21787ff78bb14e1217dccfef15f2aa238c547f940e05c06d87366f1ea6ef7202

Resubmissions

22/09/2026, 08:16

260922-j6df9aty7j

22/09/2026, 07:56

260922-js422sbd257

Sharing

Copy URL Twitter E-mail

General

Target
camunda-modeler-5.51.1-win-x64.zip
Size 168.9MB
Sample260922-js422sbd25
SHA256 21787ff78bb14e1217dccfef15f2aa238c547f940e05c06d87366f1ea6ef7202
MD5 a01410f029e5fb45b8621dda80e930c8
SHA1 87eddbd719d7776636fe35dee79f0c61c231b94f
SHA512 f611926e48a7577ee753f41bdf940dddfd49bcb345ea8163aa6b119c669ca1fbcb59c0524028b57ac6708c86ee40eb60ca9affb3f080ba1cf7cfef54684ead49
SSDEEP 3145728:+vnSazEHz42melkaOdtRk4KxnXDx6kCCYaZ6ZNDgN67HOvZCvj1aliJidjuC1:EnfzEH82melbOtRk3nXDx6kP6ZVi6HOl
TLSH
T1368833E7E8B8C244E2296EBFF1638E99ED5FC3E894359B1F47145291A1D12D3CE2481C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Camunda Modeler.exe
- Size 224.8MB
- SHA256 175d6a0962dc023829ddc469111054bb45db3df141f228f34c77f16f9bbaf92e
- MD5 824fe9a86cf5fcc4983c631a637ce84b
- SHA1 147198c8e9f486d6a043769770dc02356ec94a39
- SHA512 c07ddf6ede44bafa06d9cff0c2d7791d3ab530467133e2b54714508b1e2c5d48b51948280a7c963cd32ef1f7618f89e3412f793637f640df6b256cc987ec09eb
- SSDEEP 1572864:2XT66K7b/+3j8AfBGK6lXimTvjuChy24T0iEwfBdEjtef0NrU+TsOtNF4mJ+72Re:iK7b2QAlx3WydiEH
- TLSH
  T1F8B88C03F29A41D9C05DC1798B5B9633FE71B8494724A3DF2B5447922F66EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 2a01c08497036d18d7e21e6735f3bf019b63fcc47e09208cee43b41df65f5868
- MD5 f8e48611169cbe7b5f1b2a95b174fdd0
- SHA1 eb9871a74549428b3e613a42c6634ceac4a06184
- SHA512 d5fbf320e1ea77a77be487511255e9cc0429687193bc9aef76990e255c5fd91a6195937bc395786cf290351deadacef6f2be15076fbbd67f7c67eadecd73f166
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/Z3r8xsJQnFTCa7id+Ui4WMEAcA3:a
- TLSH
  T1F227B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2 behavioral3
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 942bd7686fe9a32b55a08acf91a1e4c58a75ce03608125ae8b88b0e0a9322d6a
- MD5 df6520c713293e855203afa3a66e1ba1
- SHA1 19bc09df6134a11f3357e09b23fdbe7fd5e1353c
- SHA512 9ea858fafcc03bebb36a90d13fede2f9b44688231aedd190f4585f3920c498c42ccc493362829f72524b5b00052de748a1c47accb6453e6ca90f8cc4e8d7b57f
- SSDEEP 393216:hXNEdmf2ieXXZszEL9hEXHDXHH6qws7ulwO:Y8EL63HfJyb
- TLSH
  T1D44729122646D49CC099C879C7678B268A2C30E73FA7B9DFC0F461252B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 3c3db6a368f7d30357f7a821382c8d44b9663671c0763267e6120754fc16e13d
- MD5 d6af7b84edcd5c38795fc6984190fd86
- SHA1 b3ab071c56b2af502e7d0bba5c3d7b625d914c77
- SHA512 c01b71e20811586f50f8891eb8babbc0c29817585c92c64c618c0ae46b84a60d18f0e11153d739c747ec538bd8b9035c4277e4430b8edd27d5ba56341896359b
- SSDEEP 49152:BiL+sa87V2L4I1KZIBASdzKKtBr4ZjBnx1y9J03U1aLuo7H//kgpM2pb:AS87VQ1KZcrXvaLu6Xbp
- TLSH
  T16BE5AD02F6D251EDD019C03497AFA213F271780A4F206AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  libEGL.dll
- Size 457KB
- SHA256 d158fd5973c9827ebbccb28cc15056503490ed2f9c6ce9ff426586eee4cc21d8
- MD5 bc8abab4686d495ea70d994ce1e14b7e
- SHA1 a4adf7026a1c672e815b11fdc04fe0783d6911ce
