Analysis

  • user interaction
    yes
  • max time kernel
    20s
  • max time network
    20s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/10/2026, 09:45

General

  • Target
    ScoobyLoader.exe
  • Size 11.4MB
  • Sample261003-lrj2laxthx
  • SHA256 0b6c01111ab6a3187d846ec67b1d8892f6c1e0652d6980e92703961b817eedc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    PID:1088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ar.json

        • Path C:\scooby\launcher\language\ar.json
        • Size 33KB
        • SHA256 1e6cb4d5fcf5cb3fd18933790c792cdcc1aa337dcafa9b52d3e326b19e7fb9a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.json

        • Path C:\scooby\launcher\language\de.json
        • Size 32KB
        • SHA256 76a6aa013ba21516690140fb5c12c849e966458545b9be4de675c740a4f3ba0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en.json

        • Path C:\scooby\launcher\language\en.json
        • Size 31KB
        • SHA256 6d44b5bb77f3f9a1bc43fad22b784056e7b6c0b17ecea43ecd209f2712d758f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.json

        • Path C:\scooby\launcher\language\es.json
        • Size 32KB
        • SHA256 2e33c21d750fd8f2e14114816e6b001c83ef14a181da0e43b4f0584b9fe3c4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.json

        • Path C:\scooby\launcher\language\fr.json
        • Size 32KB
        • SHA256 0fff6e2756899d4b129fb52ad70924485c31a8599ef1d54a4c8d405d4266d822
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.json

        • Path C:\scooby\launcher\language\he.json
        • Size 33KB
        • SHA256 a70eba2d68ceac7255102948a0709a4f5886e7105ff93c8c29ea70be872833a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.json

        • Path C:\scooby\launcher\language\hi.json
        • Size 51KB
        • SHA256 3af94289a0bee6c7d3e19424f31c5a609968aed6c97ee14149e4307c5d33e3c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.json

        • Path C:\scooby\launcher\language\id.json
        • Size 31KB
        • SHA256 9498987ab0d9483b02f7c3ec318af0f77ce78f8f4db41c8dfe6383782d21605a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.json

        • Path C:\scooby\launcher\language\it.json
        • Size 32KB
        • SHA256 0dd7a8f2747e9f63709fb12e9c798a3eb91236abc94007b75b8d4e8d846bda60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.json

        • Path C:\scooby\launcher\language\ja.json
        • Size 33KB
        • SHA256 0095eb2bdbb1b1ed249f398c5ea7833809dd739351fe5df6bff368308a75b2ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ka.json

        • Path C:\scooby\launcher\language\ka.json
        • Size 39KB
        • SHA256 53faab1170e1988bddb5db99ad3aaec281cb2a5c2053a92f3f9ac5274ae59977
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.json

        • Path C:\scooby\launcher\language\ko.json
        • Size 32KB
        • SHA256 172093a55e5e33bd652e8a7030fcf7fc3ac0391a7e782ad4fdb212c7fee5da15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.json

        • Path C:\scooby\launcher\language\nl.json
        • Size 32KB
        • SHA256 997473e94975d0ce8c11222b6f9b3e9b5ffeae15d05bee54fceea89005b749b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.json

        • Path C:\scooby\launcher\language\pl.json
        • Size 32KB
        • SHA256 21c2342a094876d671770261deb2362ea6291d5f240f420ee609f34b8e2fb2e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.json

        • Path C:\scooby\launcher\language\pt-BR.json
        • Size 33KB
        • SHA256 f7f11da778180af4830c04921c4d28afda99fb65448dfac952cb103c1581e0c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt.json

        • Path C:\scooby\launcher\language\pt.json
        • Size 32KB
        • SHA256 63563e1af11709cefc8efe8e23d28a21239093b87bc64e9ff8efc48c2122ebb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.json

        • Path C:\scooby\launcher\language\ru.json
        • Size 35KB
        • SHA256 7ad47f58d9b1595115e2e3c7ef798bd8a891c3f0a671a9b6c00c687cb3bb3845
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.json

        • Path C:\scooby\launcher\language\sr.json
        • Size 41KB
        • SHA256 a15786e914ada4b923c316e1c568680d2f64f9b43c8b36e69b043eb84d39b8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.json

        • Path C:\scooby\launcher\language\th.json
        • Size 37KB
        • SHA256 bc23e5488d338313e9e1ba8a3839b8c2025cf5c6800cfb49c9ca4e8b614bad50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.json

        • Path C:\scooby\launcher\language\tr.json
        • Size 33KB
        • SHA256 5396c500d2319aca440465749507a5ebf6fcefce646cf97be7a1235177246b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.json

        • Path C:\scooby\launcher\language\vi.json
        • Size 33KB
        • SHA256 96eebad3ca7a68dd19b2891707c685f974b11afc5860a37b718c84b010057e08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.json

        • Path C:\scooby\launcher\language\zh-CN.json
        • Size 31KB
        • SHA256 716edc381c3648e8d59012d7a42ede75cc8bf750cdaabb370efc33e21c7f564a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.json

        • Path C:\scooby\launcher\language\zh-TW.json
        • Size 30KB
        • SHA256 06756e9961b0bde93c4cba2fa7337a87de7bb2d53fd379ecc9485395afab0476
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1088-122-0x000001F728030000-0x000001F728031000-memory.dmp

        memory/1088-0-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp

        memory/1088-123-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp

        memory/1088-124-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp

        memory/1088-125-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp