Overview
overview
7Static
static
3v59q8bj.exe
windows10-2004-x64
7v59q8bj.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1qbittorrent.pdb
windows10-2004-x64
3qbittorrent.pdb
windows11-ltsc_2024-x64
3qt.conf
windows10-2004-x64
3qt.conf
windows11-ltsc_2024-x64
3translations/qt_gl.qm
windows10-2004-x64
3translations/qt_gl.qm
windows11-ltsc_2024-x64
3translations/qt_lt.qm
windows10-2004-x64
3translations/qt_lt.qm
windows11-ltsc_2024-x64
3translatio..._PT.qm
windows10-2004-x64
3translatio..._PT.qm
windows11-ltsc_2024-x64
3translations/qt_sl.qm
windows10-2004-x64
3translations/qt_sl.qm
windows11-ltsc_2024-x64
3translatio..._ar.qm
windows10-2004-x64
3translatio..._ar.qm
windows11-ltsc_2024-x64
3translatio..._bg.qm
windows10-2004-x64
3translatio..._bg.qm
windows11-ltsc_2024-x64
3translatio..._ca.qm
windows10-2004-x64
3translatio..._ca.qm
windows11-ltsc_2024-x64
3translatio..._cs.qm
windows10-2004-x64
3translatio..._cs.qm
windows11-ltsc_2024-x64
3translatio..._da.qm
windows10-2004-x64
3translatio..._da.qm
windows11-ltsc_2024-x64
3translatio..._de.qm
windows10-2004-x64
3translatio..._de.qm
windows11-ltsc_2024-x64
3translatio..._es.qm
windows10-2004-x64
3translatio..._es.qm
windows11-ltsc_2024-x64
3General
- Target v59q8bj.exe
- Size 41.1MB
- Sample260925-2myxysaa87
- SHA256 ff508e2f912d59c9eabaf03633ebacfd45c2049f38dcac027b8a7d7ad867ab2f
- MD5 c4c58fa22842733f566c4ef47306bfd3
- SHA1 d0990ba2596e7d3e57eae438d8769aec29ff7060
- SHA512 c4bd6dd7db10c4e39f07ee019e54de52d3c8e718a572f112503749c0900d76f0c09da2d727123c4f8e897d34932901ebb1dc43985a9728c6e8f777a96d2ea845
- SSDEEP 786432:g5mgiFGe/+eNyHgHb/LwQaPYgEqM6oRKU5etJMr5ycxkeX+K7PchrPSXZxu1pvI:gA3oeDIOb/LFawgXM6jGetJMrQGH+LKJ
- TLSH T14C9733BA2776E630D6EF41B5482CCA451A1F684EE451633AFFC22109F894D3CFE65E81
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
v59q8bj.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
v59q8bj.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
qbittorrent.pdb
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
qbittorrent.pdb
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
qt.conf
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
qt.conf
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
translations/qt_gl.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
translations/qt_gl.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
translations/qt_lt.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
translations/qt_lt.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
translations/qt_pt_PT.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
translations/qt_pt_PT.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
translations/qt_sl.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
translations/qt_sl.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
translations/qtbase_ar.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
translations/qtbase_ar.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
translations/qtbase_bg.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
translations/qtbase_bg.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
translations/qtbase_ca.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
translations/qtbase_ca.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
translations/qtbase_cs.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
translations/qtbase_cs.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
translations/qtbase_da.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
translations/qtbase_da.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
translations/qtbase_de.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
translations/qtbase_de.qm
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
translations/qtbase_es.qm
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
translations/qtbase_es.qm
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target v59q8bj.exe
- Size 41.1MB
- SHA256 ff508e2f912d59c9eabaf03633ebacfd45c2049f38dcac027b8a7d7ad867ab2f
- MD5 c4c58fa22842733f566c4ef47306bfd3
- SHA1 d0990ba2596e7d3e57eae438d8769aec29ff7060
- SHA512 c4bd6dd7db10c4e39f07ee019e54de52d3c8e718a572f112503749c0900d76f0c09da2d727123c4f8e897d34932901ebb1dc43985a9728c6e8f777a96d2ea845
- SSDEEP 786432:g5mgiFGe/+eNyHgHb/LwQaPYgEqM6oRKU5etJMr5ycxkeX+K7PchrPSXZxu1pvI:gA3oeDIOb/LFawgXM6jGetJMrQGH+LKJ
- TLSH T14C9733BA2776E630D6EF41B5482CCA451A1F684EE451633AFFC22109F894D3CFE65E81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/modern-header.bmp
- Size 9KB
- SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
- MD5 940c56737bf9bb69ce7a31c623d4e87a
- SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
- SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
- SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
- TLSH T1D312A8869D83DC42EC4F7F71E3E6A05320E0690A052FBAD56F3634D6E65F88B672410B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target qbittorrent.pdb
- Size 173.4MB
- SHA256 eb0839e1407f6eb1c20ca8b3cad40675da4cd9cb73e294ec6874262b06a88e53
- MD5 b6983b4e996e3c3a390f6a2644fda5bf
- SHA1 5a7d7f82ea0942112a5d55a4a05cd2486e19eeda
- SHA512 b354ef9464b457bebd00855334011359e4871ad0c8ba7d2b316617fe8e79ec0a7f4c3084c03fa1c42fda64254b72a956d133c320c9a93de0039abf87a46fed2e
- SSDEEP 786432:nr70eJLKIMSiytusGg35y10SfUykFO0dIeHUjPs:nPHCy9
- TLSH T1B9886C71F2845A02E55B5A738147071C52739C42B7BFAEBBC50D632A8C91388EBBF6C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target qt.conf
- Size 84B
- SHA256 fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3
- MD5 af7f56a63958401da8bea1f5e419b2af
- SHA1 f66ee8779ca6d570dea22fe34ef8600e5d3c5f38
- SHA512 02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d
- TLSH T11CA012E02135B2104063430303DF4192303C81C030333D1C6304001A5E01C0A0776E50
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target translations/qt_gl.qm
- Size 316KB
- SHA256 204a01ac7deb6b5bae193afecbd1e50d18c73bf7d94badeb2bbfdf6123c4ed93
- MD5 0661ffabfbc50187f3ba38876b721946
- SHA1 eb5e7205355cfc6bcb4df27e224079842c97b296
- SHA512 65ab66cc54d65e7678fa731a5c5f2cc9d6fc217b91ad47d538440811e09a23e49cd95ce62a79e3e8c275e250ac1a0b54bd289f6dd067573876da7aff54381d02
- SSDEEP 3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
- TLSH T1FF641C9063F85209F6F77B7D663A4224CF377CA5A938C10E4350AA6D1970E449E3AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qt_lt.qm
- Size 161KB
- SHA256 47eb5f97467df769261421d54a5bea1131c9fb9b6388791d38bb6574335b64bf
- MD5 8992b652d1499f5d2f12674f3f875a35
- SHA1 e22766a49612f79156c550d83c6c230345dda433
- SHA512 9b8b6dbff432f2a46c14bc183a6baf84acbf02bf2c5bb8c306c6538fbd9be1c0a9015bd46728f2f652f9163afc56b1e16d16eb95d8f7728f3c562ae9f4f1ae1e
- SSDEEP 1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
- TLSH T193F34F9562FC204CF2F38E3DA3B782019BB778AB2A75C12B1360B92D15705D4D97A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qt_pt_PT.qm
- Size 68KB
- SHA256 2c1e7bbf5168a64b43752dd4c547601c0bde6d610f8671fa3e3af38597e84783
- MD5 6656500f7a28ef820ae9f97fd47fb5bb
- SHA1 cc112b9c9513bcf7497f3417168b4c8a9f7640a9
- SHA512 5c3cbfcf86af6b4d949c1d914cd379e512e73ba350af661033a386ee7fb981fbfcb43d9a35fde7656e17bb09f64f1469f84867a780573c3359d645269461d5a6
- SSDEEP 768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
- TLSH T132630C9266F8264CF9F3AE3E96734224CF3738662939851F1B506D390870D49DD3A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qt_sl.qm
- Size 223KB
- SHA256 c44e0313a9414cc0e490b65b0c036fa11bca959353b228886547bc2c8492034f
- MD5 d35a0fe35476be8bd149cee46e42b5e9
- SHA1 9f3c85c115a283e5230d1eead84c8cb73a71fa03
- SHA512 beeb1751882af081e80be93f7464d4c6322b724efa2cbd3e1cbe709181d380c1c57e770fa962bb706d6fcf4a8cb393e3f6e187c1f604f8ceefb201ca3200bd1c
- SSDEEP 3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