- SHA512 c1f8e219ffbe103e2660aad4d950bd201284c8ae0bfd9b16dcf1944f0219b4b844fbe61a6e73fc85fa8bb27a6c0b732d5843b39ba06a39aeb8903652c2a74a44
- SSDEEP 6144:S25bWhtnviry9wjKs+QOqzkMCbgcuov42U2+1yVrxHLUqEEcN:N5bWht6y9TspzkMCbgcuB2S1yV9r2bN
- TLSH
  T115A47C15B3E549B9E07AC138CA138643EB71B4560B61FADF02A0D2793F77BE45A39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 81377041d32990dbc7a6224606675c98d814d84ca38bb6534a1c878da80393b0
- MD5 7ad58f2eddf718b896a0f7f4e13a9951
- SHA1 e7440716178037dbca9a0529f9645f85f2ceebd8
- SHA512 a1f9a935f500fbfaf3fb6a1574d4651bdb9aed269e6351dca599475513db1cae55ab0600d98e5b6fe3b40b47210c4bcadedc7dcd462bfa4f706c992a7dce96a1
- SSDEEP 49152:/bcPYWPc7utsobIQO0g8u+r1zczQCitZ7iwkv5OMjAgMvz3/9c3fs0ADL7/1bkjI:/P8bTCgkKvEE0A37VpEfcBp
- TLSH
  T196867C03F69681D9C05DD2788767A223FB34B4450724B6CF2AA497152F6AFE0EB3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/vscode-windows-ca-certs/build/Release/crypt32.node
- Size 126KB
- SHA256 3bf045b1c980a92db50229bb6fb01e58e3e518fd8b62af67739ab124aaefb891
- MD5 a5da498b86037c09c599adc07ee729db
- SHA1 26127c2e90dd047a79502dbc87bf60b4835c37c8
- SHA512 a6db93cd94c5f9eafa659475d3f8dfe43d6e4501a089a76bdfebeadaefc4013f29dc70f010f1bd9e78f6176197194d5b0b95ac389248c52c7a977386588c64bc
- SSDEEP 3072:xilQ6cQT4y8SYN3XvIQIknUNRuubEmzIXr:xjQcyVYNgkUNRI
- TLSH
  T191C35B1BB3A510BBE0778238C9A34E41D3B2B8115B619FDF07E041691F677E19D3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/win-ca/api/index.js
- Size 32B
- SHA256 d789f05ed0373d9192245decd39c015e7531d1b181bd28ea1b74123eab4f4dfc
- MD5 34d17c13ee1578e8e31b9f6d7073ba57
- SHA1 c16b4a4267d855e7a06942c444f09220995a9d6b
- SHA512 d753edeb6c0224dffaab97ff53ed8df6a3c372c1c401e1767199435eba7183621fd0f8bc4491922dc06a5e55b8154135f7138cd20c249ffa056df8b67a6f29eb
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/win-ca/fallback/index.js
- Size 32B
- SHA256 d789f05ed0373d9192245decd39c015e7531d1b181bd28ea1b74123eab4f4dfc
- MD5 34d17c13ee1578e8e31b9f6d7073ba57
- SHA1 c16b4a4267d855e7a06942c444f09220995a9d6b
- SHA512 d753edeb6c0224dffaab97ff53ed8df6a3c372c1c401e1767199435eba7183621fd0f8bc4491922dc06a5e55b8154135f7138cd20c249ffa056df8b67a6f29eb
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/crypt32-ia32.node
- Size 90KB
- SHA256 83ade67b54c67b7aa43c70377a6b48da16e749c5ede3a294dad4b4d11635cef6
- MD5 c38c6bbe0a4bb61e70d0d8d8f532742b
- SHA1 6532157cea6c4d54a08d05da1db4f08ef3bcdd2d
- SHA512 f994977d83aea54ce0eef6bf35fc86eff1af9e84cd5de34a4196098da3558eb5a0f75731a757037d3f0ca223fab92f0c2b3dcf56cb305108eca3c34b91fa35dd
- SSDEEP 1536:rPjz1q7+TfXFavCakpkFkxvAabkmR87APOcvd6sWldcdBcIp5Rd2RkD:rPjtTdaqTpkYvAaQvc1yMBcIpVmkD
- TLSH
  T13A936B41B5D1D0B1E6FE4A3C0470D6728B3F7520EFA1ADDB67801A6A4F341C19E39E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/crypt32-x64.node
- Size 115KB
- SHA256 d9b9a4e7516239970927255e63834d034692feef02f51e0be48f42719f457a48
- MD5 a0000e1a28644ae2ce1b84101e8978dc
- SHA1 d0b81b342528e9f1314b43ba9f7b8ad3f945a648
