.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

XIDRF_leak_patch2024/ZedGraph.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

XIDRF_leak_patch2024/x86/OpenCL.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

XIDRF_leak_patch2024/x86/OpenCL.dll

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

XIDRF_leak_patch2024/x86/cvextern.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

XIDRF_leak_patch2024/x86/cvextern.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

XIDRF_leak_patch2024/x86/msvcp120.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

XIDRF_leak_patch2024/x86/msvcp120.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

XIDRF_leak_patch2024/x86/msvcr120.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

XIDRF_leak_patch2024/x86/msvcr120.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

XIDRF_leak_patch2024/x86/opencv_ffmpeg310.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

XIDRF_leak_patch2024/x86/opencv_ffmpeg310.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  XIDRF_leak_patch2024/Emgu.CV.UI.GL.dll
- Size 26KB
- SHA256 10aa8dc1474aab6c3f143282706c562ffced9c85344fe43ab73029a4dcdc250c
- MD5 4abc6bd9d1113fef7b90fa097f9e1f39
- SHA1 08fe59104028709ee023f330755b5a6218e860ca
- SHA512 8413c96c23a4f6ddc6d94e6be5e9d5626e694357d3baf87df49e2729a5b8a9dcb0ff600970d6cbee7f8f39af209c3759014bb2f48fb7d0de596888512cf20be5
- SSDEEP 768:HRm4w3tkjDK9W4xrk8HgWdyoooKz6PKo6:DwqPKi8HgWdyN
- TLSH
  T1D6C2E68177B99623FDBE5B7E99B31A485333F2826472C79E058C256E1BE37900D02787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  XIDRF_leak_patch2024/Emgu.CV.UI.dll
- Size 115KB
- SHA256 9eaea802884c155216e5ffdb488ab112d6f7bb2809e1d6d026ae7f568490c596
- MD5 19c332b85e7859bbc20f82d00e28a9ba
- SHA1 a1c421d7c171a91316c5fe1b6fa6d7491d858062
- SHA512 364bcfc15676880041b916989ff4cd297ad9171cf1d7d84ca086a85bebf10d6c0d3cd1ffd39e4eecec0300299f5d1fb529a094a5d11506aa6f50f731b8cd1bb0
- SSDEEP 1536:Rpw3VXh24craszA0VmRI6FlhgT01q/9C43TPM:fw3VX/crtyI6FrgT0o/oqI
- TLSH
  T108B3B82037BA821AD8BE57B01C35A2C11376BA6A7B04CB5D6C55134C9DB37538B12FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  XIDRF_leak_patch2024/Emgu.CV.World.dll
- Size 496KB
- SHA256 f5cc2b4ec3969378c33798216eb129dd56cd0641fc2174f2a09ce13de1298c5b
- MD5 5bc992e857693e0d9a0af7bbf04ec5ce
- SHA1 5278983598cef0c0e3ca13906aeb79031c210f88
- SHA512 cc00e8667b02b71196c64da90d6bcffbc6a4c5e2e067d782ee4434f7d8e6afc5d80c820a9128234e67e2f2eec153a77fc5d93c05146248b3d0f6c2a619501669
- SSDEEP 12288:cgEhrXTQSVMmgSHwstutjbMz/j7nmIWHYlqm/LRJ8J:BMDQS6kQsturH88J
- TLSH
  T192B43948BBD47A2FC58D077FD4760A1C23F0C929E743960619F9D2A23C92BD6CE165E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  XIDRF_leak_patch2024/XEReport.dll
- Size 19KB
- SHA256 b4e54e09f6b993ee32fb29ae29a6d6bfd784ce2f8bf8df3de1ea421dd668f54d
- MD5 b6bc755247bb556567dcf9cc218571ce
- SHA1 4d8d976a2d295a17f085c70e37b50a9fe028a482
- SHA512 5ba23f77a2a81f600aef60d1d82ee4b77edc797159a67a3a83e5251dbc5ff8ea0652475a28b448628bdbd6113ebc9669e3537880a03ae729f20196e81b3b6ad9
- SSDEEP 384:l4IYqGHzz9VBz0CC3xgFj00LoemYk7KgLC2Nhx/z2HINZIogLngnokw8wA/aSN91:aBqGHzztoaS8inLFaIdgLW91
- TLSH
  T14A925D363F94D333EF7A86724C33015156F2EB81E825EB1EAC89924D45E37444722BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XIDRF_leak_patch2024/XIplugin.dll
- Size 8KB
- SHA256 d5b615db2e67f34b0ba05d6be6fea9f811765fe349776ccbe2a2f775d08a6f75
- MD5 ad02dea64e44218d17bca62b6b97a030
- SHA1 5b11129dc1e9a183d7cc74984c6e6d95d168c60b
- SHA512 435ac3ee786f1398f86b31de38f279618b7c09f4cf213087daef0fc331f0ec345a9301d65a2013fa865adb82ab6291a590a5fe6333d1172752598e7da4d5be7b
- SSDEEP 192:gDiEe/A1HGOxw1W0NgIW1Pnasbuv+nNPXLm3MD:gDiEd1mJ9N6nafvGPXa
- TLSH
  T17EF1E6225B90C7F9CE6B0FB7AC53135006B9E7049957EE6E548CA0274DA338407E3A75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XIDRF_leak_patch2024/XiDRF.exe
