896bfc9a73b587c531367d9416b4f49736d6ed47f174976782c534eb1838c2f6

Resubmissions

08/09/2026, 16:39

260908-t53d4avcja

08/09/2026, 16:19

260908-tsykdathrf8

Sharing

Copy URL Twitter E-mail

General

Target
UnixStealerV2.7z
Size 604KB
Sample260908-tsykdathrf
SHA256 896bfc9a73b587c531367d9416b4f49736d6ed47f174976782c534eb1838c2f6
MD5 40ef1735541baa34b1b1501f8b7c1ed7
SHA1 63844bc00c5431384954f8ff5911d3a2bee1356a
SHA512 8cc9eeff13cdfde66eb9222c11cc61b9611536e20a87bf7973729ebea8334d6cb1c6431cf94f6b86afda1f49f18e2169a0250097b035cf84e21a4f56035cf645
SSDEEP 12288:HSfVKMohzuYLB4GbjcDT1Cm6c92pV5pi4wx8e4Ts3U41mK63F5vO5eX283z:HDzzVLCGb5I9Obpi4u8eKskMk/vo8z
TLSH
T150D4239C86A206FB3F0FA32B9408A754189F845341659E78E0197FDD7DC2F849EDCE86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  UnixStealerV2/Builder.dll
- Size 31KB
- SHA256 3ba937c60ebb6a47149f3f17ed26f8d7926f51c4fd665be7af5c1b6bcfbf44a3
- MD5 cefc8e17a678f07e1fec33c1c92afe36
- SHA1 aefde8a313348e876a47da0881c24e09306a3e9f
- SHA512 8009ac41ce7e4c6ca7e7e3ff5515c9ff9cbcb0a973fa44a2d49ccfc8c51a7c42f77550ebeb0d3edd23cf859c43e04f139cc078d282591eaafe62b7463cfb2141
- SSDEEP 768:PuCA0HcjIq+7pwDIcq+GVWOuPBNjR9dlJ8U:PfA0HcjIq+7pqqRVB0TR9TqU
- TLSH
  T121E2180177F84A27E27E87B42BF1924907F3F5661162CBDD2DDA70DA40E2B604621F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  UnixStealerV2/Builder.exe
- Size 147KB
- SHA256 8158bbcd71f29aed2855c6ee6f3e48239e4e2c78739bfd10d441a6d18f11fd40
- MD5 f2dfb8bdf2c71e609fe3b08e947fe439
- SHA1 18bb013f1cd3ea22f3366bc94f4a3704b4a06447
- SHA512 4bbc32a95f31b3cec7b0b6b8aeaa88965159ea98cd448ac45c1bd70a6383ed5ae13443889dce537a15c8b768da1af712cdfdbccb3f6835539d0f52a374517ca8
- SSDEEP 3072:t5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCgoC:tBKjK2LFzZNfIULl
- TLSH
  T1CBE3280772AD11E8D1BBE23D89A24902F7B63826473597DF1350427A0F777E0AEB9721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware collection defense_evasion discovery persistence privilege_escalation ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  UnixStealerV2/Mono.Cecil.Mdb.dll
- Size 38KB
- SHA256 61637f9940e5e336571cbf945be0f36d6d6050e06288df0f0232d93b26f0bde7
- MD5 0c4ec4eb146bfe047755669c8060a967
- SHA1 f663cc3bc174a98a49893e0cf334b479b05e453d
- SHA512 478dba76de5b20906a31f2ff72a559779a262abe0265d475aa60d555d4f94f79887f237f393f256134be758d565aa46b30a39e81b23e1f3048fc80ab779405af
- SSDEEP 768:WrF3HuZyOt78PeWSTlNeyJOgfGNOV/DVxPVxaCCrHpTFuYL4oWp:WrFecOt78PeWCLOgfGkVzmpTDL4oWp
- TLSH
  T1FA0307087BAD962BC2AE56FEE4A126191BF1D53C6603FBAB4DC4B0F3BC437444112267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  UnixStealerV2/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 a5249a04ad8fd7dfd47e4d0a620aed0f7eb6051e1ddec102c541ca3e12f6e2a8
- MD5 743102d277a8754dc74f7644e03a8956
