0e167a4e858f264b1b2de9994fa395fd08d4545cc8290b837486ef5cd8b51385

Resubmissions

11/09/2026, 01:15

260911-bmc3da1sgy

10/09/2026, 21:09

260910-zzghbsweld7

Sharing

Copy URL Twitter E-mail

General

Target
th06nc.7z
Size 892.3MB
Sample260910-zzghbsweld
SHA256 0e167a4e858f264b1b2de9994fa395fd08d4545cc8290b837486ef5cd8b51385
MD5 2f63295295a4f24cefa5f4eab1d9c6e5
SHA1 5d622f25e695a81d3ff6955cad851d6e51a947f0
SHA512 72c792bffd52f104dfd93ea55b2435ea1994309327e54eddeb2de8fe98f80f9959093a4a7e2a238424e13ee727379942fa4e3b3642404b4ee59f05f7be7e4bfd
SSDEEP 25165824:aaIBzgnsw0BX5GRHzo99IzzlKs5BWLkDIJ+o0E5:sgsQzwIzzln5hA+o0u
TLSH
T169A933613F1EB1205C578837A1AC9C8AEB0909D95D63E26DD5394A82F323FE58F2474F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  th06nc.7z
- Size 892.3MB
- SHA256 0e167a4e858f264b1b2de9994fa395fd08d4545cc8290b837486ef5cd8b51385
- MD5 2f63295295a4f24cefa5f4eab1d9c6e5
- SHA1 5d622f25e695a81d3ff6955cad851d6e51a947f0
- SHA512 72c792bffd52f104dfd93ea55b2435ea1994309327e54eddeb2de8fe98f80f9959093a4a7e2a238424e13ee727379942fa4e3b3642404b4ee59f05f7be7e4bfd
- SSDEEP 25165824:aaIBzgnsw0BX5GRHzo99IzzlKs5BWLkDIJ+o0E5:sgsQzwIzzln5hA+o0u
- TLSH
  T169A933613F1EB1205C578837A1AC9C8AEB0909D95D63E26DD5394A82F323FE58F2474F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  th06nc/data/bgm/th06_01.opus
- Size 3.0MB
- SHA256 49a711314d9fb083f0b00c8fe083da43cd69efb7b023626bc34f9e3e213f22a2
- MD5 c697b3c468b5652843c7a476a1f37325
- SHA1 c3e4b2578d3429c4856f5e81795b7ba2c8b94cf5
- SHA512 e2b012dfdaa51ec5fcc7464e97f7af81d114d71609c53e5182221c0e85663eea0ef44394096dae5b06b034823c5c8d02850d3ec9734ec26e5cb69bf9cd4cf3fc
- SSDEEP 98304:gGrtRYMcYb8zRpwPG/xeqFZlhNW7VbC65qFU:9rth8V6sxHlfABF5yU
- TLSH
  T1F8E533107F1DD382586BC49782DD9CB6E8A0A5D2BB83A64CC53DBBC07D211CC5F2EA65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  th06nc/data/bgm/th06_02.opus
- Size 2.3MB
- SHA256 d55588e01a67dd9c88978a91db9168492d1980905ab26f43ebc8d81df399e4c7
- MD5 06d5f6094f5123d5f9e767cc3f8bbc76
- SHA1 0a79360b4f53eddafc0cd302ff10fd061b28c783
- SHA512 13c097333c598389c1994eed01d7ae9b4df616f9d4d68b092709422219dbb3a4bfc86caa1c9315f0f9fc5f86d1134c4a19ad57674fcc5f8290a9bc55046e397d
- SSDEEP 49152:0GZJU+0tORaI8h9UpRRZ1k61aYcMICBoLGB5ohmG6AWWxwh7pIgLTOjz:dDU+s7IK9UpvZOqcMICG6AvxeIgYz
- TLSH
  T11CB533A80F2565E3EE5BC97F6089CA8CF49053D41D25D807D81C8AF8912ADE1BF1BE13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  th06nc/data/bgm/th06_03.opus
- Size 1.4MB
