c22e2246a2d155f594c5ef4f79ad24c3feb2171e8d7b695e8421fa138d5a9702

Resubmissions

15/10/2026, 16:50

261015-vcpszatx2l5

15/10/2026, 15:19

261015-sql8wshv4l5

Sharing

Copy URL Twitter E-mail

General

Target
ReclaimingtheLost-DEMO-pc.zip
Size 414.9MB
Sample261015-sql8wshv4l
SHA256 c22e2246a2d155f594c5ef4f79ad24c3feb2171e8d7b695e8421fa138d5a9702
MD5 7d7c140769e3cbe377043b18ecdb42d0
SHA1 26c7fdfcd9063e9654afd85b4a46a0325f32e2dd
SHA512 c09ac6825129c06c4819c06d7286c66f58f6dc46fcb50c7aabf2416a58ef6d67f8ffb86cfe33b83344da58bc356a2ea01298511bc1a31207ef6edbca987f4e27
SSDEEP 6291456:W1dOUCbyKxUbZeCiqFazrdYTxHrD5FplELmMf3PB2WoLWYlpV9JJLq/RrH0Qheg6:K4iZpa3dexLD5FpiLl27x7ub0qeg6
TLSH
T1CF293391D8CD6A48F11B973193D4751292D67EC223FCB9AF1FA5EBD266CA4C044BA303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  ReclaimingtheLost-DEMO-pc/game/dynamic_transforms.py
- Size 1KB
- SHA256 5b0cbe26384129c1b4a3dc4811e7ef3e5cc8bbdcf119c4012dce6079ab3d9763
- MD5 12f31e1beb252b2ccef1e9224e6a4827
- SHA1 d23d1162e753917bf5dde625fb99243cdedbe23d
- SHA512 9d07a445777222bd0711dbf96b7068ac231d5fbb65962285a4139b48515928a3ff518624f2b07661216b932fa805a4de29cca5ca970b63d57f6a6fa6107ef859
- TLSH
  T1AB21F0B00D0BA8174131D62FD5094E0BF56B606F17CD47F535BC68372F358104B6969D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/ReclaimingtheLost
- Size 5KB
- SHA256 3e450f4e703fcee6894d3d3e3f67962b3ac3f2c5813b8e8391bb4fd1a008972f
- MD5 abc9051c978a745154aff7bc25539210
- SHA1 24c3a3a26fc9a7fd0621b7a47c480294a3103a13
- SHA512 178ec979160e4e1dad34dafb6801751350fb7816448b7b58b5ae2e1ed397630de2be67769e52443a6f02c88892031a42f6c6bd43c4a463b9545338428afc928e
- SSDEEP 96:RI+TsnMBWBPUtsMR0wn+045Vg4Em0RVY5A:R7V8pUts++7i4
- TLSH
  T13EB1112AF3A2CD7FD8A883745057073873B1AD50231207A31746B2723D673EC5B266DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

