69aff30efbbec2fff7e7c25836cf6e45940b1a75d8f69d32f86a92d2ad106af1

Resubmissions

24/10/2026, 03:23

261024-dxsa6awy6k

24/10/2026, 02:44

261024-c8mdls11fs7

Sharing

Copy URL Twitter E-mail

General

Target
Kavro-Setup-1.1.0.exe
Size 116.1MB
Sample261024-c8mdls11fs
SHA256 69aff30efbbec2fff7e7c25836cf6e45940b1a75d8f69d32f86a92d2ad106af1
MD5 90006dfef17418d5ed04a76850069e50
SHA1 1f6822daf3367fcc0aa1fbc71b26658d09b06088
SHA512 eeeeefa348a15e87d24c18ad6eafe803a2134d304c37d911c38e8265a77fb26b204938773b73eb9868f4a8d6cb69fbed4400b7d060337c7a507e503485b53204
SSDEEP 3145728:tBuSLrrcGeOzWw7BMwnu3MpRK/fo4ZF869PcbHxIZB:7usr4GJW8awnu8pRIf9UE
TLSH
T1D04833BC1289D05FF65105F3608EE4BD2B35479FCE7B784B22E7E2AD560581A3E6102B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Kavro-Setup-1.1.0.exe
- Size 116.1MB
- SHA256 69aff30efbbec2fff7e7c25836cf6e45940b1a75d8f69d32f86a92d2ad106af1
- MD5 90006dfef17418d5ed04a76850069e50
- SHA1 1f6822daf3367fcc0aa1fbc71b26658d09b06088
- SHA512 eeeeefa348a15e87d24c18ad6eafe803a2134d304c37d911c38e8265a77fb26b204938773b73eb9868f4a8d6cb69fbed4400b7d060337c7a507e503485b53204
- SSDEEP 3145728:tBuSLrrcGeOzWw7BMwnu3MpRK/fo4ZF869PcbHxIZB:7usr4GJW8awnu8pRIf9UE
- TLSH
  T1D04833BC1289D05FF65105F3608EE4BD2B35479FCE7B784B22E7E2AD560581A3E6102B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Kavro.exe
- Size 234.5MB
- SHA256 37460d3da5faae3f122d73ff387176cb004ae7dd232bbf32df2e802b180f0da1
- MD5 f9aafeb74574f6ddf973e22e6e7ea2f3
- SHA1 6a871b9f2b9ac9344cd14a18483cb4a66324cdd5
- SHA512 f7ae5bdde67733b914a425ac5e45c6093680eeae063edf69ae2898952ffc77a13d435231b9ca33e14a47c86ea771ad0c96d664687c6f471437803e5fd4120482
- SSDEEP 1572864:CwPmdrVo3J6pfgISGp987FtNQk/eQrFPe23CMJfWXu+v/MWksl1E9UIBIiW93QJa:zSrKZipp9g7U4ETk
- TLSH
  T19EC88C03F2A641D9C05DD1798B5A9633FEB1B8054B24A3DF2B5407962F66EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral11
- Target
  LICENSES.chromium.html
- Size 19.5MB
- SHA256 7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70
- MD5 142cea93256b2b7824b854c62af026e6
- SHA1 265c66c606344122b35f20c68086890017a75505
- SHA512 82c7f1c6f17ba0af42ad552062db614bca8cbb6c317a456d15c6199f11b031decf2c0816770b0004326830899264a5640796d1333c524979f9dfcf64d7b57fee
- SSDEEP 49152:ZehWCrdOOoVo5TYp2xnuCQpc3txsJM+QAFId+wi4WMEAccr:y
- TLSH
  T16E27B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.6MB
- SHA256 0c7a5fab6466c211fe39d90d845b7d6a64ac73e8c809d4fa0c09907bb45c1f3d
- MD5 b0548e61db479d85539e6735aa43ee18
- SHA1 4c7f933b9c1c771ce3431e3fec6f920ac9050dad
- SHA512 69c2d5a35896dc7ef54ccbd96481700a0d71c087a56953fea9a73ee30b4b29a2ec168cdcd30412f2fd78ce49743a2afdaf066aa966e9b016b6f01f02a73acbd3
- SSDEEP 393216:b/fXIxm4PkG4kPyaD/oOG2UfRkZXbdqd8hA6U:bCmaAO12RgrdqOAd
- TLSH
