Analysis
- user interaction
yes - max time kernel
20s - max time network
20s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 09:45
Behavioral task
behavioral1
Sample
ScoobyLoader.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
General
- Target ScoobyLoader.exe
- Size 11.4MB
- Sample261003-lrj2laxthx
- SHA256 0b6c01111ab6a3187d846ec67b1d8892f6c1e0652d6980e92703961b817eedc7
- MD5 632c7bd20ff38adfccff6b7a8ce0be4f
- SHA1 1c8b19eca9641833ebded931344f6698960c9aa4
- SHA512 88008fa1ef87499891aebcf367721dd6213487cc39982bd4136d0ef61f322f442dd9c45929a8fd03a4e090ff83350fcc00799e1f4fc4f603e54a96b0cbd5a538
- SSDEEP 196608:zTivzPEc2S9TIs5mIuaL9PoL0ZZiKtcU9yG6ZvQP7hWUMqcI5uMW4vJcUiWUWP1w:zTiwcF9TIs5mlaL9DT5JbdWrtI5uMW40
- TLSH T1B1C6335B448230F5F1977D74632EF4E16A0A31635F9638B04E07CAE94A7A8D3E6C6B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 13 raw.githubusercontent.com 14 raw.githubusercontent.com -
resource yara_rule behavioral1/memory/1088-0-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp upx behavioral1/memory/1088-123-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp upx behavioral1/memory/1088-124-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp upx behavioral1/memory/1088-125-0x00007FF6220A0000-0x00007FF622E25000-memory.dmp upx - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScoobyLoader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScoobyLoader.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\scooby\launcher\language\ar.json
- Size 33KB
- SHA256 1e6cb4d5fcf5cb3fd18933790c792cdcc1aa337dcafa9b52d3e326b19e7fb9a6
- MD5 80f227194f3dd272469dc9c7d811c816
- SHA1 d6f8e2cdf8538b6b52c2af4e7e078b82b1977fb6
- SHA512 629857eb610b9404e01bd93b5fde39485d213109c15715e866b08b6510e6b42bb6ac90af0ede22e5d21561429f589528c257763f034709c68e50b768d9f4c386
- SSDEEP 768:8mQvZRWPnal3bHnW6UpWRSIIR/EHDl1FNewtQ5RVPBRXvkq9OO:8mQvZR2nal3jnW6UpWR/IR/EJ1FNBW5D
- TLSH T15AF2C93BC2345CF789B08507D0A12D92FCE58B6F8259B82BB439571C1FBA864DDC6672
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\de.json
- Size 32KB
- SHA256 76a6aa013ba21516690140fb5c12c849e966458545b9be4de675c740a4f3ba0a
- MD5 edd98a551a670d7db9e2f813dda9a3b8
- SHA1 762346fb42f87d9f6584986e52c25e967796401e
- SHA512 0668afc9742dbbbc103e6ee89dffd8b55dd75f506ae44e72406351471951da17d3f8b0fb7b715a11772d4f70ba578e958ac6edbecd0b3b62b27be492a02b0f8b
- SSDEEP 768:Y/wWmB6NLBDYtGwplXXKuZNiwtQ5ROPBRXvk99OO:Y/wWmILBDYtGwplXauZNNW5Gv8
- TLSH T184E2C63FC3689CBBC9B48153A0A51D92FDD8479F4218741FF138576C1FBA464DACA8A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\en.json
- Size 31KB
- SHA256 6d44b5bb77f3f9a1bc43fad22b784056e7b6c0b17ecea43ecd209f2712d758f1
- MD5 f2817e06a0b3b409884420b2f30bcdcc
- SHA1 30f0d62eb3d15b374cfe9f607e6d0c987c4ef6a7