- SHA256 c5ef1842daafe7b517896f08c93adf7cbd41b3de98e774c45ecd86c03121c17a
- MD5 149f307de681ddab3d2f4373c263f305
- SHA1 0e829041709a1314a70796d6289b4f87e247e60c
- SHA512 4eaa65407050712ef0eaa2f5a2e8815a4edef5181de06f33ebd91145d4ec52aebc7694920ca89fadc983f103516b9f4568894737f474d84d4ad38826fb09842d
- SSDEEP 24576:vNvjXhUXmttXLIt9DcOIZtAiW2W1tw9wDIewEHCzYpiSPSylWZU/ufxxwpklEEhK:5jXSXmDXstOXW2W1SGizYpiSTqJHfnvK
- TLSH
  T1786523563FEE15B096EBC2718143BA4A882059BEE56AF8FC9C5321F4F4930DF2D4429D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  th06nc/data/bgm/th06_04.opus
- Size 2.3MB
- SHA256 4a9f0d22b12697469dae8a296a950fc7ec06767f2ac09a0683f77b4aa566a084
- MD5 e8cfff2b124fff54edbe9d2b5c53c4f4
- SHA1 e78c342cb3030c5bb28a07f26cc6551baf224b0f
- SHA512 330ab00b7c3aa923213c8665f4e11bd6f6230851388a8eab4e1a7d3428bf273e379f866bf4f6aeec84838fbbd6b03dd3ac06fd0e732bd27fb1feceddd5eaacd5
- SSDEEP 49152:VQjbxzZgO2nMQx/N6+yNhlCXoy1nUuYTTXxlW4ypS9+oox9:6lWOTQXwhyoWhCkS09
- TLSH
  T154B533592B7B4A794C27D05260A0C333C648E59D495FECEBF4022474FE499EBEFA121B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  th06nc/data/bgm/th06_05.opus
- Size 2.4MB
- SHA256 731f34b07747e4d2fea8c1e138755bd16299d3cc657d5b90a9cd925f64986b83
- MD5 2bbd3d8b95596ac7d127725c5e7a35a7
- SHA1 4d18e2b3ce70b0f58c056daaaeeccb69f39ed04f
- SHA512 3458bdbcef14824f56b47533257d3cdaed58ebf75c3167cb5d6f8f78006d9b53c571cfeff887eedaea761a44cdb315bece0d614d6f34d96cf5af0e2df0d0f512
- SSDEEP 49152:lq+LQWazSmjSRmVsKkn0StUTA6cmGrV86mfYQdo99jeogM0ExBBZ:lqQQWaJjmmfsTEzWsPdo9syBBZ
- TLSH
  T193C5333467E9B738EC06E7D3E34912AC1F1949AD8D63454C863876A1F25E9D8AF30B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  th06nc/data/bgm/th06_06.opus
- Size 3.6MB
- SHA256 cf7880179a46a8cfb96c07e54dd0871d48c3cddd5c1fdd3bfc26f8b590b9a052
- MD5 67c9cada2ed81d7ac82e392347e78b88
- SHA1 27d97cae5b2a8150e0ceecb36710590e0f346139
- SHA512 8f07cee7439c84ffe6b059465544aa9c51c11a08c8b694c5c0278094afa2139ec5f284aec6ae41b91cf9217439567674448481667f1903040548867ee7cdfee1
- SSDEEP 98304:EhWFA1HbdnXg0szTT581AXi4NYXks82edgB:C1HtXgxTT581ASRXkX2KgB
- TLSH
  T157063332BF2FB2A4E81785A1A38C0F52CC215BDC3B21D08FD825D59561667E92E7B347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  th06nc/data/bgm/th06_07.opus
- Size 2.4MB
- SHA256 b4b6cdb2545dd5581f6429583dced8eca327d7eae796951508e710226c0c986a
- MD5 e5bc6eed381704d54c83079ee3a65b64
- SHA1 17bfb35d0057d39e81daf5b94cad556d034d8e3e
- SHA512 04500cfe7fed200c3ebe0477a883c0c476c6aca63d7e544c2cf31fea10317a4f5e615c1dcc8f161c4057c0059a68a28df9a5aebd45ecd5e5d4edb436a996f573
- SSDEEP 49152:Lw9jZPcOg6/T2/m9/YQZOPQZAoK8f36Eyh8EJ2RXdklsQy8kVi/U14eKVC:Le1jToGOYZ/v65uGOWlrR/U13z
- TLSH
  T19FC533903B9D2BB5461B012A7DDEDC51F12A9D568E2BC30FCA191CC2FA250E75F4A7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  th06nc/data/bgm/th06_08.opus
- Size 2.7MB
- SHA256 e766e172d1dbcbfbd51b2abf52b6b4fb0160aad37ad95f4832129c408488bd01
- MD5 a10b6966ebf4a191e923e2e15fe82661
- SHA1 38d0e20b5551e817e7e06f772006f7e1949f5011
- SHA512 c414ca95dfd0b4922d46bbff5579e161d8b0b611cbd1295136f8bfabb66942164ee72e1f11ee88df9b207347ca3827568fed26cbbb66ce53ed33a59d66975e86
- SSDEEP 49152:cPsHlvSNgTFsSsy0bcxVx43esB3b+lBF0uiAoOfNPBj4ET86unNEcmlaZNSYnzPU:OsHlKgTFsSs5b6VSusBcsuiLOlPOET40
- TLSH
  T133D53375238A35BBCE1D045BB5DEAD1BC55301BD0B3BA48AFAB4E0C1F3654994FA029C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  th06nc/data/bgm/th06_09.opus
- Size 2.9MB
- SHA256 2aa3d21e28671be8e78584a2d94f10fe65e91f17c506ddbd7e6dd846c4b64242
- MD5 6edf8b479420181ad3df16371da86681
- SHA1 7ba0a176ba1d498d1161afe6fd10d134eac6d4cc
- SHA512 20294b0b74b71f3e10408ca796b20f817fd37d752142226e169838f0b3ae38986d7980e561cef643182b438bbfd176bc93e70dbc30598aca41558fdf47bceb65
- SSDEEP 49152:qZX7mUWFON9fGJ1RZ0BZ4nnSDyKqRHc9aijk6Y+ShdXShQDMVPmnMb9:qZX7dW4N9eJ1iRDPEv1XYGMVPmMb9
- TLSH
  T160E53329374F98F95C1A9C479240711AC9806EA2A332BB678CB65B50F3142CD6F7FD1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  th06nc/data/bgm/th06_10.opus
- Size 4.1MB
- SHA256 22617c1b897b784f0278da4d96103b2e220118a0d16354b107bb95fcd649619f
- MD5 3e35d73d275e1ca0fbadd2b396a59abe
- SHA1 6c1b2bbfdfbba9d99e555be53a4c1501e897fca6
- SHA512 bddfe4c1a96f488be84e40f7f36c845c99a5e5901db571f6894d044cfa6377489dab43b35e9a91bd570ebe5c3a9c121250162b92e45b07ebca814e87ff6eead7
- SSDEEP 98304:Y53mkqvqco6QXjfoj7gmKL/wKEPOS+jJCKQJT+xcwC:wWj5oja7x6E2CKQQxcwC
- TLSH
  T1001633253BE87F382713C662972D3726D340B4A93576A249D85C9DD8E1A70F84F306EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  th06nc/data/bgm/th06_11.opus
- Size 3.0MB
- SHA256 d8db415ae88af211338945f65b1c918a2cc8ddbaf2061d283093e63a87017432
- MD5 687d9ce27b7e35084f7dc5701552f0c0
- SHA1 5883667c918ea94caffbe1dd4f7127f92b92e33a
- SHA512 ed640de4ace34ab5a213f095e56adbe83424773a678b5f5a1916b8d1794423e24742f15f0f05dc348a92062e626e5b64b326007ae3d6ed517e0d6372612d75fc
- SSDEEP 98304:TVDC8Jih/c2TVRN0VRZfaU4Rtbb009c5gvIY52R:TVDJWDN+jQt80sgvu
