e01e17d089d98d54e60b4fa41f8239c13263ac079d4e76a428b67dcb642de671 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

oakbough-f...up.exe

windows10-2004-x64

7

oakbough-f...up.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ID.dll

windows10-2004-x64

3

$PLUGINSDI...ID.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

stemmafiles-cli.exe

windows10-2004-x64

1

stemmafiles-cli.exe

windows11-ltsc_2024-x64

1

stemmafiles.exe

windows10-2004-x64

1

stemmafiles.exe

windows11-ltsc_2024-x64

1

uninstall.exe

windows10-2004-x64

7

uninstall.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
oakbough-family_0.11.0_x64-setup.exe
Size 21.2MB
Sample260926-tk4resfa44
SHA256 e01e17d089d98d54e60b4fa41f8239c13263ac079d4e76a428b67dcb642de671
MD5 07b28243a02cd9dc93c5e515050a81c8
SHA1 6c2a4fdb07f100a9671c33536f482c0904e3f689
SHA512 ac339802896f6ac55a5a6869e0c95aabc566fc62578d10efa243095f213900e2ef48544a500bb56f93e360332f8789b3808400532be0c30e3b08a52dbac39bda
SSDEEP 393216:3SjC4q8AhMeLnuGTEZLP1p7JmHB1xz0daengFswPcBjOvMLB7Bj1tZnmZNQVKqF:3kCn8MBNEl7JkBPjZmKcBqvMLB7B7ZmA
TLSH
T1332733BC93148EBBE7C09633B117C87F2836904099AFA5CF3716EAD3257B0A25674725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

oakbough-family_0.11.0_x64-setup.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

oakbough-family_0.11.0_x64-setup.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/ApplicationID.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/ApplicationID.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/StartMenu.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/StartMenu.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/nsis_tauri_utils.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/nsis_tauri_utils.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

stemmafiles-cli.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

stemmafiles-cli.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

stemmafiles.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

stemmafiles.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

uninstall.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral18

Sample

uninstall.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral19

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

$PLUGINSDIR/System.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

$PLUGINSDIR/nsis_tauri_utils.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

$PLUGINSDIR/nsis_tauri_utils.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  oakbough-family_0.11.0_x64-setup.exe
- Size 21.2MB
- SHA256 e01e17d089d98d54e60b4fa41f8239c13263ac079d4e76a428b67dcb642de671
- MD5 07b28243a02cd9dc93c5e515050a81c8
- SHA1 6c2a4fdb07f100a9671c33536f482c0904e3f689
- SHA512 ac339802896f6ac55a5a6869e0c95aabc566fc62578d10efa243095f213900e2ef48544a500bb56f93e360332f8789b3808400532be0c30e3b08a52dbac39bda
- SSDEEP 393216:3SjC4q8AhMeLnuGTEZLP1p7JmHB1xz0daengFswPcBjOvMLB7Bj1tZnmZNQVKqF:3kCn8MBNEl7JkBPjZmKcBqvMLB7B7ZmA
- TLSH
  T1332733BC93148EBBE7C09633B117C87F2836904099AFA5CF3716EAD3257B0A25674725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 198KB
- SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
- MD5 91c2e2f34b5bba068e9a6178e13a4e5c
- SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
- SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
- SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
- TLSH
  T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 12KB
- SHA256 a75c0c6ffcfe8cf8894d2c644f74cff8da2af0dffab23782fbbb6597c1c7738b
- MD5 80db9f53cb4176c30ab415985c876a86
- SHA1 29a032cf9858b309982bc96910f66c72cc2056fe
- SHA512 8b78a31d507e1641b3cc08007a6bee9db99923178b19047b65448f7143c55074f8219a924ea4690de8625beda1b53c6b8f216734f76c669856f7d256961f77c1
- SSDEEP 192:V1BTusyjbI05hbvNuw8Ykv/RjyE+lJP93/:HyA0DJuw8Ykvtp+lJ13/
- TLSH
  T18F42C618BF4705F7E9B39534409BE7EF451BA520DA2F4E4AEB0A0A09FE77271580E342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 1.1MB
- SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
- MD5 1e38f56aba852b737f2866c48b823165
- SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
- SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
- SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
- TLSH
  T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  stemmafiles-cli.exe
- Size 7.7MB
- SHA256 49b4f0ac634684c051fbb234e67149a89bf513613a540997644095cfd96bb532
- MD5 00f930c279bf6fdb5853526496f26fa5
- SHA1 56063e2b387bddc85eebb0c97e260ab46ccc3329
- SHA512 531d810f6fc18280df22cb48639b54a239efed33a8e28be1c039b749e49519cd50e2b85fc57187c74d7eea3cf6be039508950ccafc400843de6e7007f044f4b0
- SSDEEP 98304:0U+KqI4RLjLz05Z45/IIuPjz4i8CUlPHOr+sHU5:0cqnj8IIz4mI
- TLSH
  T177865A02A79FD5ACD15BC87483064B735A217CDB0A26B9AF41D466383FBEBE05B2C705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  stemmafiles.exe
- Size 43.6MB
- SHA256 5956fa6c48ca106b6565aa79ff66c5ee1c04fc06f96040e4e07c485fb980258d
- MD5 1450ca95ee4088ef8e1cc2a8848d3b05
- SHA1 ed1fe9cd35ce117d0b49f6fd032044c6961f924e
- SHA512 14d3ab535b29924c5ef2bd86964f941e1105c3173e7b1adb13ad89e8c6d0936fd13c085b26c09af60e5f01134988041e2040623275d0e3985a8953cc3664eb88
- SSDEEP 786432:F1ETiFgTR7OMHTglJ0w8UmayIG260KmOHlt5:F1EA8NOMHgg31L1R
- TLSH
  T173A76B02B69F94ADD19AC8B083468A73AF2134DB0625B9FF41D456343FBEBE05B38715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  uninstall.exe
- Size 736KB
- SHA256 de46b979e9a42240752c47e892e1f40abd356b5f1617ca9d76baeec8b4204581
- MD5 e05e0c8a5faf41352f49d75525185eb1
- SHA1 e93b5b8f95fda2e650aacf26c66a095f988a0421
- SHA512 9d141bdb07e2d6211ed91a4b3e03fe96bbc2bf75c3be772ddb127212af8c86bbb54535d270b8977379c78e1be329dd1b15eeba786d0a425e3ce58ab7ffb858c4
- SSDEEP 12288:tf/XF9ku2BXVPC7SPZEBxpeHOkdAyUZrMmw4OOfCAbDWCVC63tuC:tH72BXVKOhEBwOkdABDPbDr33tuC
- TLSH
  T16AF4132CBF26CCF6ED7649304583EA5B4E212E7989469713E710067FDD33572EA1A30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 8KB
- SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
- MD5 313661ec12ed5ce1fd0b3292bf02cb69
- SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
- SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
- SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
- TLSH
  T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 1.1MB
- SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
- MD5 1e38f56aba852b737f2866c48b823165
- SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
- SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
- SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
- TLSH
  T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

defense_evasiondiscovery

behavioral18

defense_evasiondiscovery

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

© 2018-2026

Terms | Privacy