- SHA512 dce89e2b186739e7a2e5d2eae11ec9c924a2117f780d96d6a463dccaf7e753c45df90f98b62547160a318dbd5bfc3e8cd0b125562ff4955ca9fdd0d0c306aa42
- SSDEEP 768:+8m1TIQqZ5YsIR4zHALtWNuwtQ5RtP+RXvke9OO:+8m1kZ5YsIR4zHMtWNxW5kvJ
- TLSH T18AE2B43FC3645CFB89B08053A0A51D82FD9447AF8218785FF038536C1FBA464EED68A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\es.json
- Size 32KB
- SHA256 2e33c21d750fd8f2e14114816e6b001c83ef14a181da0e43b4f0584b9fe3c4ff
- MD5 88fd9477273e1d1feda4565eccb11ac6
- SHA1 029a295d2cbb0ef2907b74534128c2a621871445
- SHA512 c204161005595ed349d002774f3442f0b72d3709d2c3973493da225296eea7395a020c200f05f0bc543e953e18ab3a64e2403579177e554fa56a804d3c616d91
- SSDEEP 768:nM9mp1dy/dnv6jL5KzqNdwtQ5RpP1RXvk/9OO:nM9mPd2dnv6jLozqNGW5nv2
- TLSH T112E2B33FC3641CBB89B14143A0A55D92FDD4076F4218B95FF03857AC1FBA468EEC69A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\fr.json
- Size 32KB
- SHA256 0fff6e2756899d4b129fb52ad70924485c31a8599ef1d54a4c8d405d4266d822
- MD5 da8f703befe95eb31f2e7fa18e50e520
- SHA1 cfcfc1e1c12e5b5536195c675ceaefbb44a7922d
- SHA512 5ef5a419468474168640dcf83fcc555a8a3772cb448a8763061f3973da2583c7749ab6bf41281b7ff39ff1508fded7cb1b61c5b6756582d9caea73220ab799bf
- SSDEEP 768:mGGUMm+lZ8GWOlagfrdLLpvZNZwtQ5RVPwRXvkn9OO:nGjmAZBlagfrdfpxNaW5KvC
- TLSH T177E2C63FD7745CFB88B04143A0A11D92FD94479F9218B91FF138536D0FBA468EAC69A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\he.json
- Size 33KB
- SHA256 a70eba2d68ceac7255102948a0709a4f5886e7105ff93c8c29ea70be872833a1
- MD5 fdd13566b68f457c9d0c74774549b1ec
- SHA1 7035d4f875d5eb2d0f4518980d21e5b30c174da9
- SHA512 5e262b5a1b4da43c6b8e485b3996a8a149975b9473d9ee68cf46be9e5f832d4e5925870bfe034f648a6ad2b41ee8f0726098fcd464967d5140b77f46ed101c71
- SSDEEP 768:Hm6wn/Ai+wDEepVJ4PbPNnwtQ5RrPfRXvky9OO:Hm6wn/Ai+wDEepVJUbPNwW5Lv7
- TLSH T189E2DA7FC3E40DB789B0406398A46D92FE914B6F4618741FF238575C2F7A469DDC24A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\hi.json
- Size 51KB
- SHA256 3af94289a0bee6c7d3e19424f31c5a609968aed6c97ee14149e4307c5d33e3c5
- MD5 33c52c3dbf81462b9589a69e60554370
- SHA1 5c954a7ab0fcf0b04e6b6d31d5c5c8310e16ae9c
- SHA512 794585445098725caf791a87266bef91ed944015dbf014844f7a5068adacbf6dfe37b719430f0c9d4b4a18b21590eecab0552981b30489a1eed49ee96724a2f8
- SSDEEP 768:fmgckIwWJHrdGRYREcJe0rvO5rZht6pWJS2S:fmgckIwWJHrdGRYREcJe0rvO9UWJ1S
- TLSH T188338A2ED778B7AB88BC788BA60C0C76E8DC133F53A8615B7474739E4F64C704A95192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\id.json
- Size 31KB
- SHA256 9498987ab0d9483b02f7c3ec318af0f77ce78f8f4db41c8dfe6383782d21605a
- MD5 3e3a03e9242b4f0ea4acc9f687850c8f
- SHA1 8ea42c8634ba71af558c97b92bbcb1fefbb215b7
- SHA512 8e4e3aeb277deb66e2e76fae6362626adfa3f996893ffc4ea72df0a07a30a3d1c630500c878c16d7adbce81847d5218928f7049435926409489400492fbaba2d