antivm discovery
behavioral3
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/librenpython.so
- Size 30.2MB
- SHA256 87cb03d908db9306d7cc48c4fe90bfb29cdc8ef3b988fcf16163dc0e731e646d
- MD5 532a9b45eb2685b2f397ef1e69bfdb56
- SHA1 92cfedc0fc037caa493d007936f0cd3fb16c67d5
- SHA512 2b28c753cf8e7e8746096a3fa32aff1cca64b4b4d00f3472fef7b06d05e81c4225799a81c94115f42b72611a787f38f7ddb51e541169e043ea81bca4a1f69b1c
- SSDEEP 393216:8v3uFJeNCPwXMf0YOZNQlNh75rSSIVG8LYFn71:Zr4SuLYFn71
- TLSH
  T19E677E07B4A214ADCD76C830CE6EA532B764BC4D41726BAB31D4B7603F75A90AF19F84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/python
- Size 5KB
- SHA256 3c975a73f3b41dd8d7a9e11a06ca71dc837fe66dbc037dbd9c0fcb7ac2737f32
- MD5 0181eca7e85eee28a519281383ccae9b
- SHA1 15305851154ca401f9fc47ed97c86d6f5593e601
- SHA512 b17d9f2e6774cea978d1f7b3523f2d559a7978f88ebc3360c75edc3bf0288c39adaa7fd8ac5668d7aed1bedbb0a5a180e9029cac003c105d2955f41d22ca8b5d
- SSDEEP 96:RI+T9nMBWBPzlsMR0wn+04Ug4E30RVY5A:R7+8pzls++74
- TLSH
  T1FCB1022AF3A2DD7FD8A843744057073873B1AD5163120BA31746B2723D673EC5B2A6DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/pythonw
- Size 5KB
- SHA256 3c975a73f3b41dd8d7a9e11a06ca71dc837fe66dbc037dbd9c0fcb7ac2737f32
- MD5 0181eca7e85eee28a519281383ccae9b
- SHA1 15305851154ca401f9fc47ed97c86d6f5593e601
- SHA512 b17d9f2e6774cea978d1f7b3523f2d559a7978f88ebc3360c75edc3bf0288c39adaa7fd8ac5668d7aed1bedbb0a5a180e9029cac003c105d2955f41d22ca8b5d
- SSDEEP 96:RI+T9nMBWBPzlsMR0wn+04Ug4E30RVY5A:R7+8pzls++74
- TLSH
  T1FCB1022AF3A2DD7FD8A843744057073873B1AD5163120BA31746B2723D673EC5B2A6DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/zsync
- Size 103KB
- SHA256 6562531bd39b70069330256022e260290a63581d0b5deab3ebeb0884312c670d
- MD5 9be4eedf223aa6ab685557e725dbab10
- SHA1 a1aa65510eed951f6247470355277016de8e764b
- SHA512 3c5be775862a0b88784d0c157fb09e33fd9af2f03c9b5a9f9876cfc8b207757ed2aa20b67c57e477eeefd46d1418e5ff38a46a7d748ebe4cbd2c69f0eebfad76
- SSDEEP 1536:kXUcIOiL/a36A0ItFH++bMccub3QqMhS7+NrKjwsVPGoP/GExbn:UUSimqEtbwcPLQqMhYJjlP/GE
- TLSH
  T12CA38D477AB214ADCEF5C935879F412AF7B0B041A3125B6B4348E6343F46B285F1EB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/zsyncmake
- Size 102KB
- SHA256 427fe463bb5757e8364d10cb2639f767fef0d82bf67a35387481d55f1bd63e5c
- MD5 1d0fedb3c725a1a26bcc9733555dc64d
- SHA1 91e34353d192c57b4df66cb6e8e71e82c4845879
- SHA512 b1adfa55693f546b210f793dcb48857200d0abe7f61070f67e37eca022c1beef62414ee704fdadb0b692282e6204d53075bd5fe98aed0066470307ca2e0dc060
- SSDEEP 1536:G6IOiL/a36A0ItFH+YxQOdFZihq+3wPMP1oP/WEKuI7hpqNCWlSmo:JimqEtZxQ0zihq+3eP/WE67hp
- TLSH
  T1D9A38E4279A2216DC9F5C9358DDF4226E778B440D6165BABA388E7303F01B281F4DFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libEGL.dll
- Size 436KB
- SHA256 b20c1e14e42da55c13dad3c23a5060ca086eaf5b18b12ef5c60cd7e80276a9f2
- MD5 1090bf4c5495697a1416cd77481cf7d0
- SHA1 94452eed4fa88dcb0a5b3c503a12f3a3b5f23ee8
- SHA512 d205dd98260d033300afe3f2a1c0c06f3bfbf158067fc3290e10ddf6f51eb80b57af56fb0e75a56b82dc3ec49190c5d2c296aa548b64e39b4b004f60a7da89a6
- SSDEEP 6144:CrHQz/GL44uCWgSqTpyGRxyB5EdpmMB6cm+p4HRw0FlA1Qu4P:uudhGDyB5Xa4HRw0FlCQ
