1060903c98925ee84c847256804f833c1c8c08a78057bd13c3315016c6c0e747 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

Tolhacaller.zip

windows10-2004-x64

1

Tolhacaller.zip

windows11-ltsc_2024-x64

1

TOLHACALLER.exe

windows10-2004-x64

5

TOLHACALLER.exe

windows11-ltsc_2024-x64

5

config.yml

windows10-2004-x64

3

config.yml

windows11-ltsc_2024-x64

3

libcurl.dll

windows10-2004-x64

1

libcurl.dll

windows11-ltsc_2024-x64

1

login_toke...und.js

windows10-2004-x64

3

login_toke...und.js

windows11-ltsc_2024-x64

3

login_toke...ent.js

windows10-2004-x64

3

login_toke...ent.js

windows11-ltsc_2024-x64

3

login_toke...t.json

windows10-2004-x64

3

login_toke...t.json

windows11-ltsc_2024-x64

3

login_toke...x.html

windows10-2004-x64

3

login_toke...x.html

windows11-ltsc_2024-x64

3

login_toke...ipt.js

windows10-2004-x64

3

login_toke...ipt.js

windows11-ltsc_2024-x64

3

login_toke...le.css

windows10-2004-x64

7

login_toke...le.css

windows11-ltsc_2024-x64

3

solver/ass...7xa.js

windows10-2004-x64

3

solver/ass...7xa.js

windows11-ltsc_2024-x64

3

solver/ass...of.css

windows10-2004-x64

7

solver/ass...of.css

windows11-ltsc_2024-x64

3

solver/ass...sof.js

windows10-2004-x64

3

solver/ass...sof.js

windows11-ltsc_2024-x64

3

solver/ass...743.js

windows10-2004-x64

3

solver/ass...743.js

windows11-ltsc_2024-x64

3

solver/ass...hy9.js

windows10-2004-x64

3

solver/ass...hy9.js

windows11-ltsc_2024-x64

3

solver/ass...zgw.js

windows10-2004-x64

3

solver/ass...zgw.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
Tolhacaller.zip
Size 19.0MB
Sample260907-smp6dahf57
SHA256 1060903c98925ee84c847256804f833c1c8c08a78057bd13c3315016c6c0e747
MD5 89a997f52b968ee0a6d2f820cf2b689d
SHA1 7c95279f97043da752c09e4605e6ca1d4ee80a34
SHA512 91d64beff277a5460ac93b7b24d4b06ead1a8da1e1633b1d812863b4ce02dffc5095a29d436d8d8ef7bf78cfebc8ca7818220ab91ad20dee35c198d3e5074a18
SSDEEP 393216:1z92Ko4f6meniALMoJHNumwZy2jS6DbviOrQ853iTvA54Eh6psW88s63p:1zwIIiALFuLyiS6Dbviwh5yTv9Eesg3p
TLSH
T12C1733FE8C7431EDF13AE2E514DA4FF401384AE44E161990B063F8D679C68F7562AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Tolhacaller.zip

