4db9553d803285ff9a664d676944d78a6fb11656f89ab4dfd2bc1b35d47c1421

Resubmissions

01/10/2026, 17:43

261001-waqsxsxsg1

01/10/2026, 17:06

261001-vmt6fa1cra7

Sharing

Copy URL Twitter E-mail

General

Target
VenoX_Game_Searcher_1.0.0.exe
Size 94.9MB
Sample261001-vmt6fa1cra
SHA256 4db9553d803285ff9a664d676944d78a6fb11656f89ab4dfd2bc1b35d47c1421
MD5 11b91e601cb7e7b4c7b5c4de94ca70f2
SHA1 7ef4b34ac8559bc083d257f62179d1df4c4f4f24
SHA512 0f334b541dcb1efb69124b4a6027f5b77742e32aeb98ac515a5aa581a0beae62c20af80af96c7edfc8948e45ec245f0e7501d931344ae3c22126b5af155f4f2a
SSDEEP 1572864:9Dt9IKPdcreG/jHRWY5eroROnIi8+HtFIROkdgU8iqLi9d+51kk7Tb9xLJOECHw7:9DUKFcrjjHRWRQGYHO0SlLiMkuTb9xLR
TLSH
T10A28332C573CCEF7D41E997EA31041068349AB1E5C20AB261BBC521A77C7BDF407A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VenoX_Game_Searcher_1.0.0.exe
- Size 94.9MB
- SHA256 4db9553d803285ff9a664d676944d78a6fb11656f89ab4dfd2bc1b35d47c1421
- MD5 11b91e601cb7e7b4c7b5c4de94ca70f2
- SHA1 7ef4b34ac8559bc083d257f62179d1df4c4f4f24
- SHA512 0f334b541dcb1efb69124b4a6027f5b77742e32aeb98ac515a5aa581a0beae62c20af80af96c7edfc8948e45ec245f0e7501d931344ae3c22126b5af155f4f2a
- SSDEEP 1572864:9Dt9IKPdcreG/jHRWY5eroROnIi8+HtFIROkdgU8iqLi9d+51kk7Tb9xLJOECHw7:9DUKFcrjjHRWRQGYHO0SlLiMkuTb9xLR
- TLSH
  T10A28332C573CCEF7D41E997EA31041068349AB1E5C20AB261BBC521A77C7BDF407A79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  VenoX Game Searcher.exe
- Size 180.2MB
- SHA256 fca56d9c2f055dfe28d43b4b3d9764db79f97cf532cc337328bdae1631df2fa1
- MD5 e6f52893834950e850ae040303524fe9
- SHA1 c9a5cee7d26745ef3f65d0c199384a70976be7b8
- SHA512 9afa942ed6f79fc5eee6949cc21489a53d63ab7115d944ac216255895ddf7827394272676d37075703f15f7da5d3a41a1368492a0c43c0c5d7986dce083620a6
- SSDEEP 1572864:jH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+q7:Asok+hK7j
- TLSH
  T102988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.6MB
- SHA256 b66a0400ccfda4cc16479381d21f7426b82b9b88e0256061935a76cdaa766c03
- MD5 619710230efcf4973ea6ea786de1ee07
- SHA1 8d3c3b9fa8d6ff3756bc3eb14ce16065fc958f57
- SHA512 033fc789c7b6d265fd09bf7421d8f47b72fa20557ccbcfa555ee0ac5cc90a000ac70b6b236178c7570f4e602247aae28b19a8ab0854e155e133dfb6957cebdc4
- SSDEEP 24576:Fy2Jw1chCzea1gMkcnNRqmSIg1eEIa7RtZBzd8duhmI9k7Ihie9t16cDiVPv:Fy2zOeFMrSICe8RtZB587IKEZ8G
- TLSH
  T1D1858D47B2B900FCD46BC174861B660BE7B274051374A7EF56908AAA6F33FE1167E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
- MD5 cf1d12194f2ffaadb8152502571c19a1
- SHA1 68777900b2d533d72ae32ede40862a0db8196791
- SHA512 8b20362f71c1ead34bb448d9acf31ccade3ead4c3fab326e7abc4617c0abb1a56a36eecc3218ad87e43af8289c8bf0280469c0e59dd1d0f6d5cc3246a6a1730c
- TLSH
  T1118160F7A789067D24C70069A12D62CABA23C32F8B7478485089566C0530AE45FBACFF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution antivm
- Executes dropped EXE
behavioral18 behavioral19 behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
- MD5 633100cb9dec3e4ae1c672c0b494fbfb
- SHA1 185d7fd4070157aa1eb4ad0fc53c362ae649030e
- SHA512 1ef6d19f98b38ac368ddeefa58d8f8a8e064e6402dd95d9b6e3b7a847c41cbd0f46dbb72646d27d01eb7b7f3200419c7ef8003b9ff53c9bfca76a71d22423a7c
- SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrhxtjFvcLd3s03Mb:ac1ZFjQBG1oQZi9qSvBBkLveomRz
- TLSH
  T1E9817384DBF5641247EB30D4A674A48D6234D27971AD08E0C8CBC3F531E50C9BBE3B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
- MD5 26660b3078523a953ee252b4e86e1c8b
- SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
- SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
- TLSH
  T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
- MD5 25fdd950809b2b22d0ba6917fe014c35
- SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
- SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
- TLSH
  T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
- MD5 69638dc10c19961a0c05350ae333d6a4
- SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
- SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
- TLSH
  T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
- MD5 1036ce624efbb9fbbb387fec25fd1bcb
- SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
- SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
- TLSH
  T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/inspect.js
- Size 174B
- SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
- MD5 21784edff107eaec0e9ef7e66e83552b
- SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
- SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
- TLSH
  T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Unix Shell

T1059.004

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32