- TLSH
  T182947C29B2A448A9D036C038CA174A72DB31B89A0F75F7DF12E5D2692F773D45B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libGLESv2.dll
- Size 6.3MB
- SHA256 2d171e91e1fe7205b76dd69ba9f7ddce7910283a5a5111c09c84f5db8c795a74
- MD5 7dde909bd5c7538ac46064741a8da6c0
- SHA1 46b50003be83eab7e0c48ebbd9260b5b021e70eb
- SHA512 a057586a0b566c5470a6508e27764f9662ceaf3b08244c3db3d1e07789e87a30a43f1daad0274a4e3d00b641d3f9f90e9c073a5f7db3fa6d1de7f45c33adc092
- SSDEEP 98304:1DACC5v8sHfvlfkvghk3xlkihzsfFUQOJt6c:CvxkvgfyoiQOR
- TLSH
  T1BD665917F2A281E9C009C135574B9632EB31BC851734BADF2294F6692FB27E06B3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libpython3.9.dll
- Size 8.3MB
- SHA256 b3d612f89df65b43f235f9f5471d2fac364b6fe77a88205e5b8625f3481b6c3c
- MD5 63c3f6560248ea6e177df61484a234bf
- SHA1 c13871bad3e469092134719eb5f5074777505548
- SHA512 cb1cae66255429f49ded93cd7aed5405aa20f20fcc0ed62441f92957ae928c44c4748848df8b991b2a1535983082b599389f74d0a110fee18b48f77daad35d19
- SSDEEP 98304:lIJbP/eIyeXZ6SbBcaL6vO9eDxY6XO7dPlMBLa2THxM/UZ1c4fv3+opm9g0vHF6:qJDegpBEOBR/34fv3+opm9g0vHF
- TLSH
  T199967C23B19150EDD93AC13192975233BBB5BC501B21BBDB2154B7702F72B911FAEB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/librenpython.dll
- Size 20.8MB
- SHA256 6cf21313d2a45c908c3afd86516c348f36fce7836617382c1ca967a1a71be779
- MD5 78b30211ee85aacd05c7322cef48d7ad
- SHA1 d299b6ebdf757fc7b1f25f8210bb3ed97c20ab32
- SHA512 7f4ad96c7801dfcd9a654978b724934aa8c40e6ad21924a9c0db68a55e4c3b669e9cebaea465b811712ba3e5872162423861ecb2c74770370001edb3042e8b71
- SSDEEP 196608:f05Dolsx6gj6xVeyf88Bly/70bWUaGDn09pxabd4e0:85DolM6gj6Ley0x/I/Dnwpxw0
- TLSH
  T139277C4BF05254ACC586D174CE2BEB22FBA5784C4672799F329457B03F61BC0AB2AF44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libwinpthread-1.dll
- Size 344KB
- SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
- MD5 da67da022bbc1bb9409e3328c1cb64e1
- SHA1 e1fd29f4256d7066f05d113cb8e96e1aebaa38e7
- SHA512 24ba4936ff149f0875b3e4c7e36e80f941130faccd4d6296d68c8af8b0e647c37d0822d477218ab0b3d4b51f24cd1dfa1ace54adfbd175d122036c3a7e787ebf
- SSDEEP 6144:Wo14rtZLc1fPm3YjZxgMOKSjkPDNjYBlplydMofn6cHqq85l:Wo14r/cBPm3Yg8SjoYvplydMofRHqq85
- TLSH
  T1E4744B8BE754DA7ACA1146318CBB0B097337D04067979F5BAB2CD2783D8BBC4DD99608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/nvdrs.dll
- Size 14KB
- SHA256 0c2f259c6a1588a2ed6e00b5dd471611c029bbc9fd3bcae01000e38882594fbc
- MD5 49fa278aa122678d71fefbb7ce89754b
- SHA1 71b346018938bcd823c7ac739645ca89b46197b2
- SHA512 acf53a2397af2539db1f73313058cdab3a1283f71e667eb54078b73c93ee757ecf5f35bfcde136cf3c709779bef9a8f9c12e5edefd0839784ff2fd47df6ea285
- SSDEEP 192:kKFj3Az2SjQ0bnUdPIPKPpCxeELcNiTw/dUfYa2GzEfw9vnQ:kKejQ07KPUKueELcNiM/dyDzCw9vQ
- TLSH
  T12962D6069B5524BEDE4AC17FC2771762FAA0B950076218C70331F2650E71FD4273D8AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 ceaa1c9d7b4c3c0e9131895e22f67bec1922d4525284da69d96b7a0800e62cd2
- MD5 eff1e93ae7724ea9b548cd98037a8eb7
- SHA1 5907d411728aa9a457d3a60d4814e6e6c89ac85b
- SHA512 9ff92f01476c42b7ed5494a89ddaaac514305688aab19e7e512c37fcd9716a25933aa6e0691c78421c2f31186eeb48afcc62385b55a45943d718bd83eea3fd8e
- SSDEEP 3072:CO03Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:DiQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T1C5A3F10AAF5616BED921403EEAA70562D7B0FB6223911CC71211A7311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 68322c355f202cbf4e04e2696c2f36b6a5d99488be931bf9645c71eabbc00037
- MD5 d6ef626e122d94f0a04f8ac1281d1be4
- SHA1 7b610ef344bbfda9ab2b59779b28e6780765a2e6
- SHA512 f172338c34592a6f18446462bff51f9bf96b666b45d99990ec00d15b005c955ea6535d1699a9cbaabd514b96a90ef891dada2e342edf839f3cbae523534f7a69
- SSDEEP 3072:1Om3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:4AQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T197A3F10AAF5615BED921403EEAA70562D7B0FB6223911CC71211A7311FB7FC1AD374BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/say.vbs
- Size 336B
- SHA256 b253baadc1fbdaffad5ea232080cc731c262779e8d256e8a57f7eb5a684a1640
- MD5 2bb7b68da76cd3be900723983a819069
- SHA1 8e3accc0203b203e514107f610cf4bca1a174434
- SHA512 674b3eb9b09fc8957a7a90239270bda61d6e7de14fe9df9a2a25ddda9f36e952046c7f5e755d56f81033157dd699d19c89a2b8940a30ab10d131baacff842e03
- TLSH
  T125E0260EAD22A2968012800314F5C45E4AD8E52BB20288CC3CBFD0E72F0AA07EE71840
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral26 behavioral27
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/zsync.exe
- Size 92KB
- SHA256 dbc39d1d4ddc8c744e7840a294f906920c532adc0dc9e69f7664a91b55b2ff77
- MD5 2e9d3dc697a2e1fc5c5be1f7e04508dd
- SHA1 0f72289874472de314aecefeb5457812f1c72481
- SHA512 d938a7d94c869b3b67c70d016b10c6a3c79fc3e928f3471a829b925041feb192f2f4d77993cd450d8246e0a4eec94f2275fd44ffbb931e15a5f9e74624dc0d16
- SSDEEP 1536:/9yPhoPyrELhNx4xKM87bsp9G8e5VuSYJadGo7/TjX3DvrnAvp3ITPvsXXlgpoIW:KEL+kM87QpRKuSGI/TjX3DvrnAvp3ITn
- TLSH
  T1CB934A89FAC75AF6ED77097044D2F27F8730E601C414CE92D748DE8AE973962281A6CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/zsyncmake.exe
- Size 91KB
- SHA256 bb9c90f996a54a6c697f41a7897eb924e90e18a07746b612bcb5e034892f260f
- MD5 ac2119ef9d738e1a3b7f83c40616a238
- SHA1 d3f4e1675e39318e3ad9fa62b1144da637617234
- SHA512 f1274568f646ed807e01268f01407349f4b7d3be3ddc5bea29d44bc260847e6a45017809406632f65fbca25d3c7a96438356bf41b3c71f0f9360e85fd091ada5
- SSDEEP 1536:4bjZoLhn7LOuW35VgkJFNqGTfJUM8EoqUxvr7fYnPHv3jz/jDnTnbPr7Hf/TLzAJ:4/eLpW/gS/BUM8EIvr7fYnPHv3jz/jDo
- TLSH
  T19B935B4AFACB8AF2DD77493084D7E27F5B30E100C514DE9BE388DA46E913932591A3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  ReclaimingtheLost-DEMO-pc/lib/python3.9/__future__.pyc
- Size 4KB
- SHA256 58e9d4577a45e253caf95fee0d446581b0caf0a3d3b08f4ab09868c56e53d264
- MD5 08d42ce57d4c079f976050586d0d44bc
- SHA1 d22d35f0a1d95ffbfda38385ba64b2686eeb159f
- SHA512 ea428d0e6240337bc30e4110481b955db2deee23a3afa981f894dd13c3cb0194def39f60572fd549f1882521e02ed44d98448f86f718706f5d5a488f9b405376
- SSDEEP 96:Sg1NzUuGd+P2sKNwW8D2j82xnCg8Q/Ks/qN+Bj0ui:n4BRd8D1YCM/KsSN+Bj0ui
- TLSH
  T19D81750A69454AAFFA06F2F2A2C951C14F59C3BD2F94603A355C52443FC38A2937B89A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32