Overview
overview
7Static
static
3SmartUpgrade_3342.exe
windows10-2004-x64
7SmartUpgrade_3342.exe
windows11-ltsc_2024-x64
7$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
37za.exe
windows10-2004-x64
37za.exe
windows11-ltsc_2024-x64
3ArCave.exe
windows10-2004-x64
3ArCave.exe
windows11-ltsc_2024-x64
3ArCave.exe.xml
windows10-2004-x64
3ArCave.exe.xml
windows11-ltsc_2024-x64
1ArCave.ico
windows10-2004-x64
3ArCave.ico
windows11-ltsc_2024-x64
3FileArchiver.Core.dll
windows10-2004-x64
3FileArchiver.Core.dll
windows11-ltsc_2024-x64
3License.md
windows10-2004-x64
3License.md
windows11-ltsc_2024-x64
3Plugins/7za.exe
windows10-2004-x64
3Plugins/7za.exe
windows11-ltsc_2024-x64
3Plugins/Fi...ip.dll
windows10-2004-x64
1Plugins/Fi...ip.dll
windows11-ltsc_2024-x64
1Plugins/Fi...ip.dll
windows10-2004-x64
1Plugins/Fi...ip.dll
windows11-ltsc_2024-x64
1General
- Target SmartUpgrade_3342.exe
- Size 112.9MB
- Sample260908-wnrmdawsdv
- SHA256 5f3939ab860a1d2b1a08e168ee45925423bf722e46e292c2b710ca9f4cedf27a
- MD5 01b0c7fb95f3bd473afc02c295b6accc
- SHA1 64e9c4abc663d8f8780185144e03e9c7bc4c847f
- SHA512 760d19bab93a883e14c261bf4fb79cef1aedacadcf79e269fc61bf02c8509c9964a7c1c9fdcce6c20d8c6288c13d9eb83966655be8d4cffeba6850615d0e9d74
- SSDEEP 12288:8+IB8jlox3QkrmvKgyszOMIgk82J+DTbqm/maxlqe0SuAKqBiy7M/ry0rrpRfWgh:8+IB+loptmC+OM9J/mary7Ui4M+0rrv
- TLSH T1FC48535021FECCDDC12B0B719A71A79945FB0368F0E05AA718DE117C16E0FE937A64AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
SmartUpgrade_3342.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
SmartUpgrade_3342.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
7za.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
7za.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
ArCave.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
ArCave.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
ArCave.exe.xml
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
ArCave.exe.xml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
ArCave.ico
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
ArCave.ico
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
FileArchiver.Core.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
FileArchiver.Core.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral25
Sample
License.md
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
License.md
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
Plugins/7za.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Plugins/7za.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral29
Sample
Plugins/FileArchiver.Archive.GZip.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
Plugins/FileArchiver.Archive.GZip.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
Plugins/FileArchiver.Archive.SevenZip.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
Plugins/FileArchiver.Archive.SevenZip.dll
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target SmartUpgrade_3342.exe
- Size 112.9MB
- SHA256 5f3939ab860a1d2b1a08e168ee45925423bf722e46e292c2b710ca9f4cedf27a
- MD5 01b0c7fb95f3bd473afc02c295b6accc
- SHA1 64e9c4abc663d8f8780185144e03e9c7bc4c847f
- SHA512 760d19bab93a883e14c261bf4fb79cef1aedacadcf79e269fc61bf02c8509c9964a7c1c9fdcce6c20d8c6288c13d9eb83966655be8d4cffeba6850615d0e9d74
- SSDEEP 12288:8+IB8jlox3QkrmvKgyszOMIgk82J+DTbqm/maxlqe0SuAKqBiy7M/ry0rrpRfWgh:8+IB+loptmC+OM9J/mary7Ui4M+0rrv
- TLSH T1FC48535021FECCDDC12B0B719A71A79945FB0368F0E05AA718DE117C16E0FE937A64AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/INetC.dll