- SSDEEP 768:Sr4m04yZWydWNMzq+WlruX8xNqwtQ5REPcRXvku9OO:Sr4mSZWydWNMzq+Wlrc8xN1W5hvN
- TLSH T181E2C63FC3785CBB89B08193A0A50D92FDD8476F5218781FF538576C1FBA464AEC58A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\it.json
- Size 32KB
- SHA256 0dd7a8f2747e9f63709fb12e9c798a3eb91236abc94007b75b8d4e8d846bda60
- MD5 304e7ee11e05e0fd2f9add0e8b1c9ad6
- SHA1 020dac8173af66a153ba4233ad21e9d242ecb579
- SHA512 6077240701ba4dda171b3b0a3ca1d19e5beb573462aa8e52fa1a23e17026e47b474c91a8398899b743056813ebc10a3f1ebb35af5f2a9d8c69b9d715da9e16a5
- SSDEEP 768:yQUmkSDLCiVdFlkv4bu+GNWwtQ5RJPY4yRXvkW9OO:yQUmkoLCiVdFlkQ6+GNZW5g4kvb
- TLSH T1E3E2C43FC3341CBB89B04153A0A55D92FD9447AF4228791FF038676C1FBA464EDC69A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\ja.json
- Size 33KB
- SHA256 0095eb2bdbb1b1ed249f398c5ea7833809dd739351fe5df6bff368308a75b2ff
- MD5 e3d2cd564135e810e3dca28c42900f6d
- SHA1 50ba8a6a1ee91b1e9b5946dfe6bb7e4aad29b1f3
- SHA512 a3ab57f1dd4b98f63ae37acb77a1dc59f0dd47a468fbd19c7f250b5aff5eaa56fb69aaf420344cdce2a03127aa4270e1351f21d9078adfa6345f28858be1fd4c
- SSDEEP 768:rlWmnDdGiho3L9hJPmhNNwtQ5ROPbRXvk69OO:AmnDdGiho3L9h9mhNWW5QvN
- TLSH T14EF2A53FC3A41CBB88B4456390642EC2FD944F5F8629791BB03C936C5F7A928DD858B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\ka.json
- Size 39KB
- SHA256 53faab1170e1988bddb5db99ad3aaec281cb2a5c2053a92f3f9ac5274ae59977
- MD5 75d342b0a4c683b157221383fe8fde0c
- SHA1 8490877edda8f326d06add9dadc80f5b07f3e3ec
- SHA512 3e303ce0561985948ca18d2a02ada684595deca32eb9cb38f08ed5078ffec7a249cb96d82d4a8fdfdcf56dd85f6d3aec28ce7a4a604ecd17448f52ae566313b8
- SSDEEP 768:8ObmJEWExJj/7bIJoEWZJZtvg3wknNcwtQ5RcPb3RXvkn9OO:vmKAoEWPZtvvknNHW5cvE
- TLSH T16203983BA6F42BB78DB9000240717E82FE944F9F9148642FF034A79C7F765149EAD662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\ko.json
- Size 32KB
- SHA256 172093a55e5e33bd652e8a7030fcf7fc3ac0391a7e782ad4fdb212c7fee5da15
- MD5 25117b2e4852efa26019a8fca22d9bcc
- SHA1 0b016fbc7fc994a862ed37d9662224d9bef53d83
- SHA512 5b7423233e862ccebe3d94da8a20e03bdf5f415223f34c73d5dfa244d091655ad79aaabf72a99fe52a3ec0cbf7e9bfed438fe2c0751fd4b6a423ea771564168a
- SSDEEP 768:pmnLDH7STSzRt1MvN+wtQ5RiP0RXvkL9OO:pmnLDH7STSzRfMvNhW5FvS
- TLSH T17CE2C43BC7781DB788B04043A4A41D82FDC497AF5329795FF5385B6C1F7A068D9C68A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\nl.json
- Size 32KB
- SHA256 997473e94975d0ce8c11222b6f9b3e9b5ffeae15d05bee54fceea89005b749b6
- MD5 55a91b59a2c761b63b4434d8528e5481
- SHA1 b25c3495ee8fdc3ff7ddb8eb501ec6860e1b2d55
- SHA512 c9b7dd399910c1c3313e79b47b39e2a4f3c513ae43a1d2c9ef137bc0baf44ed9131635a0049f1e2ad649e55d2c03755ec37ea5a5a3d457e41713a7606da1b462
- SSDEEP 768:/Nm8H0vHwjYTgtFj+II10jN5wtQ5RDPkRXvki9OO:/Nmm0/7gtFj+IQ0jN6W5MvZ
