Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 12:20

General

  • Target
    GalaxyDesk-0.9.0-win-x64.exe
  • Size 32.3MB
  • Sample261001-phyp6sbf37
  • SHA256 519c6fdf7f8109bf03d42e309a8bcf9788bb5672602dc36efe6c4876f58e684e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GalaxyDesk-0.9.0-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\GalaxyDesk-0.9.0-win-x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4372

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE-APACHE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\anstyle-wincon-3.0.11\LICENSE-APACHE
        • Size 11KB
        • SHA256 c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\anstyle-wincon-3.0.11\LICENSE-MIT
        • Size 1KB
        • SHA256 6efb0476a1cc085077ed49357026d8c173bf33017278ef440f222fb9cbcb66e6
        • MD5 SHA1 SHA512 TLSH

        LICENSE-APACHE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\anyhow-1.0.104\LICENSE-APACHE
        • Size 9KB
        • SHA256 62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\async-io-2.6.0\LICENSE-MIT
        • Size 1023B
        • SHA256 23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\core-graphics-types-0.2.0\LICENSE-MIT
        • Size 1KB
        • SHA256 62065228e42caebca7e7d7db1204cbb867033de5982ca4009928915e4095f3a3
        • MD5 SHA1 SHA512 TLSH

        LICENSE-APACHE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\dtor-0.3.0\LICENSE-APACHE
        • Size 11KB
        • SHA256 a8ad31b1c3f40dca5a84119351b8fa8ddc868edd77fad8a8ebf6d8f2d16fa4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-APACHE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\fdeflate-0.3.7\LICENSE-APACHE
        • Size 9KB
        • SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\foreign-types-shared-0.3.1\LICENSE-MIT
        • Size 1KB
        • SHA256 333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\futures-io-0.3.34\LICENSE-MIT
        • Size 1KB
        • SHA256 6652c868f35dfe5e8ef636810a4e576b9d663f3a17fb0f5613ad73583e1b88fd
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\gdk-0.18.2\LICENSE
        • Size 1024B
        • SHA256 8cf56d10131ce201cf69ab74b111d3ebac1acca3833d7efb39ae357224b70edb
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\icu_properties-2.3.0\LICENSE
        • Size 2KB
        • SHA256 f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\ignore-0.4.33\LICENSE-MIT
        • Size 1KB
        • SHA256 0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f
        • MD5 SHA1 SHA512 TLSH

        COPYING

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\jiff-0.2.37\COPYING
        • Size 126B
        • SHA256 01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\js-sys-0.3.105\LICENSE-MIT
        • Size 1KB
        • SHA256 378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\num-0.4.3\LICENSE-MIT
        • Size 1KB
        • SHA256 6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\phf_shared-0.13.1\LICENSE
        • Size 1KB
        • SHA256 0ab4d106b6faac07fb6a051815fd1b4d862d730895e2d7d7358c2f13565e7a38
        • MD5 SHA1 SHA512 TLSH

        LICENSE-APACHE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\proc-macro-crate-3.5.0\LICENSE-APACHE
        • Size 10KB
        • SHA256 8ada45cd9f843acf64e4722ae262c622a2b3b3007c7310ef36ac1061a30f6adb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-APACHE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\rand-0.8.8\LICENSE-APACHE
        • Size 9KB
        • SHA256 35242e7a83f69875e6edeff02291e688c97caafe2f8902e4e19b49d3e78b4cab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\rand_chacha-0.9.0\LICENSE-MIT
        • Size 1KB
        • SHA256 209fbbe0ad52d9235e37badf9cadfe4dbdc87203179c0899e738b39ade42177b
        • MD5 SHA1 SHA512 TLSH

        LICENSE.spdx

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\tauri-plugin-single-instance-2.4.5\LICENSE.spdx
        • Size 888B
        • SHA256 eb8a6c84630461b352badcab1dbe5d0168c56d377358b2b8c86b51003272d5ef
        • MD5 SHA1 SHA512 TLSH

        LICENSE_MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\tauri-runtime-2.11.3\LICENSE_MIT
        • Size 1KB
        • SHA256 9dd42ea92cff2ede5cd477cbfcce051b2d0115c0ac7f368ee88cb545055dff1d
        • MD5 SHA1 SHA512 TLSH

        LICENSE-MIT

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\unicode-segmentation-1.13.3\LICENSE-MIT
        • Size 1KB
        • SHA256 7b63ecd5f1902af1b63729947373683c32745c16a10e8e6292e2e2dcd7e90ae0
        • MD5 SHA1 SHA512 TLSH

        LICENSE.txt

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\wayland-scanner-0.31.11\LICENSE.txt
        • Size 1KB
        • SHA256 1cb6f4dee8c649f175736380495f0af0c753c87f22d50931692968bb24bf2161
        • MD5 SHA1 SHA512 TLSH

        license-mit

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\windows-future-0.2.1\license-mit
        • Size 1KB
        • SHA256 c2cfccb812fe482101a8f04597dfc5a9991a6b2748266c47ac91b6a5aae15383
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\GalaxyDesk\runtime\payload\host\licenses\zbus_names-4.3.4\LICENSE
        • Size 1KB
        • SHA256 260e4ff3fc493695880c90774283eb1e3d018f898fabe655bbd52dd2cbd2fcad
        • MD5 SHA1 SHA512 TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsg1F48.tmp\System.dll
        • Size 12KB
        • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modern-wizard.bmp

        • Path C:\Users\Admin\AppData\Local\Temp\nsg1F48.tmp\modern-wizard.bmp
        • Size 25KB
        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsg1F48.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis_tauri_utils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsg1F48.tmp\nsis_tauri_utils.dll
        • Size 33KB
        • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
        • MD5 SHA1 SHA512 SSDEEP TLSH