- Size 43KB
- SHA256 f19674b7eb8fb49a9f117816e7db85173c017582c7a9d20ad816929b4c4eff41
- MD5 5afa8a910a993ccb1cfbd2612fde1ee2
- SHA1 9227d0c54f6696281cfb341ef84c4890cafc63b8
- SHA512 28bb8d74862c6688115d11ab09480f1f4b1b9350fddc34b02f1bc7094498fc73573977505da3317adc5b00c9c83aa41f8c6c46a3b3d2cb9a2dd56c9bbd181cc3
- SSDEEP 768:s4RgW72i213M0s9Ac0VMHoaO9gG1zQBWAC1Ax:s4KW72iw3MJ0eo371cBkAx
- TLSH T1EE135B8197E952E2FBB9463074B76E62553EBC245815A08FC337268CACB2351FD2C367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/modern-header.bmp
- Size 33KB
- SHA256 e88ef276f4a4fc8527fbbed7e38638f4f6697b9101ce3b5d813d2c2d113aa244
- MD5 71653b820b3eab9de4c977e33674a0ec
- SHA1 ae4a7a25cdf4e20452ac345b8e3a496f05cb582d
- SHA512 372b1a3d920b2397fd78f66a46d6cf8cc2a1ecce7f4528acd5bcbda7cb2197abd0f4c91031c5cd26b0f21435ecb3b4dd5a4d1b00ed857906f37c181712bbae33
- SSDEEP 768:IvvvvvvvvvHLG8xCmvnYWU/GQnmSxXyACc99NOQvvvvvvvvvb88888q:Pmo88888q
- TLSH T16FF219309995E607FBE62E5748D6B35C82AE9EC45047A04403E14FCC7E6BFCC6E662C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 201KB
- SHA256 07de16d44feba3da2d6313194913d7439eee72a837e28115cd6efef233f2573b
- MD5 955073993319ed1a6450a8953189bb21
- SHA1 ececf5647bafaa554eb4dbcce1641381a650480e
- SHA512 090d4d16432b61545d387c440ffd0539ab864d91976f553f970983c1e607f42eac6ab662d99b5dbd478de18f44ad31462c2cf380b27af06528e7d52d2c77ea38
- SSDEEP 1536:pk3bur9EMTUyXELEkEbE7EEEYE2EXE0EmEBEtESEOE9EqEcE3EyEFEGEtFJ:pk3bm
- TLSH T19F14A4705956D603BBF61E930CC6B39C476E5EC4504A909402E58FCC7EABEDCAFA12C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsProcess.dll
- Size 141KB
- SHA256 73047d88e6fc5f58643e6827f43fb8f09ade98ec9d8ec9a8ea4b55375cf370e6
- MD5 cf880e1e0dc2bdd77e31ae3c9590ed62
- SHA1 de971adb675c1d54ac557d639b8f8a385e0c29c9
- SHA512 ed393b03c68df685253f8696e4fb2704576aff73f45832ef8e2552bbcfe2bc446fb30fd2566887c23a09aa2499628ac3713492324d88d0bce481220e3bb1e92e
- SSDEEP 3072:FPn7qn8B6MH506oR2wdA2N0Igi3vclr2nwNNAkD2tY:xcMeu2Hd/bajQY
- TLSH T1B4E38E01B4C28071D9BE193818648F769B7FB811DFA89DEF675405BE4F746C0EE38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target 7za.exe
- Size 592KB
- SHA256 a2caa9ae4f080fe16e061d70c145bbef4aaee6946bd840a6d344b1eebc3ac293
- MD5 ccb2802eb20b49ec868f38bc6591edd3
- SHA1 c7322389f45fa204d0b98f64476f1473dfb8577f
- SHA512 29694d9a4d342f7c2f06007eefa71c23bd0d120329876b58dd92a5dccd6389a05fe2dc43ce74e40781d51663a1f7f8b353edf3b54bbe4e27e49d90f7261716b4
- SSDEEP 12288:+4x2QX9pJg1XDdaKTEcILJajcPVL+3wtD42j6GNEcQbECNdN08VrGr8GrBQmKz/N:+rwFpcEJnVLMd7MKtu8mHwT
- TLSH T1BAD4BF02BBC2C1BCC63224304E396716E1BAFB6447268AC763D41F5E5E351E17E3A6B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target ArCave.exe
- Size 839KB
- SHA256 89675ffa63fda41a40e39e575ee8b072616776476116a2edc13448d7678eb959
- MD5 e913b2fa2191f0d369dc8628c243b020
- SHA1 d6c6844c59c506d4fabd6428f3e06e7f477117c0
- SHA512 8f3eae5e832df6c38f7f5a2bb6a9d6560a00114dd0f75d0835175d575e8b23da2bd1325f4e1b1bd6999cdefb96d6e9ce5c48c4930b7398527cb6761a61a66f1b
- SSDEEP 6144:10fYkoYP2NekCqOALfitLoDP+wvuv3rLTDrJtpgzphdoDP+wvuv3rLTDrJtpgzpc:10fYk5eZ9ndeZ9nxf4
- TLSH T10D052993368A2290D8A9CD36071D1F9233717E336B5CCB5D2254776E99B2213CB23ED6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target ArCave.exe.config
- Size 968B
- SHA256 63852fa83b1c16c6a411c59c4d78c44a744e4831579fadf91ac2cafa47d75c7c
- MD5 45559af21fb1d4fa7e91b36cfc27de67
- SHA1 2e8495d3b7f1d1005cb19346940ce523a2095642
- SHA512 4dee246040bcf6e1061e38e745c37549548da5ec737718224cd049747265fa314ff816c60c8386380489686b675d3fb209c71b824709ad23ffcf6c47f2cb5603
- TLSH T1C611591421C07E5B09235E33C9218604DFB043D3552A24ACB13E66AB9F3148B07833AA
- MD5 SHA1 SHA512 TLSH
-
- Target ArCave.ico
- Size 12KB
- SHA256 7b42f3990df3e54e215c1e4eb282eacad1ec3ea692c7cd655d90fec2d6e84844
- MD5 b08c8d96e08ede2f45040a54c5a8ddb9
- SHA1 ee22eb9e75776ed7a1dca8717e973c31331087fa
- SHA512 b2c58e36ac801ccafd7947b7ed87c4dbb25010ed0deef4ef0b097d696f3041ad264e8d11a34e75a884e22141714bf42026a13ff96a2e2a89bcf8908ff023e61a
- SSDEEP 192:Rj8ZxcS09dkyL857TY2ea3f7QIeumW1DirskqMWX21jPHaOWRAPUCAST:ZAcSD9gDa3TQI1xDcV3WGhP61AP/AST
- TLSH T19A42BFF327AF48E09F7551622313C9A136CE1DD8CD0265BA46DCA706708A4E4DA4BBF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target FileArchiver.Core.dll
- Size 67KB
- SHA256 cca47be3de20f63c2f8001d895fe286edcaaf8c209905ea3c04310ad36b12379
- MD5 f0fa29246ddf474070bbc36b7f8b8577
- SHA1 c9cca7e17094e8f730cdb727ed634adeb922c164
- SHA512 f42cdcd62790bd0e23b15edbb53499880df2f327e2c8535b076392e062330365218f51dca745f341f5c313fd4a8be0a747e677bf3aee062082531893d4157800
- SSDEEP 1536:M9VCg/aKyPPX8O7Z+xPok2IqgAheUYeP1cBkA5:M9VCg/ONYxP0I9qY1B9
- TLSH T199635C6123AC4733DB8F56B8B47111450BB1D2669817F3CE19ACB2E63D9339A17A21F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target License.md
- Size 441B
- SHA256 914cb9a81abee62131544e9a7634a27213b227530e94fbb8f929b64593c98860
- MD5 83bac2683b8a501fda0e02beea41646b
- SHA1 e6f2e0f9b57f0e5ba59c5be1c5604ab96a3ac3bc
- SHA512 510e91015eacbad811498c11eaa6cafb11751e122309fa7e154c955fae1d053ded3642646713b030b71ca5338a53bbfd91016c80a6197c6da9adb3ba4b00af03
- TLSH T176F0AB627114133FA78449C289232ECBF6DA991E869364C064AF72F45A278154AA8188
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target Plugins/7za.exe
- Size 592KB
- SHA256 a2caa9ae4f080fe16e061d70c145bbef4aaee6946bd840a6d344b1eebc3ac293
- MD5 ccb2802eb20b49ec868f38bc6591edd3
- SHA1 c7322389f45fa204d0b98f64476f1473dfb8577f
- SHA512 29694d9a4d342f7c2f06007eefa71c23bd0d120329876b58dd92a5dccd6389a05fe2dc43ce74e40781d51663a1f7f8b353edf3b54bbe4e27e49d90f7261716b4
- SSDEEP 12288:+4x2QX9pJg1XDdaKTEcILJajcPVL+3wtD42j6GNEcQbECNdN08VrGr8GrBQmKz/N:+rwFpcEJnVLMd7MKtu8mHwT
- TLSH T1BAD4BF02BBC2C1BCC63224304E396716E1BAFB6447268AC763D41F5E5E351E17E3A6B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target Plugins/FileArchiver.Archive.GZip.dll
- Size 18KB
- SHA256 7b9c1315914a29a0c2cf4dc58e1b0538340cd7fffef2795c64e2cd69e4031106
- MD5 850291c3e1e21e99c727d09e8d96e0e6
- SHA1 a607c00bdd65f28627361e3062f30c89dcdf9ec1
- SHA512 b656027d0b3f49ec646a1c2831cae25297eac76623584d08332fc3de79227580f5440f4549fa32d8fd1ce0b5b4ce613e10c432866ff8fec690bb914a62823bb2
- SSDEEP 384:b4NRZigs7d2WaZ4UyFNyuAFtEC58dAG6RELCG9GtSzR0T:bAPdZ4HN4x49USzo
- TLSH T12D820745B2D84327E8AF1B7ABDB1220007F0E7A18836EBD81DDD61C56F6776109623F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Plugins/FileArchiver.Archive.SevenZip.dll
- Size 41KB
- SHA256 f582cb2826fdd2ae578337c6df42b7ec8911f8e39c91ebf8c3381c3c21060e5c
- MD5 fc448703f2e239fd438498ea34d0bfe0
- SHA1 57a0ab990022e16b70329490faf0173c7e7e3f20
- SHA512 420201271e86695c4bbe95c5928dee499d298335fb90868c3f4d2858792cdaafaf5a8de257644f12d4bffa8ff278a411b510aeb51bb51ca5b6e50247e3f8c7e5
- SSDEEP 768:MKnC2uOaZxyqRobiumc/sE/PSjOPaCHdeN8pSz7f:HC2+QqU/PS/rH
- TLSH T11913499467EC8323D6DE6EB8A570451903B1E29B2917EFDA5DD8A0E50C273D04AA03F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10