- Size 69.7MB
- SHA256 6cd0b0533b6b3f9f2d853833c7f15d97e316e6e6d0155b4925351e0de06e6a71
- MD5 cbf3bac102a9d7693640e1aa80f4ba99
- SHA1 4137b03c6cbd04ed5dba5be6299fb04ceab7f266
- SHA512 1b3e33e599ddc0e1bf5c2e09ae6a79ebbb3c25697a9ca10645354e78fefee67a30ac8674b9bc4aca1869849c2e138464901268a25bec4100c0258a1ebbb429d3
- SSDEEP 1572864:PPCSP3Km4JNlFWSxXTyEYPePBwO+hccaR2XL5QZvq:rP3Km4XlFWSVyEY22O+GUL5Qlq
- TLSH
  T125F70141A2A8C095D6A98438C94717FBD6793C09E714DADF759CBD8D3F33AC85A3A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
behavioral11 behavioral12
- Target
  XIDRF_leak_patch2024/ZedGraph.dll
- Size 300KB
- SHA256 4639cecb32106e8ea4da47fcfcba62a92b2bbcb78c6423c56a8982aee7ec964b
- MD5 8a3abda1bec99595c943b69aa04210a5
- SHA1 04cc10fcc99280ace63e982399227f57e3f660df
- SHA512 f82cdf56cf1e6ac898135210266226c7265a860cedae6d4a8f27b4ed1421b437c4e4ea127d2a73116613c64039b97a79e3da403c57ef9bd6b323047cd0df85d1
- SSDEEP 6144:4fj6bF0fp20Hpnzbrj3hQ4hXKtoQcVhgGDJarLv:4fji0RnLQKjVhgGDO
- TLSH
  T1C2645B2AA75C9A6AED9F03B8E006551DB7F4C516766FD7AC8DE0F0E82D13750C9022A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XIDRF_leak_patch2024/x86/OpenCL.dll
- Size 24KB
- SHA256 784a370e89706b08ae5efd90caef7d7385f43abbac5826b9ca35fc556a605bbf
- MD5 700267bf4dddfa621006293f66dad8b5
- SHA1 e3b1ec7dd97e22817ca77c4b7ea2e30af550117e
- SHA512 57f16fc1834acbd4ff318a0d15237e752f11e74b7e830fc65e079b6999eb6a1ef4d69b1ec4c4dd8b7ea80b384f5299d6491be350f82787891d5bca8d4dc9492a
- SSDEEP 384:8oS8qWiPguWB92+miWmvNWtcFVzNiBYdf9cpYgH4TlgDXk85RRcn9FGIS1SlhR9s:HWtD56xz0ZFRndLbcUKPCwDL1rUTQQ
- TLSH
  T122B21E084E488771E7B35632DAF6BE13D99C98A31B1ACBE3B146D0154AC85D718BC377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  XIDRF_leak_patch2024/x86/cvextern.dll
- Size 11.0MB
- SHA256 4bc88c4fe2e8d7d523d88e11d5b9a0ca333c658e258c577cba60d119168055a1
- MD5 8cffd7733b32a63ef699b1c6ae1ab3c3
- SHA1 039d28d6fe03829f2bb58204cdf3e101f0dc8ca7
- SHA512 328e1b9159853dd547a8d845e8db63ef8e74c0932b8d72aae0d7b283bdd7a313895fc27ce14fbc55ce50c48d224a6a8af01f1260c3cecbb3a3b30888275df76b
- SSDEEP 196608:f4IstfXM/tDceaDjUKnMt5C4AG0U7jQoxjBBBSwPlAXVYNniAUo:fhKeUVnMTBS1YNniAUo
- TLSH
  T1E8C67C61F660C525E8A800F17A3DE69F412D3A3513B880D3B3C95E9A65B86D327B3F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  XIDRF_leak_patch2024/x86/msvcp120.dll
- Size 444KB
- SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
- MD5 fd5cabbe52272bd76007b68186ebaf00
- SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
- SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
- SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
- TLSH
  T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  XIDRF_leak_patch2024/x86/msvcr120.dll
- Size 948KB
- SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
- MD5 034ccadc1c073e4216e9466b720f9849
- SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
- SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
- SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
- TLSH
  T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  XIDRF_leak_patch2024/x86/opencv_ffmpeg310.dll
- Size 11.9MB
- SHA256 c11139cdac81b6299f1756c04e7b9e9047f1e2ce37d18d8fc04421bcb0e9b297
- MD5 89c783eee1c47bfc733f08334ec2e31c
- SHA1 48f3ae37e58c6be4b7cbd775e77706636eb8a3e9
- SHA512 4b3441e9c18af534b09c4b13ca6fe4961f5a5cb873751d8bf343f2e6d10c5f054bd77964d4d77389972717ab72772670ce88f76cad5bbf600bfc83c899edbc6d
- SSDEEP 196608:ltVj67SO81OIHexLvh52x0c6i3VeEkchbbyg1mW1mcjHvI7uiERpP/nY+yF:x+Lh5Fc6yuAreHERpnY+
- TLSH
  T1E2C68C85EAD741F6E90B0D30916BF73F9B345B05C430CDA6EE942F86FA63B62541A309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

discoverypersistenceprivilege_escalation

behavioral12

discoverypersistenceprivilege_escalation

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

© 2018-2026

Terms | Privacy