- TLSH T1E3E2D63FC3685CBB89B48053A0A55DD2FE94475F4218791FF138536C1FBA468EEC68A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\pl.json
- Size 32KB
- SHA256 21c2342a094876d671770261deb2362ea6291d5f240f420ee609f34b8e2fb2e4
- MD5 b53fec9be853d60f1298008556ba0ddb
- SHA1 42d10cc0724aa3e00f6c3bda28efcc095fc3d9d4
- SHA512 f1c559cddfbce55bf9ff235a41e91d5ba2a69a24b08450a2de836bf875999150cfe564633d7e77d1cf313a933622dd7e8110f5c49d597e93cd1620d9375261f4
- SSDEEP 768:yzqmpksNwLR7DjviDX7k/QNBwwtQ5RlPvRXvkU9OO:yzqmSR7DjviDXQ/QNpW5Rvr
- TLSH T13CE2A23FC3781CBB89B48053A4A51D92FD98479F8218751FF039536C1FBA068DED69A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\pt-BR.json
- Size 33KB
- SHA256 f7f11da778180af4830c04921c4d28afda99fb65448dfac952cb103c1581e0c7
- MD5 9fcfb23dd0be86584124ca1cf838a4fe
- SHA1 7a2735b83b0b246dc07404790ed898be0fe19894
- SHA512 c5d84091ff7ad6a42c851c49b39ec3284f2a0f5399bb89c7db56cc363bc962afa72c02088c3c56a586669e906905e66d6865798de0116b87f3ecf252d3eaf691
- SSDEEP 768:K6m7CiYM6U69zvegKs1qYs+5CRX72rL6YIpYEyAaWxM2HXVs:K6m7CiRSzvegKs1qYs+5CRXxY3WxFHFs
- TLSH T156F2C53FC7A41EF799B0420386621E82FDC80B5F260CA85FF27A635E1FBA950D8C5565
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\pt.json
- Size 32KB
- SHA256 63563e1af11709cefc8efe8e23d28a21239093b87bc64e9ff8efc48c2122ebb8
- MD5 12e83e4eafbb0984f16b2f10ff74c721
- SHA1 873052a2c5c23469718f81f83d6a58b0520cecd2
- SHA512 241ba15c7da8f76626e800f5ab35f471db2b9342cb040193a3fa9cdfcb3f90f2f5a4048d96f713679caf3bfe7c2e7be09ba907da45efff612339dbcea028b206
- SSDEEP 768:hL8merhgtnnv/QvP8LpBN1wtQ5RpPFRXvk99OO:hL8melgtnnv/QvELpBN+W53vs
- TLSH T145E2C43FD7641CFB89B04143A0A51D92FDD447AF4218A95FF138536C1FBA468EEC68A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\ru.json
- Size 35KB
- SHA256 7ad47f58d9b1595115e2e3c7ef798bd8a891c3f0a671a9b6c00c687cb3bb3845
- MD5 3a8ba6331580c68bdba6f7e2d2d84500
- SHA1 eead29842f273df12a492777d3cbae9e401411ca
- SHA512 29412fd37a6db728248217dd99ab75add28f69c7f0b03f25b3cf02a154f9427206f7dd162bd41ea9b5ae203c4237a00429686f6f87a9e5319e04b4381c7b1de5
- SSDEEP 768:lpRQmrR3NRyIOMXN2LSqa/wZNwwtQ5RxPiRXvk49OO:lpRQmV3NRyIOMXN2Lra/wZNzW5Uvh
- TLSH T1B7F2E93BC3686CFB89B2900394646D86FC9507BF1B1D765FB0382B6D1FBA024C9D9562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\sr.json
- Size 41KB
- SHA256 a15786e914ada4b923c316e1c568680d2f64f9b43c8b36e69b043eb84d39b8cb
- MD5 002d5ecc748969eb65f58e818fabba8a
- SHA1 b47f94954ab6c585e185095889e46ab9b7316de7
- SHA512 9874b7cac40de94e244adee3c0464f43382734022d6aed97d299221586fcf0571c636dbccbe3083813926ab80e148fae96c948d7554f393f2408f0b5bc79bf36
- SSDEEP 768:4mgeSh6wXeEqw4/KYJ38yuKL167oAFNtbyWEFD:4maeEqF/BJ38xKGtmWI
- TLSH T147139877C76818F78022A407D8107D8ABCD943BF2B5A621BB1303A6D3FFD0748AD955A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\th.json