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Tolhacaller.zip

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

TOLHACALLER.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

TOLHACALLER.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

config.yml

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

config.yml

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

libcurl.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

libcurl.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

login_token/background.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

login_token/background.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

login_token/content.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

login_token/content.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

login_token/manifest.json

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral14

Sample

login_token/manifest.json

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

login_token/popup/index.html

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral16

Sample

login_token/popup/index.html

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

Behavioral task

behavioral17

Sample

login_token/popup/script.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

login_token/popup/script.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

login_token/popup/style.css

Resource

win10v2004-20260513-en

windows10-2004-x64

6 signatures

150 seconds

execution ransomware

Behavioral task

behavioral20

Sample

login_token/popup/style.css

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral21

Sample

solver/assets/0fe7xa.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

solver/assets/0fe7xa.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

solver/assets/43vsof.css

Resource

win10v2004-20260513-en

windows10-2004-x64

6 signatures

150 seconds

execution ransomware

Behavioral task

behavioral24

Sample

solver/assets/43vsof.css

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral25

Sample

solver/assets/43vsof.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

solver/assets/43vsof.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

solver/assets/9jm743.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

solver/assets/9jm743.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

solver/assets/bklhy9.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

solver/assets/bklhy9.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

solver/assets/f58zgw.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral32

Sample

solver/assets/f58zgw.js

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  Tolhacaller.zip
- Size 19.0MB
- SHA256 1060903c98925ee84c847256804f833c1c8c08a78057bd13c3315016c6c0e747
- MD5 89a997f52b968ee0a6d2f820cf2b689d
- SHA1 7c95279f97043da752c09e4605e6ca1d4ee80a34
- SHA512 91d64beff277a5460ac93b7b24d4b06ead1a8da1e1633b1d812863b4ce02dffc5095a29d436d8d8ef7bf78cfebc8ca7818220ab91ad20dee35c198d3e5074a18
- SSDEEP 393216:1z92Ko4f6meniALMoJHNumwZy2jS6DbviOrQ853iTvA54Eh6psW88s63p:1zwIIiALFuLyiS6Dbviwh5yTv9Eesg3p
- TLSH
  T12C1733FE8C7431EDF13AE2E514DA4FF401384AE44E161990B063F8D679C68F7562AB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  TOLHACALLER.exe
- Size 29.6MB
- SHA256 d47065c7834811ac98a527729597fed00a30adc63098be4cf007f806c0b4c0fc
- MD5 8bef419a3c0c953f0e1c5814206169a1
- SHA1 154a327ddcf52659de2d581c317692cfad8c2505
- SHA512 27e948d327993f0092de682cd2f99cbbb82c4f1a1a28f60e5d747f6b0fabf8d4975948d182cb6ccc226e1629c68164c42065daaca1daa003ecf07a73331fbdd0
- SSDEEP 786432:yQ3E04o9W3VCQ3E04o9WsAdv/7RXmC+nf09Xh0DHbgu7jgAOZZ6pdDfTfWQI1jKA:yQ3E04o9W3VCQ3E04o9WsIv/7RXmC+no
- TLSH
