Overview
overview
7Static
static
3oakbough-f...up.exe
windows10-2004-x64
7oakbough-f...up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...ID.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3stemmafiles-cli.exe
windows10-2004-x64
1stemmafiles-cli.exe
windows11-ltsc_2024-x64
1stemmafiles.exe
windows10-2004-x64
1stemmafiles.exe
windows11-ltsc_2024-x64
1uninstall.exe
windows10-2004-x64
7uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/09/2026, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
oakbough-family_0.11.0_x64-setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
oakbough-family_0.11.0_x64-setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
stemmafiles-cli.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
stemmafiles-cli.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
stemmafiles.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
stemmafiles.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
uninstall.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
uninstall.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260911-en
General
- Target stemmafiles.exe
- Size 43.6MB
- Sample260926-tk4resfa44
- SHA256 5956fa6c48ca106b6565aa79ff66c5ee1c04fc06f96040e4e07c485fb980258d
- MD5 1450ca95ee4088ef8e1cc2a8848d3b05
- SHA1 ed1fe9cd35ce117d0b49f6fd032044c6961f924e
- SHA512 14d3ab535b29924c5ef2bd86964f941e1105c3173e7b1adb13ad89e8c6d0936fd13c085b26c09af60e5f01134988041e2040623275d0e3985a8953cc3664eb88
- SSDEEP 786432:F1ETiFgTR7OMHTglJ0w8UmayIG260KmOHlt5:F1EA8NOMHgg31L1R
- TLSH T173A76B02B69F94ADD19AC8B083468A73AF2134DB0625B9FF41D456343FBEBE05B38715
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5384 stemmafiles.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5384 stemmafiles.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\oakbough-family\config.toml
- Size 180B
- SHA256 48a6815acfd5ea61122f207260911be356f37e9b53d598a69a614f2d8331b44b
- MD5 4497e7ed188b36eb5de7e707a5ba9c6e
- SHA1 f910ed71f7062b28a7442b30f077e093e415710b
- SHA512 83d299da9b8beabd16fc0e7d5e209e3ce30a6f49596577df083c4380abffa31ffb996f14da8593222fb8f7450c431a6a4d47cb0eafa1a12998e5c3c0ffaa0557
- TLSH T1E7C0802E51DBEA451125FF88DD70CA5345F3B675849D149511ACC05D145891CD15445D
- MD5 SHA1 SHA512 TLSH