- TLSH T119245F8562FC250EF5F76B39AA778344CB7A7CB47A38C11F0340AA6D1430585E6AA773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_ar.qm
- Size 156KB
- SHA256 e03fe68d83201543698fd7fe267dd5dfc5bfd195147e74ff2f19ac3491401263
- MD5 a7e4d0ba0fc5df07f62cc66ec9878979
- SHA1 21fd131b23bdd1bba7bbb86f3ed5c83876f45638
- SHA512 d9e6b10506fcf20b5b783f011908083d9df6c5df88e21b10d07f53a01ad6506a4b921c85335a25bae54e27bad7d01b6e240d58fdeeaabc7ff32014ec120c2ecf
- SSDEEP 1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
- TLSH T1D0F37250ADB4B139F052927AC303C3108716413A93DDBA3BAB77FE3416984BEAA1F5D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_bg.qm
- Size 161KB
- SHA256 e448ac9e3f16c29eb27af3012efe21052daa78fabfb34cd6dff2f69ee3bd3cdb
- MD5 660413ad666a6b31a1acf8f216781d6e
- SHA1 654409cdf3f551555957d3dbcf8d6a0d8f03a6c5
- SHA512 c6ae4b784c3d302d7ec6b9ce7b27ddaf00713adf233f1246cd0475697a59c84d6a86baa1005283b1f89fcc0835fd131e5cf07b3534b66a0a0aa6ac6356006b8f
- SSDEEP 1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
- TLSH T166F32C5D78BB2112FA52D27A1F0781E387297829112258D7FB0C7EA411DCE3A772B9C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_ca.qm
- Size 204KB
- SHA256 005b0aa0c9a5b930dfdd870661958a8069bbec862d75f98bce20bf7401bea13d
- MD5 79172e893f4e5f8315542bcc6dc409a5
- SHA1 bd4b8bc44a94cb540112b29dfaa64a25280abcd1
- SHA512 5962e05f87c6218f156b0454687a9f6179dcaad524105b0729c65451796cc1377e0120b3a5f6011f06e59e924f461d801035bf85e7f8310fc8757bcf4222af31
- SSDEEP 1536:BRLqRQFkzaZd4PIc83HuXrL+o3QEsAj1guyXELq+Iaw3Vp5ysCAGi05cDFLe:BRLRkz6dHcsu7Hg+B2XEWjaePzCTcBLe
- TLSH T10224FC4167FD2A4DF6F32B396A3A46058F7B7C696939D40E4310AD6D0871E48CD3AB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_cs.qm
- Size 170KB
- SHA256 03028b42df5479270371e4c3bdc7df2f56cbbe6dda956a2864ac6f6415861fe8
- MD5 c57d0de9d8458a5beb2114e47b0fde47
- SHA1 3a0e777539c51bb65ee76b8e1d8dce4386cbc886
- SHA512 f7970c132064407752c3d42705376fe04facafd2cfe1021e615182555f7ba82e7970edf5d14359f9d5ca69d4d570aa9ddc46d48ce787cff13d305341a3e4af79
- SSDEEP 3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
- TLSH T15F043F4122FC244DF6F35F3A6A774252CF373C696A36D50F93006E6A1520A85E9BB723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_da.qm
- Size 177KB
- SHA256 7d1e5ca3310b54d104c19bf2abd402b38e584e87039a70e153c4a9af74b25c22
- MD5 859ce522a233af31ed8d32822da7755b
- SHA1 70b19b2a6914da7d629f577f8987553713cd5d3f
- SHA512 f9faa5a19c2fd99ccd03151b7be5dda613e9c69678c028cdf678adb176c23c7de9eb846cf915bc3cc67abd5d62d9cd483a5f47a57d5e6bb2f2053563d62e1ef5
- SSDEEP 3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
- TLSH T1A904614123F8210EF6F26B397AB74240CB22BCAAA931D50F67047D6C09716D9D97B772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_de.qm
- Size 218KB
- SHA256 9cb5504dee6ef0d4d4be8ba2e34ba8294018a9e0ec810ceaf5e973d57a283434
- MD5 e22001db8ce8562063fd3904544658c2
- SHA1 7503d1bda02909b9177ebe03de87f91609b11b6c
- SHA512 e2656f09d38456bc96d2c5e4c70ac30671562874a526da76b5bd3ce912866dff5d5dbb3a60cf1bc445662687829f179d79a6fe53dd32a7471342d5c3ee830135
- SSDEEP 3072:7k+oCKfFWDh77qB8HVXE7YXEUgtWLDesK2NGDDiEfuBwdRlh15ce4M+ywYPYXCZI:7kvCoFps7G6g/Nlg
- TLSH T122244E4113F9651CF2F36B796EBA82409F62BCA9B971D90F5310A8AC0530E45DE3B772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target translations/qtbase_es.qm
- Size 161KB
- SHA256 4ffda56ba3bb5414ab0482d1dde64a6f226e3488f6b7f3f11a150e01f53fa4c8
- MD5 c7c58a6d683797bfdd3ef676a37e2a40
- SHA1 809e580cdbf2ffda10c77f8be9bac081978c102b
- SHA512 c5aed1a1aa13b8e794c83739b7fddeafd96785655c287993469f39607c8b9b0d2d8d222ecd1c13cf8445e623b195192f64de373a8fb6fe43743baf50e153cda5
- SSDEEP 1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
- TLSH T1B1F30D5067F9220DF6F36B3DAA3B86148F767C65A839D40F9710792D0870E499D3AB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10