0736f8148c8f889813cf00dbc90fc3029ece508af58d99018498066d20725e51 | Triage™

Login
Reports

Overview

overview

5

Static

static

3

bundle/dum...LL.dll

windows10-2004-x64

5

bundle/dum...LL.dll

windows11-ltsc_2024-x64

5

bundle/dum....x.dll

windows10-2004-x64

3

bundle/dum....x.dll

windows11-ltsc_2024-x64

3

bundle/dum...ct.dll

windows10-2004-x64

5

bundle/dum...ct.dll

windows11-ltsc_2024-x64

5

bundle/dum...v1.dll

windows10-2004-x64

5

bundle/dum...v1.dll

windows11-ltsc_2024-x64

5

bundle/dum...ee.exe

windows10-2004-x64

3

bundle/dum...ee.exe

windows11-ltsc_2024-x64

3

ScyllaToIm...m1.vbs

windows10-2004-x64

5

ScyllaToIm...m1.vbs

windows11-ltsc_2024-x64

5

ScyllaToIm...er.vbs

windows10-2004-x64

5

ScyllaToIm...er.vbs

windows11-ltsc_2024-x64

5

ScyllaToIm...es.vbs

windows10-2004-x64

5

ScyllaToIm...es.vbs

windows11-ltsc_2024-x64

5

bundle/dum...64.dll

windows10-2004-x64

1

bundle/dum...64.dll

windows11-ltsc_2024-x64

1

bundle/dum...64.exe

windows10-2004-x64

1

bundle/dum...64.exe

windows11-ltsc_2024-x64

1

bundle/dum...86.dll

windows10-2004-x64

3

bundle/dum...86.dll

windows11-ltsc_2024-x64

3

bundle/dum...86.exe

windows10-2004-x64

3

bundle/dum...86.exe

windows11-ltsc_2024-x64

3

bundle/eon.exe

windows10-2004-x64

5

bundle/eon.exe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

Target
bundle.zip
Size 20.7MB
Sample261024-xtfbzaby4w
SHA256 0736f8148c8f889813cf00dbc90fc3029ece508af58d99018498066d20725e51
MD5 096465e71f5d8e776cbc17ef68e97ad2
SHA1 64cf44925633c8295e9868af5f19e580a7ccb895
SHA512 bba8d07061c46b3d4476372d2b7262f0e3b9552bd5f3c077b8504154f145a30ca38fe1305bba2f731e9913cd822b3dd479d3aaabbd4d9d4d5af77f46d9bfb7e2
SSDEEP 393216:cP56wh+42VHzd04O/XVJQ+JMpiiodXGF0zbpwkWarrgtCbPN7cp:cB6ghyHp04Kcg0i5NGwak/rgoJ8
TLSH
T18F2733801DDC2C94D706B5181C99EEAAB79FA369353872477F4D28AC86D6801C2FDD2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery execution

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

bundle/dumper/Plugins/PECompact.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

bundle/dumper/Plugins/PECompact.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

bundle/dumper/Plugins/PESpin_x64_v1.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

bundle/dumper/Plugins/PESpin_x64_v1.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

bundle/dumper/Plugins/ScyllaToImprecTree.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

bundle/dumper/Plugins/ScyllaToImprecTree.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

ScyllaToImprecTree/Form1.vbs

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

ScyllaToImprecTree/Form1.vbs

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

ScyllaToImprecTree/Properties/Resources.Designer.vbs

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

ScyllaToImprecTree/Properties/Resources.Designer.vbs

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

ScyllaToImprecTree/Properties/Resources.vbs

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

ScyllaToImprecTree/Properties/Resources.vbs

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

bundle/dumper/Scylla_x64.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

bundle/dumper/Scylla_x64.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

bundle/dumper/Scylla_x64.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

bundle/dumper/Scylla_x64.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

bundle/dumper/Scylla_x86.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

bundle/dumper/Scylla_x86.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

bundle/dumper/Scylla_x86.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

bundle/dumper/Scylla_x86.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral25