- Size 37KB
- SHA256 bc23e5488d338313e9e1ba8a3839b8c2025cf5c6800cfb49c9ca4e8b614bad50
- MD5 51dfd8168c899dd6d305676b45ad6472
- SHA1 068fa254e767a42fa218e3f7e12d7b419e1cb943
- SHA512 18b5394cde7e0a68422f965de62ee531cc524a5ea3ee2831e485214ca3c643d698acdba01325603e6b530fd2158b30424c0e9f75e5f054b8edc94678f1e50564
- SSDEEP 768:Sxg7m+5y5Yh7CsiLSh5oPMkfOqMyKbQz5yB5B8UhUHLvM45qyJKXVarLl5wxh5Ci:Fm+sE8EN+HLcErLlyxhgrxk0HA83NRWx
- TLSH T18203E93BE2245CBBA8B40503A0293E82FD945B5F2729B4DBF078175D5FF5728C891DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\tr.json
- Size 33KB
- SHA256 5396c500d2319aca440465749507a5ebf6fcefce646cf97be7a1235177246b5a
- MD5 b1ce0a0e07fceeb5fa7aed3da39c362d
- SHA1 720dfe63bd926c94aed2d337110cb04206ddbafd
- SHA512 8821dd1a8b07563c643dd00463eb1051b23034b001c22d05a9ea79c6b47174f54c55ded77b3326aa5fad47d8cd4406bbe6ce66cefa9e15c4724b7a4b7532759a
- SSDEEP 768:1mAwhvoF69EJDsUrioXY2qOGbLX99JmxF3L7MFJY:1mtoF69EJ4UGYGbb9XkF3XgJY
- TLSH T17AE2F87FC6391CBBD9B41147A0605E92FCCA0B5F6228B81FF539536D2FBA460C8C6925
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\vi.json
- Size 33KB
- SHA256 96eebad3ca7a68dd19b2891707c685f974b11afc5860a37b718c84b010057e08
- MD5 f405c8efd5490d53c351279aeadfd7e9
- SHA1 6a77502dbcf4736b11d174d69bc3f5689675644f
- SHA512 993b3270bb741034e3eed280e4f0f225b1de717f4e6917c6ad2777294bf6cc8b66afe450a1944e53ea2b9e23e1b9c111bdeaa6f7687a8d4f2fba9280f24b2446
- SSDEEP 768:XLpmk/XAn8Avzpjj9/ztOGlt1tEGHy8hXNZwtQ5RnPFiRXvk19OO:XLpmk/FAvzBj9/ztOGlXGGS8hXNaW5YA
- TLSH T199E2E73FC3B45CBB89B4401390A91C82FED44B6F9258786FF178576C0F7A464AEC59A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\zh-CN.json
- Size 31KB
- SHA256 716edc381c3648e8d59012d7a42ede75cc8bf750cdaabb370efc33e21c7f564a
- MD5 2938188b0dc83655244e86f6054c7d24
- SHA1 0058a3cbfbbb7964c975be8be2f8222da9751abc
- SHA512 37635a07bb4f6ab692930062788b7262b3a0b3dfa12b0d1e426c7a600ba02a00f70642dd3a8e483bb9e9ef01b739ebfeec02791a0e87c94d57bf41107e3acee7
- SSDEEP 768:KmKzW2ZZQbZgdGn7kF3jrrNywtQ5RAP9RXvkC9OO:KmKi2ZZQtSaurrN9W5Avn
- TLSH T14CE2C43FC3681CFB88B08043A0A46D92FD94075F9229791FF039576C1F7A868DDD69A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\scooby\launcher\language\zh-TW.json
- Size 30KB
- SHA256 06756e9961b0bde93c4cba2fa7337a87de7bb2d53fd379ecc9485395afab0476
- MD5 4e52e65f4cb59ef77fcd9fc9267d38e1
- SHA1 a3b052043085c01e963eecf8b9afdbf9c1cbb973
- SHA512 91f1ba332c976dbfeb432db59c024bee78670d192206a46558572ea77ad05124ccec1152ba7f5c41a25f5549574a1c7571101b6cfd3b50b652971cdea409f516
- SSDEEP 768:a3mLw/BOImL0K4pVgW3yur02Srs6eKMeBoG2dPOrH7bIcve2gCvo950+81O:a3mhL0KkVgWCaNeBoForOh5k1O
- TLSH T168D2B3BFC6A82EEBD870545385A50D82FCC01B6F0A2C785FF179176C5FB9862CD806A5
- MD5 SHA1 SHA512 SSDEEP TLSH