- SHA512 d1f0ba0da59f1c4f09c903dde38ace33de33171b2883f6c7893c529355049e3890dea7175634a869e9f77d487be2cbf79f31069fdadadd49be1085266d1a295d
- SSDEEP 3072:Jut8RPl71rtuqcGuU4shO+G3QtgI1MkSWpt1:tJ1tlxu7x+yWrJt
- TLSH
  T16EB36B5BB2A540FFE1769239C8634A05E772B41107619F9F07B0429A1F673E0EE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/der2.js
- Size 1KB
- SHA256 694123efca860967fd8bfaf3acd1e247fc2e6525439d4132f7a760f2dcaf439f
- MD5 20d1fe9127c29820a7ca82e015964e81
- SHA1 ae805fd4968dd719529894bbc0ba0c9b6db13b10
- SHA512 a1105d5c841bf2775dc553222783317e2b81e1cbb573f88eb3759ab7e547eea5b45a0474a9bc52b8d836132ecb49b3aea2489594e08b95c26d29e94acd068d64
- TLSH
  T18441ED85BEE2A1724667B457265FAC0AFA6CD243400CD683D4D4C0823FE4D9C82B2BAD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/fallback.js
- Size 2KB
- SHA256 573fc8c329488b2919ee635caae7e220ec9498b5c56d03b32bc817eed3f78e2c
- MD5 5b9aa032d39d8cabe9feb4cae11fae60
- SHA1 72fa3b16130cc5e4f0f99cbdd9788d7958d2a5b2
- SHA512 02eb81c643243bd587bc5358cc334d90e671db5d950672e8647bd8431b09218e55fa79d0feed0755b0480945b9c4d53c12d9a978783b598337d35406546c45c3
- TLSH
  T14941CE0D68F67180D333B479DD5FD945706AD113382CD911B8AC92A46FA22B893E9DFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/forge.js
- Size 354B
- SHA256 256c8e24dc0783734e4fdcbef2d1f4f5408b45119832d42baef5dc74749b6f03
- MD5 00981d7e0baa824c7fbfa0a6101e19ac
- SHA1 d1fbc6bbd18cf22f1fbc744e07f70a03fde79bcd
- SHA512 d64075f0b7aecf711e02087aabbac6da9cb43a2c6f197d3636ecadaa4dce1195a36f0c0ec3e7426b6e98a6b676471f2de3a5c7b833b07f909bfdd6d8dea0093c
- TLSH
  T17BE020C898EBF041742BF5514D1BC846140DC80B0028C61B350CF7D5AFA09F40495FD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/hash.js
- Size 1KB
- SHA256 ee879c4d433aa1b45836fec3afde118898e6819b77795cf250b3bb619f08e5bd
- MD5 f38bb064668a52e170d11e01e2048be7
- SHA1 aed53f23fa6452b8af8168e96516c4af890a0a1f
- SHA512 7805ba4c44ab43afa8032616fe594b12ebae5f57b07dbdf5ded2f665f7213cbdf7a1d2d88f9213bf32836f8d9dee2b2295052f01a1b16d355994e9c26fc8d0ec
- TLSH
  T11521FEC6BDF3756457F372641A7FDC0CF96D8282415CC640FA24D1A12F68860DA72E9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/index.js
- Size 3KB
- SHA256 0fa6e724546f8fc586d7dd866b6e616e81dd1b9f834dc237acdfb54f67d5c66a
- MD5 3c2a5e0f33a2f7011682c16c79d3ca85
- SHA1 8561dd6a194fd46244a4b3920cd9ee18502ff455
- SHA512 3710b7f69b0ef6cb97d1fd56b825f2f195e81690714411a26009a9fa78437288e914cddf280e0d5c21fb1bb3add9dd88c6a41d64cae096d43357219dc4948243
- TLSH
  T14F61EC9C3CDBF21152E37378E41F8C06B066D013381C891279CC9AB87F64694A7E2FA9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/win-ca/lib/inject.js
- Size 1KB
- SHA256 d3aad66c31ee5485607ae16fe58e956451f9f23b9c4e929b6534a25711b48ed8
- MD5 459fb4f65be8589078b50b860c1722b5
- SHA1 2d87d05ea00a477927ec0857a7260128190fd6e2
- SHA512 db7e50b8ae91cf53e45bd7e815422b6aa9e6168dbc908eb549b3b7f7c9b861091303d381bdf7dd35b89a2a9ddf44ca7df649a5f412495139b0fdbe83680d7f58
- TLSH
  T15C319BEC15F51A30AAA688F5632B54EFDBB6E8C3000C9C31366DD29C5FD05E496974D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32