Sample

bundle/eon.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

defense_evasion

Behavioral task

behavioral26

Sample

bundle/eon.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

defense_evasion

Malware Config

Targets

- Target
  bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll
- Size 34KB
- SHA256 6a51a7e5ce252e01643f6e6d96a4eb15ed162f615a569f1fad157dfced6ffe2b
- MD5 1e4c916c141ce64143cc03d68f340e62
- SHA1 aa3746e5c381b0b9f70fe88d208a7d50f88b060b
- SHA512 c394dcb87c851b7089a1dea56c97de74f7f9642474313aa410f2403b2db33bcded25a3797f5078beab0864489a6ed91b3947e6447f5935641ef5d0489c455ade
- SSDEEP 384:VgsHIA+xpYd8NHGgyvNfUztd9cWcSKfOphwtlwM+1nu6EDHpC676J01wNgvySXmq:V3IPryxUZdylghovmnTEDAJKvySeop
- TLSH
  T1B3F22A02B69180B7E26E2A3418B996625D7F7C417BF040CB3F9A16F95FB16C0E678317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll
- Size 1KB
- SHA256 17b5256499d88166833bd2ee98b242d23337659f45bdb9205d15ecb6b784f797
- MD5 117f1a000d87fd4356ae72f198806eac
- SHA1 1a0ce06b77e5da718f9c3653abefee337d365336
- SHA512 74f4a10abfb02ba037ef3b545d3bff774c79a75f9c8ea6d50a6967b60f9901a0b3b6e9b36cdc2c7b20b54a7a3324548327652b4dcb83db348fda24514522113f
- TLSH
  T1CB31AC2BD7550973CA091F748A83831DA1B7607116C1A0044BC499686C6968BFD71F22
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bundle/dumper/Plugins/PECompact.dll
- Size 33KB
- SHA256 cb358ad5b464dce7b102417dd3e14389e11b591593a62e3e1b80fa1c4453ecc9
- MD5 0111537a291bb6bf633f33ee41236f5b
- SHA1 5b4a19344e62e608fed7dc31a961d67b9733f9c4
- SHA512 f151e764e5f84d9e35cf0896d9f62643d5afdce7c56fd24fe993178f1cbe12d905cdeaa59a570511e20ada69e87db1280c5e8e61d1ba4c2e45d4789e52ac3290
- SSDEEP 384:NI4s0r/dwgGaSPbfu6UXSgcL8dXQrkhU80lHrpeu+1nu6EDHvlvo1/NqvyjsCH:z7SzfHU1cLWIkhDsZmnTED9vlvyIC
- TLSH
  T1F6E21A0172A184B7E1AA1A3458B5A2715D7F7C0167F040CF3F9A16BE5FB06D0EA7C366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  bundle/dumper/Plugins/PESpin_x64_v1.dll
- Size 40KB
- SHA256 e183ebb99dfc7a8d6a8de614158634b00a6527fa5ad440722c6b5cf0a1a43473
- MD5 e851afbadc38a673a7e7cbc232c8bef5
- SHA1 1db930e3f51a4b3e7fb1ffc0ecd543241d44e94d
- SHA512 7ec97409f3197676d19ca2bf5a231d3d1967a11f266adfb243b1f9f6fda43938bbe6e138342cac9a6ac05ee6b5a4d6a72233c1d21a9d6e32f81aa87f324b216b
- SSDEEP 768:bEEAODltRD4njn7oNj7TF0KTClxCTn5f+7nzggXjkDLEHY73uigN:bEEdDltKoFTFH6CTB+7zXMDa
- TLSH
  T166132A5A22B400B9E5634339CCF38E55E673F84663B5438F869882AE1FB37D65538732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  bundle/dumper/Plugins/ScyllaToImprecTree.exe
- Size 11KB
- SHA256 883ed0acadc4850439b9f35722b74ff930e39a93f4032c1bfa2a4ac7c9f33812