  T14B67BF0263A99A10D07E43B981B6D23D43F2BC09EB51E7D763E06D532EDDB80573A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  config.yml
- Size 275B
- SHA256 91e137df4d777fe14231a275bbb8f2973654b93bca9646a564cce062572d368d
- MD5 51326a3868234a3d89d9149b46defc92
- SHA1 46544e5bfb62eaa3ffbd9d88099a980022970d0f
- SHA512 5d4ae767afe6cab986f0c8031199cedbee8749487f218d6d4cfd49e595fdd77160236e3f03dbee7781560126879bf8aea5c0af363394168b44b7d9aa1dc5f987
- TLSH
  T149D02B3576D6B93511700CD97893A2806E310C50DFDB259BAA550BE91C4CC226209A5D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  libcurl.dll
- Size 3.3MB
- SHA256 97f1e2988e2edd296d902a4bdc4f12d61b3b565ff2a320fff72d65075afb9d33
- MD5 338b7aea205149dbfe335c5eb6f1f33d
- SHA1 fc9a48605ec2945c3dee2df31ad2fc1f7a08d377
- SHA512 959921f971c392389f63606e6caf0816cea49414b812076413d36d3072a00b40c4aeea976fd5724fb43a7bd74c32af95656c0b6c37fc8f74b0c651370c147f52
- SSDEEP 98304:y9JKU5fw9W0tyGl/gnvt3y3E04o92WLYB+Z2n:yuU5fw9W0tyGl/gnvti3E04o92IYBx
- TLSH
  T194F58E13F39511A9C46AC174D71BA333BA72B48A1731BAEF179087252E62FD0A73DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  login_token/background.js
- Size 561B
- SHA256 3a0b66b463cd5369cf5321cae1f6a151140ced152fad33553cf031a1450d02a5
- MD5 a2f98767faf346ec378460b09edc15be
- SHA1 1ba285fd2769ea823f76f4a33cd42dc99f2c15aa
- SHA512 88f9fc3e746ea5823e6c6466fe0f189dce78d70978475ecf33190778b3f56342711e7e8d0dd8344354c92628bb2bcb34cf890b0f07851ff25dc47be918f7c8d2
- TLSH
  T1D2F0C08BFD16A04D33E73579E43F17082E2AD1714A7EA2D678008098DD3C151119EEFB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  login_token/content.js
- Size 330B
- SHA256 203148cdc510fe87de701bc090ddf32badf5f1e955a8a04023c0c12c6b4e8c56
- MD5 806fda9f2ebc860ad6767bd943b2f1b7
- SHA1 d47f9c78901a7c33b5fcd489a93c7637771e3e98
- SHA512 5251dc7374baba0228f2efd5bf2d4988664f1d34de56611130de5fbd04a339b9479298bc9454dcf97d8d23252ba7e77fc72e8c2be0132ed1b94827de2e45af53
- TLSH
  T1D9E0265B4003978601F225D9A6525320533211CCB26BF19172586048ACACE0F925ADDB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  login_token/manifest.json
- Size 663B
- SHA256 3c03244219145f5e98686310fa59261601987076513ce495af5b58de054ab50a
- MD5 e640a908ee1c8468610d6fdfc0e5655b
- SHA1 c81ee4ccc68038e9810d0b216dcc9a39f64cb450
- SHA512 b9a827728a4952c300b536a02b0a61344c4711dc7ec1c56d2b593c2a27b1b1bdb2303bfb9e147e59af07204a402fea1adb7e9e8f644bb7a9a5f78f7e0eb0c8c7
- TLSH
  T1900149BB8904982B03F887A46C635A03F310031F5242646F797CB06CCFB022B116BB0D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  login_token/popup/index.html
- Size 980B
- SHA256 e23f995d091d64cf8f38cdbbf0ca99ed9e53f8f17b73ed43cd59e4d8f1ac71ef
- MD5 526de09da0015af05724395853794cac
- SHA1 7284a50a6456b098fd5a3b0b86e0ab11af1151a2
- SHA512 49c09b89f79b451f90be329151bd9ce7f94f57a9c4313bfeab7960096d7e915cd4df946b12d079afd2881eeb3197918aeb565daa67a705f53b3609c18675e9bf
- TLSH
  T1B3116B364CD42C2710B697B118C4E156FF826103C74A682075DCA7DB1FF6E45CD93C45
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  login_token/popup/script.js
- Size 504B
- SHA256 d5285b4fc13833956296d97e85040c7d5a8a08779898aa9ceeb23f46e8b1a9bf
- MD5 18cf581d487f4ab13aaa535e644cd3de
- SHA1 a6b65f33953a616542552b0b7d63a554e1143f48
- SHA512 10e3f8ae0b9cf4d4eb094a0819299b2c9877d8bc2868b21a0d0516e24eaba3fb5237782231514660edae0963c2a054e1ebad91d63c9d837dd7bff0d1fc489544
- TLSH
  T1ECF0E97B00504875033F4A73965187CAFE45106F750510AA3A5C46C43F60CA6A152CE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  login_token/popup/style.css
- Size 1KB
- SHA256 8a00d4330e487ddb30f87e361e19e72cce816492adc6489805eb14cdf123388b
- MD5 0473b813d099fa90fe40d8d803eceb6e
- SHA1 bbe03141536b5f02cf4eff4fdf365e783b26e855