- TLSH
  T176E533AB3B4F7A05405FD0D25A9CECA9867208F90805F087D3190AF6F17AAE47E3765D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  th06nc/data/bgm/th06_12.opus
- Size 1.5MB
- SHA256 64009d1cf6bee74c092ab78dd91d97c9130166647b2b84d5f885a5bfaf1387bb
- MD5 147ae42b3ef2148a6ca96d0353507e15
- SHA1 035bf7c5d951719e27374673c9df85a1df37e842
- SHA512 973abd172f589c6a309a8610483ed97c02dc20c37b9b699418a0647e15bb3cd4c38a9a10394990e8ec480f484fbc2201b20341a64f016976fdd57a39fcd6a54c
- SSDEEP 24576:SUr1q16wQrwV0skOy9OoKmqPIFIyfS0PQEdYK50GhfXPv/HydwhSMdMjAAjoVIBs:71q16wQuqOBUIyfDPQEqKlX/S+GNQIbK
- TLSH
  T1BC65333067457A69BCEE9D538A843337548241117B2637CDC22FBBC9B63ADC62F39642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26
- Target
  th06nc/data/bgm/th06_13.opus
- Size 4.1MB
- SHA256 13143aecae90f5c22b9105f818f5b7aa6108727b40f0de226380d111be426d4c
- MD5 7244afacf66e24dd29ec8bbd576add45
- SHA1 860e4c3286eb1001faf2f6cbc39e15f96335f136
- SHA512 17d150f94ae38b498e9776a8a80389e4fbc3763c1c0eed33c6f1427195e171732d62ea931ae4ae22f3eb6d0d5e31949e38cba91190123c8bf2e0badbd28efbb9
- SSDEEP 98304:Cjfke5Bb9ryD/hOnqbFZxZYrWqJEd9YSoq3A+YAGqVYlwn0bbFo:Cjfr9EhOn2FZRqJo9/5A+yqVYl60bpo
- TLSH
  T1C616339EE7081515B13B9593F7C96662CB86C26F4A2BC19EA5941CC1F333AD80F36F09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  th06nc/data/bgm/th06_14.opus
- Size 3.9MB
- SHA256 273dd53a7f56c4693b7b3f7b8bce4039ba9bde4e2d238a5cb993f3294c9ece42
- MD5 0dd165df74eae9b1c66e0d65f1b1a11b
- SHA1 dffe078922e5bc1e20ecae852a6a63f41ca63f22
- SHA512 0f27bbd966efe0b7d6d8115c070f13afd14c70389a428ee56f424ad9c5d80dc7748d432f798289a490c1fe2c927da04290ce58c82dd6f5ab60126cffe9a26a45
- SSDEEP 98304:SMug/T49Cj59ChEwogt8HnV+zxNnGYxmqg4pYhh1TTej:4grzu+c8GNGYopPTTS
- TLSH
  T1C016333F9B1623FA101F8C13A284F686E516A661EDB7F19EE1242470F1796E51F3061F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral29 behavioral30
- Target
  th06nc/data/bgm/th06_15.opus
- Size 4.1MB
- SHA256 75aa1e465eee30ea68aef6b1c4247b8143bc85ab825b27898050bf2aa108cfbd
- MD5 c7822e1808fc8ae4c2c6a25515cc47f6
- SHA1 7d69957a12792a0bc51c810681229438734ec46f
- SHA512 77f95cc7c3cc5a2d730d2d83fd33cffa93e6c24175c37b8aa223a57c69a7f675142231f64f400de19b4ae9740a9df0ec6d0ed76e18887fb7e47aa04bcf8b6230
- SSDEEP 98304:reaIynVyKdGFndl6wfbHkGKat411+g6leo0p:rYy1dykwfYG5+/os
- TLSH
  T1D2163336AF8C37B41067E006795E946AE60920A6CB63945ADF150C28F6F4ED52F3F70E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32