- MD5 4c70ceb0b6603ae30432a09c42404f1b
- SHA1 ad4d7551e01ea67d11748eb82f9bd8984b36eb28
- SHA512 51528b2ac44763468e46a367f45ade55dbb960fe8be14814d79e787ce1167289d894837ba4d24025529687f98f20071054b213d83f14929410dffecea2edb5bb
- SSDEEP 192:zD2RoZ5Z4b2q0fycIMBB6YSUVrGFuOlMkgyJsO:x5Z4qnRIY7VrGFflMkgyJF
- TLSH
  T1A9321A2637E89A33D97A4B721CB3914443B2B7564AB5E71E2CCA41CE5CB37184393F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  ScyllaToImprecTree/Form1.resx
- Size 5KB
- SHA256 4d3ee9059f5b98ab1806f6916ebea2a8c56023f8c63ddfd80b7378d27d1aa0f6
- MD5 96ba0a444d087ae06f32319ca4f0a3e4
- SHA1 e3e08973b3d47c1ad51ccb133315b6242e275f0f
- SHA512 571d4083c76428d8c3914b2bc1281cc79ed4603b5fe0e3e82ee58dad488fcfe7f797a45b0ea7f14841a2a100656f059c186b7338ce33beb910cdddbf9ee70cbb
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFC3qxdRMvDbu8KsrbEKAy202lUt:Zf+tLPfYnLvFVOiFQaUD7Ut
- TLSH
  T172C11E45B2D1ED260E93483CD65139847BA8923F0234AC94B4DC961E5F92B85A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  ScyllaToImprecTree/Properties/Resources.Designer.cs
- Size 2KB
- SHA256 81677e759573774859b115dc8ec383daa7242d73dd5dc4cd0f87bc57488b2eab
- MD5 4f086511f30b244cc110d4fa42cfb817
- SHA1 3276518e1f08cf1f92011448dc06fabb0c62c924
- SHA512 704e92b3038919ebdcf6148ec46d745ac0f7162dcbc1582d699b82aed875d3fa8f7f844c958e3f0393d494778446f0446e34d564b671d13a2737393b739039e7
- TLSH
  T1B45150F30FE9C5360815E59B4B01F851D7255223C22CE839F8AE42509FAE34143ED9BA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  ScyllaToImprecTree/Properties/Resources.resx
- Size 5KB
- SHA256 4e124f5a7694ffe813c60601b1b73c53e47536b1f1c0e798d4d55bfc2ca3774f
- MD5 c07716633f086d91759ae32a18996a1a
- SHA1 bf3383c20acf6e64ce49f120938456161e5f6cb9
- SHA512 c6ad0ec603ff69d2d1b787db9426f29d44ea1ba45cf1d2b7ec41cc2bd6d5c93af8d2299139cc1c5d10d56718f36daa37d544f8d5411fad91a72efc2e70454cdf
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFE3qxdRMvDTursrbLAy202W:Zf+tLPfYnLvFVOiFQaUR6
- TLSH
  T1E3B12045F2D5DD220AD3483CD64139847BA8923B4234AC94B4DC961E5F93F86A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  bundle/dumper/Scylla_x64.dll
- Size 507KB
- SHA256 183671a094a184f3bb22b893cbce8a77f4bbc3932d96a1113b7d93755ecca360
- MD5 7bd1b05fcef651cb71a401fb5954943d
- SHA1 d2c8a60e9bd14d85459519ef20ce3487e6270d82
- SHA512 aed6c7dffbcabe6062cabffeb904d017e7a15b3ca900279a902c8f09c7a0ef7e98795aaa05b4e38f38c694f407470f65327380f736f096595382b19f5ae6eb62
- SSDEEP 6144:dKsoPHO7OtFAlEYKvkmiV76xyGl4ImDkwGem/qzD/13tTykCnoIVRUt0dMkcwLSb:U3RtF41wmDkjSzWhnAmMkcwLv
- TLSH
  T1AAB47C59B7F808A9E077A13CCAA3C642F3B274550770D7CF5664967A2F23BE05A39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bundle/dumper/Scylla_x64.exe
- Size 500KB
- SHA256 47889e39785f0f50d6254ac29eceb2e5b39667eb74986e01d80b3042679f35d2
- MD5 9e6ecb3625b7ca4ffb2167958d9cdf72
- SHA1 8d8b8ae5d66101fe8b95182708506d90ea6cf471
- SHA512 716d2f9c3beec854f0e9598cd030d4ee0bc611cf19ea479d7f2468ad85440a4213f28745c4cf37ae85dcd5566ca9f14b9208efe2d3465ab4fe3e8c38bc716a98
- SSDEEP 6144:ojm7X2kYngdKc2jfiF6G1Nmbe40jVEUFlTHYkifA2O9d/ffdcEZUd4rQk:vAHdCmbeNjDYkzfV/Y
- TLSH
  T151B47C56F7E808E9E077A138CAA3C742E7B274540B70D7CF5668967A2F236E05D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bundle/dumper/Scylla_x86.dll
- Size 462KB
- SHA256 e21db48a70ed20fab35139e7919d9c1833d0728c33ec9d95802daf1571fcd12e
- MD5 738b9e4e29c12a8cc9c43e477c8940e4
- SHA1 fdfac85735242f90f5ebb0b5c4ae77d45499e916
- SHA512 b00456e830d4e18f3052b78bda7826f62cc231c34fb09e6490475d2720ec82d90d43641f0740ad87d4d26929bc8ec3b08748da8433c19aa1ed16bf5cc403604f
- SSDEEP 12288:dAgJHfZPW2qmAvztIAZDdpm2x/12lwjAHMB4F:dsztIAS2SlwjAHMB4
- TLSH
  T149A49D31B681C077E4EB013099BEDBBA657DB661172982C7F38809AF5E642D12F3474B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  bundle/dumper/Scylla_x86.exe
- Size 457KB
- SHA256 4b49b0827f447d8d272c4f118c7c0afd2c786c12751e8e6e32e8477586afcc75
- MD5 3cf24b68ce13aac31a2808bab6a805ea
- SHA1 0bd75d62fb43cb5e3039fb5ae4c4e09a6841372c
- SHA512 85f169eefbc340dbe6b3b949c4ecde7df6db1cd408f546723901f2a4b6144da83c5b23e3c5eee63157ada09538f0b7520ca42cb5a41fecbb4147dcf5c20077df
- SSDEEP 12288:g0QsSmAKgxCk5IPYOVhJUInmB0kwKyI6t2CtOjpcoPa:g0CyjJUIw0kwK5hjpco
- TLSH
  T103A48D31B791C032E1E312708DBEDB79A57EB2611B2685C773C40EAE5EA42E16E35347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  bundle/eon.exe
- Size 23.0MB
- SHA256 5732c8c276a56e3be14681104c173da854bcdf75affcc6ef5b50e5127e07e35c
- MD5 1261b4f0888e4128f2b3bfebca4c5baa
- SHA1 a259ae1fd90717599bd73d7807c355722a0211d6
- SHA512 9808051c4471c53b56b0c1fe7467e62bb80791d7be204294c3ab2bed5b93eda899e8d497bb0c3a99d6e66e1dd3a628235d1f7994ebe353f75b7a8503171687d2
- SSDEEP 393216:MYw7K3TDkGYrJtX6816vGwgLdYRAzFFAmmTFpAgeNcXRXS:MYKK3HkGkqESGzRYMYmmTFKkFS
- TLSH
  T1BC3712D5A8C446ECC792C635D28A16FEE2C5749A0FBA542F7FCA18023271C41D9E7E39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Visual Basic

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

Credential Access

Discovery

Debugger Evasion

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

defense_evasion

behavioral26

defense_evasion

© 2018-2026

Terms | Privacy