  T14B4729122646D49CC099C879C7678B268A2C30E73FA7B9DFC0F461252B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 7728490eb079c19b17baeff2b6590c976f6a928b3c17923aeb4fcf1f1f31d299
- MD5 6ea5d026d320e2ea52c4e9e5cdb883fb
- SHA1 83f080026a25745e0161443c8bf80d8052bf1415
- SHA512 4a232d6078325090de16800bbbf521029ca108187f9e49c02e4a6c97a74ea69835fb2f1012ec40eb3f84518e04b047c46f15b64b4e173ce8b99a9db3ee6c2d57
- SSDEEP 49152:pagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPkuf0E6OOlz2u1:pJ1lS0ZcoAs9HaLu8he
- TLSH
  T103E5AE02F6D251EDD019C03497AF9213F271780A8F205AEF17A05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  resources/updater/KavroUpdate.exe
- Size 602KB
- SHA256 62d3d9379badb8bbaf92c0c3785a7e6c1100bb13b3d2b93af59b2c2cdced965e
- MD5 19c903b5ee32b12af41452ec95e549d2
- SHA1 6c42e851a358590de1f6a56a37334a4829be8ba4
- SHA512 31e2fd59ed032b91b934e43fae8d86ae0b131ee5f7a0218f10fa7aa34dffdf1b2472b8c0fcd36adcd089591569a159d67130376e9c0ef32fba75a7e45b9dd82a
- SSDEEP 12288:NulID08MMaQoGCM9hy7StfOvle0ediO0n+VxYK3igCBFOPFmuz7Hs6e:rD0RVM987SkvNeIgH3iggMNms7HB
- TLSH
  T133D4D0C4B3A14CEAEA67553D8A51C501DA337C060B70DADF53A05A9B5E33AD09D3EB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 3d8555de997bca1e58a72c6a8bc13a8267dca2c882ee0a783803470b289d1d23
- MD5 f46154ed293b5ed031312c3fef27138e
- SHA1 6d3d5e61e08aef1d9a3658e8471cdc233e1b81cb
- SHA512 8908df2f50d3d707ef09bf881c94f9ed375379e404098bbf269095f645ffdd4010e16fdfed72553db09fadc62e16824dc4eae0d0ae6aa68e574857eded1c6f5c
- SSDEEP 49152:o8bFjaGwMVhX4X6t+LsctbWjRIWHyQ1TKhwI+A3O/rrlfelrVeMsnNBnyoxmohPY:o8bFTwQWUUKG7V
- TLSH
  T1D3464903F69681D9C06DE6798B5FA623F631F8800B2276DF56A00F192E66FE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 5549afe706236d5c7ad5df4607c51639c790dfd118770eb27af8f2c5c076c3c7
- MD5 99c5850794a0006d80306d01e8f64060
- SHA1 3fcaf46c6dd67942e6b20e31d2fb97fd8a9b0e33
- SHA512 e489d01cd2cf9eef1cfeecd2f3a04c4c1120f87713b40137cb3af547b04e6d0278c758e62b028e914324f00899718b1463e2e5da631233d2f28d46e235a4a837
- SSDEEP 24576:BHzMfR00pJ8YRlEcqX0GoJyKqPHrKNlC1E+Dkw7+DQ6g3v0TAE7yoeHYV:1zMfRbX8aluo8KqTKNlC1E+Dkw7+DQ6N
- TLSH
  T15D156D6396948AB9D6768034DDD28A0389F174811322BACF03B41714BF5EFF46B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $R0/Uninstall Kavro.exe
- Size 327KB
- SHA256 51c4d12703878d29fdf47e5724d5b51ef37f7c190841f727d582f2d6253a6dae
- MD5 bb596697018539e7522e02157c586cf8
- SHA1 136ae05fb10143d919826b70c8b6d5c8c5215a40
- SHA512 a3325db2f03ac460cdcd691ba6ac5792eae5b08a0c69fd0f34310dce0f577206cf315d754d56ed976ebd8ff8900489b18160eb425ce5c4468e854c895d15ac1e
- SSDEEP 6144:s740IR7SWiflWJC+lNV97+M9hp7IedgrfWCd2CaQ1W++0tUa8T2t0EyL+m7aF:Ok7StfOvlQM9hp0ediOC1aLaCLRKmuF
- TLSH
  T17864E0D072A0C81ED9A4197247ADD6E605BBBD0B1F342B8373D0BF8F3971969881E953
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

Network Service Discovery

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32