- SHA512 374afa11ba705802cd72d9d0ba56a92885c7353ba20a0ccdfef6d0aaf3b03b546205c32cbd51d4c4dbe2bdbe20969476b536758e5b57fc815d87764dfec2c6d0
- TLSH
  T198217B14CB4631467037CAB52FA29611EBA254834E03577D3FD1B9D0CFB1A689A60BDE
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  solver/assets/0fe7xa.js
- Size 14KB
- SHA256 57a1dad8f08a71fd5dbc7fd4d2e12e4f9a9b7e8800bc84a81a91d4512bdb2cbe
- MD5 4a8ff979840378ed59882fac57d83abf
- SHA1 574f977e6bd79488c1c21675637c8823a3057fb9
- SHA512 b17fa290d6d89314cbe9ef0fcc792dfd38ab2e23a82b729edd813156c47e7407bd441f35380ff6ee26a0fc84140b22041d1f8662df26aa1ee9a5df6701e95d54
- SSDEEP 192:hGEXYnMJ6zFjfRgAn8EAjZ/lvcXOBpxrotGA2J4k2A2VNcmdEiCKmh1664c+gYrf:vXwM2j6A3eZPpbTJP2THr9c+gYlR
- TLSH
  T1E26219B87520F0109BEB2176B17F2D2F73751E1EDD4880A02356DDE92AB816D6287F6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  solver/assets/43vsof.css
- Size 37KB
- SHA256 a88223b023410974e0b80bc20eb2f78e236b13805ddb002f0df001495216cd53
- MD5 eedb30a2e09c01d7e820a5262fd48123
- SHA1 1385e6b8a08a1581cbf2a22794a3ed2b89a8788d
- SHA512 113658ebd94bf0673b2759b0febb13c542da26468df9b137a6eb88caafb3e7662feacf05a839535cff244cad2bce78a1a2b04d8a2d47909ea683b4ae1aa18fd4
- SSDEEP 768:zLSy/lZo77LetCq0TKEQGVF/TovMDGrKxbi:zhZo7XetCq0TKEQGVJSKxbi
- TLSH
  T14303B764A266F83CBF2F4A7796FCB2ACA1087140C91749FEE543A511A1C73F149F9B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  solver/assets/43vsof.js
- Size 82KB
- SHA256 1f36796c1a78d33697c97bd90a146f58d975f2de408a35c92436d5f78cf894eb
- MD5 0562ac8b5c4088f3eb5bda2a3462857a
- SHA1 7bc39c713f0f21ba22bbb622a1e824e1a631641c
- SHA512 2852c6808a02f2ab2925d2b0b95db7108ad227c8511a354d228399e381a10b7ceb7bb6803ebbb699bbdae8eb4013e902fce49493c60e45b7c447578101360868
- SSDEEP 1536:hDHUOi7Ai1eJhiupT9gimy0hWUjspkC1+JB:KOKAJJhiupTyyssPOB
- TLSH
  T1D0832AACB724F2ECDB8F5229E2770045B73C4ABDB006C060959E9E663517478F2A7F64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  solver/assets/9jm743.js
- Size 128KB
- SHA256 aa94841b252336362bece8cf909be9bfa05f9ffe46de8958f571c23a821760b4
- MD5 337830b7dac177303272ea52805c4a07
- SHA1 96019ed488ebc971d9c640882190878e1952c451
- SHA512 287394dc3ec5d6f363df592c73ac3f78acae2c5ee3caf1692c9ca27da19c60ca3248a1c267c252d5bb6773a85554671ce913b377917cb693a1ab016d545f6b0e
- SSDEEP 3072:Pdc2IYNwIcoYquT6OszQg94LsM3MvrbHd+wrWJBYfetwjpc37OcBwhPihON1uklw:PddKIcLquT6OszQhLsMaJrWJBYfetwja
- TLSH
  T17AD33AB6727BB17383DB132744AB0106F6384865580F0408B3E8595B2F7B869A6FEF75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  solver/assets/bklhy9.js
- Size 122KB
- SHA256 60590b305ade1dd88bf9d9c60ec954dcffb5868cae675c502e06808c03d71e27
- MD5 9a1a9a93be67d9a81ee2374b6346fee8
- SHA1 0f736f02c8f660525766e350997b55d2c8fec008
- SHA512 64beb2af5e8fa98cc4290e6c3a2739ba6bb2840fe047677720d31aa0816dbf0bdb20a5a0b56043886303d7214a62f962c9ced42bc97a7d5f6308d9cfd36c022d
- SSDEEP 3072:2mpD5b/ZuwKze/T7WHvZRq5T6PsNfB9wqpxLWRUHIz:28Oze/TKHvvq5T6PsNfIqpxLWjz
- TLSH
  T11BC33CE67376B073839B137740AB010AB2791964180F0448F6EC5A5B2F7B819A5FEFB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  solver/assets/f58zgw.js
- Size 3KB
- SHA256 81eced794c5da6da667f49804ac0d161199dbf58a94e85b266c6c22706f5be23
- MD5 cbd4d395ea908f739ef1313ced69985a
- SHA1 0065ef93122d5945578ff7fc7d4550a5e9a6e55d
- SHA512 17e373d26b79b97eeac6c754bb8dae1e7595f3cbf22f22fdb8b82771fbd1d4fd1bc6e1be349b3ae29fce4ee29a4a04dc7dac54426ea706509a8b980d81243a02
- TLSH
  T11071A525A7931835DBEE3F67B3FAD281B27833540811C93AF91CE516531061089E6FAC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

executionransomware

behavioral20

executionransomware

behavioral21

behavioral22

behavioral23

executionransomware

behavioral24

executionransomware

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy