53994489c3f7ffd36d8176b7ba5bb3741324ca9e094cb26c38f26d8b5f9f11d8

Sharing

Copy URL Twitter E-mail

General

Target
Agefield_High_Rock_the_School_(2026)_PC__Archive_x86_899421.zip
Size 790.8MB
Sample260909-234hdabl9w
SHA256 53994489c3f7ffd36d8176b7ba5bb3741324ca9e094cb26c38f26d8b5f9f11d8
MD5 a6b8982fdf91a6ad6d3bfd0b20b349a4
SHA1 62997faf58b514616ab8b7b574be60633e3eded6
SHA512 b1a9ae86c45fb278870df6d632744bd1599c603b2ab5ed073f77816af42cd291c3f1272aece30b0fb09196864673c028e0f43fd5c549ee06a0c6a3ec4f7bb082
SSDEEP 786432:Y4d3AvT8enRjYqHfOWtX0vXihnPYz5SQH0TZZor:Y4dwvT8enRYaO6kviVgND0T8
TLSH
T1B48933068A1DE4D7FAE371F47470D057D92B90B032DFA299F5A631B89E4A9006F2D90F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Agefield_High_Rock_the_School_(2026)_PC__Archive_x86_899421.zip
- Size 790.8MB
- SHA256 53994489c3f7ffd36d8176b7ba5bb3741324ca9e094cb26c38f26d8b5f9f11d8
- MD5 a6b8982fdf91a6ad6d3bfd0b20b349a4
- SHA1 62997faf58b514616ab8b7b574be60633e3eded6
- SHA512 b1a9ae86c45fb278870df6d632744bd1599c603b2ab5ed073f77816af42cd291c3f1272aece30b0fb09196864673c028e0f43fd5c549ee06a0c6a3ec4f7bb082
- SSDEEP 786432:Y4d3AvT8enRjYqHfOWtX0vXihnPYz5SQH0TZZor:Y4dwvT8enRYaO6kviVgND0T8
- TLSH
  T1B48933068A1DE4D7FAE371F47470D057D92B90B032DFA299F5A631B89E4A9006F2D90F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.Yhy
- Size 328B
- SHA256 83c06fb8b71cff236c96f3add5028110932a2d4723e2b3f73ff25f8dc7a9fda0
- MD5 92bd7fed497f850efa70419a7d9e7b9c
- SHA1 136762aa081138e62e2ffcf493f9923c64998e31
- SHA512 5a3fdc257a6707d21018d174b64112d938e321b88696aebca5b07a6ae2482a58efdc04dbe6fb4fea0fe2075e96bec1a684be70b7ab303e6321dd5ca0ed7e327d
- TLSH
  T178E0263607935E19F02650E2D056515E20E1480320427D4073708E88A43D949B9389DF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/Jt0uqShFzmae.9Y
- Size 21.5MB
- SHA256 bf3bb86ee77f4d4fc26d7c9ca0d616bef9cbcce628d81ec8013ec12fe809c903
- MD5 11f8de532aa7cd1d145bd13d6b782e60
- SHA1 b0dd0b347c419c46a1074cf208b4cc73599687b3
- SHA512 c7ae69cc764ac572c89886bc1daf2de8212e3d4062d93ad2899f9a21e86b5af4e4a9324fa93d747a3d526540aedadead79404d83a15b2c20c5092f01b32cdb3e
- SSDEEP 393216:QOpDPASk6OU2h053gL4Xw+vJqb4yMXsuybP3MgVugMc/Ne97cJyYXB0+Ox2DQirL:QOpDPAYOUG053gL4A+vJqb4TXsuqP3Mk
- TLSH
  T1A237078A4FD50FF18DEC8E4097A27DEC16156327EC252AAF0DACC555BB7DBE008A3815
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 367KB
- SHA256 64fb96c48c8e7d4b3e5a5fd5b42a2ff58d0bd5004bd620432b60a189329a4c3f
- MD5 b2289a3510b0e14bc3d6ced50846bc5c
- SHA1 57483f871d42e85808351d1e416267a8098ecbfe
- SHA512 29f336b730e9250bcd183247b607ad22fca71718cf4afdad08cb02429c915e9e2a0342649d5814083b91957a82d98ce018be66f187316bc6d23d19075bea938b
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fm:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYX
- TLSH
  T15B84230988C710040EBC87A97105FA7CF16C6629A3EA637955E7C6F5FD1EC662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 70KB
- SHA256 07d90f26d609424b563789620f1501010f873bbd1d523e641e3f1ca09e461ead
- MD5 d8a08fbcfebc1502a2cba47078b4b957
- SHA1 a2fe1598bfb04bf9d9343dfc9bbe964c9be27e67
- SHA512 5d084c96bc12b4460ddeba1b88f055867b622fbdfc560aecc0845be9fa44b35a1cd7ce507e9a71d8660e25bc565cb628a068fca10d309b79c94e7b89cde20b2a
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRk8:fK4FJumM68gsjFliwugQikL3NRk8
- TLSH
  T1A863025A8589773BB404EEBDBADADC05C124F6C03EC603A39F597D8853E4D603652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 ce65926475da73abf804a5457b63fa5a8fb7304075be1713b5fb9e128260073b
- MD5 52f052e11aecfbba065c48adc1f71552
- SHA1 6a3a1626c5c33e5454c2a937bc48083d995a4ec6
- SHA512 55b7573298793cfb96613bbbb041053ef2525660174761dec0ee91d64d3751218140772ab06a67375fd017762a6a4f21c46544c1606337afdc77544d5124a2e4
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKAb:Z77jHIL0vBzbiE54gbyDdkqL///qHap
- TLSH
  T162C31327B93C584859A47C5ACE81AFAA06E04C0EE58FBB4B42967C9C9C1F142FF50DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 359B
- SHA256 dd189b10f6130d194274c715513ec52eb6383c6869f7a71cdec2940932968493
- MD5 7d54d9dd3b35ac19c83343984deb3558
- SHA1 1d340a819b043b594ae3f7c2659e5b174536d0f3
- SHA512 d8fa6c7607d74850d8f59a5516eec46ecd4afdcc4c2a0643bc0d6d03923f584a273aaf6ffbbd5d730ea398fa8dffbe7e2442ebdf2347fc09441727c7695c0a51
- TLSH
  T15CE0C0E6626CC096D0FAE01589500CEC2A43F88253CE8CF80433ECD1823231644F88D6
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 b1d71acf11b78e5053e638d92a6e0ab6da908cadafa14e07c7ff261e380c949b
- MD5 c5e6418813cf21c8e36736aeca96cf91
- SHA1 cc8de5a60e6a19f8cfa75bd9f2f0e6a82d24d162
- SHA512 f1bd973d5d7d5010feedce12ad60dc5b9c9a06d65344261effc1208acbe7356e102615380b0b3bc4e240a46e4c290acc198fda904a1cdad91b6303fec449dbca
- TLSH
  T16C21BCEEE33A2FA09341ECA59071B6E2CB1A2310F9ED746DA44B677509876239089771
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 1KB
- SHA256 9acc6b7ce59fc0cd5d3d628604ef5f9b88019348cbc2523a29fd03055b1cf871
- MD5 28b132cca0a686ef624559f10337c639
- SHA1 6a14557028db78e3802419486c2a99187ae519bf
- SHA512 5b073d18fd4ff3f43fbb306ba5b0a3cd493fd365387cadc57d0ea2bddaf95dca843f12eaa845fa5b3187759e046f720e35fbc6745be6789acbc97e8010faae63
- TLSH
  T1AE31C6DAEA24A137735862D1B2140AF780212F7EB830D90C49DA76BF2253F751C35D82
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 6109ec4c138121cc4490b29491f3793c2fff418e360b63934c264de2bfb1464e
- MD5 dfa925af2860ff6630a25088f8a849ed
- SHA1 820fcd6d86d1eb43f44cbad560d474ada6332ac0
- SHA512 69fb905b6aadd248ff5faf25da30438074106dedeccc6cee9cb3cf7e0fa953c1fba8d09e8241658240306da1a94f1cfc194d50a19730fe7819b3043942294af4
- TLSH
  T1932183A8E704DD7372255011F28955E24058A4373C6AEE5D00C73A6F664BF762CB8DE4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 0a31f89c38206551a352485e6aa439c00d17fa55acc26ba063771e78e7453dee
- MD5 9871c49ef8a7bc78f7b53a24340ca4d4
- SHA1 424e80222730a6c2ad9fe60846b2195bc0769041
- SHA512 ccb0cd71a549c80df60f967b1015bc70e57e18fa34bcc049a0c59d95a56d049e73961f56e89c3cfbb3fe73b730a01194581d43510ee065abf65a1e80575e29aa
- TLSH
  T1F33126EDE33D1F60A354DCDA9130A6E3CF1E2340F6F8A498949B9B6109479339445BB1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 b4ae4af90e229f34bd14e2c64e0f43523393f14ee900d9f0fddf254ef0d2f077
- MD5 81e0264ed05dd880758e772332a3fa9d
- SHA1 e8b90092b5a13fc6838e7e0379ac94f017185e0b
- SHA512 bcaa6af4a720e19518a7cfda75853bed89eb43b3af9b73aee2faad0e4b26b2b5798a54dbaf8f0aed1031c05e17b40521a7cdec2b9ff1f90474431b7a5c1b9912
- SSDEEP 192:vzR3KblGhHiG+WsElhnJ3mD3SNnt5uY3X7Kb/:7R68hCedDtOSJuY3X7KT
- TLSH
  T176F1AF01598DD663D7B640F048855752FAB14A3C05BF8EE18C8C0E56CA7890B9B598F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 1KB
- SHA256 5fbee54d2fa2000ff503ade876a60a87e48512f3cab487922a0e34388874ab35
- MD5 cac0f7ecf5b921d98ca42f431ef4de42
- SHA1 2fa8769e71295dffff838c564a66772ec0e17f2a
- SHA512 02d1a70c67ff698d622db6a53d6e7b2bd85f383c416c2b7a586cbf3f30bc95803673463d1ecefcd6df55f6b93faa7ef6712e824647c68b188ef037ec150069f2
- TLSH
  T1B411A5C6A975C8208D84E5B3266EEAD4843BAA94130A05E81C1E5D783B70724A94FB4B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 944B
- SHA256 ae35a2fd3fa0415e440d632e1c37080b3038ba97a4962f52e633e7b9333bc76e
- MD5 ce0e09cda71f2b4924e5922adf3d1fc0
- SHA1 629d4dcc16ed3953911d71bb0cc1c1b70ac178d8
- SHA512 bc5707cf7cbe1cd4c95e66a9db5b53a9fbb76d98e07c0ce70d3a6014851a9cc1881f9b1e765cadf1fd07dc20b95609b004dd4322735bec0486eba4868cfa9ed8
- TLSH
  T12D1154F4E9B67D3AE76867F3AD084A62E9E252CD81F120144A2B745D56105300911E4F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 6209a196893fc4fcf8681b889661c9b07f4012259f63350de5c5254388ae1714
- MD5 1ff03e1740b23cca1943d5a11693d636
- SHA1 815d493df30ff45853b73c5830e710ab26c080dc
- SHA512 aa9c470d9b653bb24eb22278964fb92d0121b758be4067725ea05a20b20011ce44ae20ff29acfc1e6b0295b58e7fcab4fe5841b05b5a9a68b8a935d4e6a8b951
- TLSH
  T13B411FC2E720457331960154B269854786C81DBB7874EC5959CB782F876FF399EB0F43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32