- SHA1 31971747d45f995bc8d05c26c728df293a074db6
- SHA512 00bb76043a3a147b570e0421f768a2f2238954922c45c611d10d8fd4a1f8ba56da8a7b7377facfe54ff6dbee2d81be87c0d6e3de9e884625697ae478a82677e9
- SSDEEP 1536:QOTXdiVgzDKG2fNRck9FRcXRHr5vMALYKXNgJGsZ9ajr1vjCXev:TT0W2fjvm9uArWJGca31veXev
- TLSH
  T111937E29ABECA666E4DC72B724A709084BF0E165D143D71D9AC47EFC2C5BB121923393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  UnixStealerV2/Mono.Cecil.Rocks.dll
- Size 24KB
- SHA256 273292babd45f9f34de5054bd9cdfe1d859a7dbf6f4ad5974fe4ead70698ed5b
- MD5 fe8c2b2eef6e5e7284dc9b522a7be468
- SHA1 8779911266ea9bfea924aad33a7e1c7855f41857
- SHA512 b78f759568fa5ce77f87db6f02688493877ced8c9b289934c6adc95db5581d3ebc858092c650a47d5d7eb44c2dd2ed01a8491930acd8173d45f777285d0990ab
- SSDEEP 384:aWLOZBsQXmnFlPQnqc9H559krjuVXcVXD9PmROMLUBLMWG1UX8JvbrjEZ1O/pl+1:5aQHP+qcbkrjuROoUBBLXA/AS
- TLSH
  T177B239103B99CF3BD2FF867958D2532802B1C96A5603EB064DCC90EA9A5BF945341BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  UnixStealerV2/Mono.Cecil.dll
- Size 348KB
- SHA256 769a59793d4b8885bbbfbc5aee8f57a0d4e34d275c56c60c03994309b87f67e9
- MD5 7c40214d60b54749a1a7f79ea6f62bac
- SHA1 a240d705b52fb1a78cceedab268db42cbeb47512
- SHA512 66a489988d15f1c651061656703b6fb03c4c6ebe82bcb0d48246c760e3764e4a7f2ad8d1653c90401fba6aa9974586d36256ad3a47e1112c1f38488a8818ab92
- SSDEEP 6144:NimznQ2nMpRAX2diEIn5o4gcuomZSFrIb:XnB2EELcu0Fr
- TLSH
  T1C6747D3527EC873BE69E537FE46A081A82F5D816738BEB8D18C8E9F51C43B5359011A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  UnixStealerV2/Spectre.Console.dll
- Size 794KB
- SHA256 842fd97e58fbbac48ccdda0e575b14a1b8af75c42ef87911fddfeda5b7bdbbc5
- MD5 2a47203be983f3dac02c9df64550a25d
- SHA1 d728230fe3cbb43b5cab7ddb6e018ec22955e766
- SHA512 89e969397a32e743b34037998435b16cfa35475ea1898ba495a3e9cfa33022fd6482678d497a962362fd0203d454893b53fa0cdebce44a0c6ccea538b3c02c35
- SSDEEP 12288:KbiZiRA2wChnq791r++f7lWv+YnPXNKCiQGCniCUzSN:XZklnm911CPdKCiQ9nN
- TLSH
  T18E057C2633E487A7F1ED8A34D8B9261055F1A99A5211DE4FADC858CA1FF3741FC01BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  UnixStealerV2/Stub/stub.exe
- Size 258KB
- SHA256 59b20774e811849ca7a4f333045604e1517b72a0b47373a7328422c84012c03e
- MD5 48abcd1cfeef155b40f7f0930ac9f779
- SHA1 9939b8f80b4ceea31b4466930fcbcd7c4a1683e0
- SHA512 8ef27cf51a1a89d4529286e14cfcb6e1e1a4b4521af6545baba032cba395bbe4d3d51fb54a8565f9ca93f844ac15e5e9edadc6a9cb3120e665362e94f0079bf7
- SSDEEP 3072:3XQrUaL0q+r9Eq9nhxdfRIUBAfqwcU9JX6/u3Quo5tUCw1kNXztO/QJkhapKJIdn:CknlfptwlF+wOzxJ4a5uRvLrKYzIFPv
- TLSH
  T17C443A6833F94A15F3BF8B71A8B094914676F82AAD1AE74C1D8524DC2F32750EE11B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery spyware stealer adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral15 behavioral16