09f9473c3b572c88b8e818280d6a52f804d5b1676c0e07a8d722852785cad96e

Resubmissions

26/10/2026, 13:05

261026-qbjs4sd131

26/10/2026, 12:52

261026-p33vmae15j7

Sharing

Copy URL Twitter E-mail

General

Target
SLIDE-Tweaks-v1.1 (2).exe
Size 88.0MB
Sample261026-p33vmae15j
SHA256 09f9473c3b572c88b8e818280d6a52f804d5b1676c0e07a8d722852785cad96e
MD5 41f2cfb4769b70be6fb29ecc310b3f40
SHA1 379fe8a3c422938c979f1e526fbafb34b78b559d
SHA512 de314448ed9fbe7452ecbce9547f9e11beceb293be89e8530b5be1b02ab9df4286117dc06ec6895ccb1d1440c57aceace7f5ebdcfef7075e4e76d782df2f365f
SSDEEP 1572864:LaaFj3il0F7jBYeybanIcAemtug99yM6disLkA8szvwegGUNQvKguoeeYjf1JFwE:Las3iO5BYUI5e3d3gnszvw3GgMf/hYR3
TLSH
T11518330535EDE2B9D8220179C838602448CEF21A312197FE68B7E4BDB5B37593695F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SLIDE-Tweaks-v1.1 (2).exe
- Size 88.0MB
- SHA256 09f9473c3b572c88b8e818280d6a52f804d5b1676c0e07a8d722852785cad96e
- MD5 41f2cfb4769b70be6fb29ecc310b3f40
- SHA1 379fe8a3c422938c979f1e526fbafb34b78b559d
- SHA512 de314448ed9fbe7452ecbce9547f9e11beceb293be89e8530b5be1b02ab9df4286117dc06ec6895ccb1d1440c57aceace7f5ebdcfef7075e4e76d782df2f365f
- SSDEEP 1572864:LaaFj3il0F7jBYeybanIcAemtug99yM6disLkA8szvwegGUNQvKguoeeYjf1JFwE:Las3iO5BYUI5e3d3gnszvw3GgMf/hYR3
- TLSH
  T11518330535EDE2B9D8220179C838602448CEF21A312197FE68B7E4BDB5B37593695F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 14.5MB
- SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
- MD5 b5e57572cfb5efa08f55f46772a42ded
- SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
- SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
- SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
- TLSH
  T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  SLIDE Tweaks.exe
- Size 200.5MB
- SHA256 9f61c501c53be76853d425df9bcdcd44ee64a3e2250f361f2be01769aa4891c1
- MD5 3914b9a49c5f62ffcb3d1d04aef70aa7
- SHA1 2a065d04e96eb0dc0ea1b28e2fb03f18507fd5c1
- SHA512 fffcbdd6b3bedf04ef4de930ccb0eb3becd5da0029940df153c4d0f2849775e55fa7212475377e25652f663bd4502e8d5525745106bd00da8ecbaf51d2203769
- SSDEEP 1572864:Bir3YkVksSEZWaMZDjL3r2sHCDTnq/jxOiuYSeh019IZQEKzVn7SfK4lJroH26Pp:KIAnVb+/jVScxkg
- TLSH
  T1AEA88B13E29601D9E05DD1758B5A9633FEB2B80A4B24A3DF2B5407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxcompiler.dll
- Size 24.7MB
- SHA256 d8a6ff71c310c934cc859e3e9b1a2c34b0f38253bdc258c1476cbd9ccb633e37
- MD5 da07043f07a01969dc66b66e2c9021c6
- SHA1 84f4012019684aeeee29355f64d2bbec6ce47d41
- SHA512 aff96ee5a79b0156677938f8e01495fe1c37f92bf272c33ecfc5c889226d94ecc0be007f76440f05084874a5c4c42549fa6825f9865da50da942d7e6639ae959
- SSDEEP 393216:epLjH68inXc/GE+HiCt+2xwuQbgjvMCWT:yHiEFapwuNW
- TLSH
  T1684719122646D49DF059C878C3678716CA6C34EB3FA678EBC0B461152B7BEBC1B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxil.dll
- Size 1.4MB
- SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
- MD5 360c2ec3a4114840498e4b0f45820395
- SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
- SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
- SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
- TLSH
  T185657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 5c8c4804c266b3c0bd1517c42f9dd310c3733fc14c363fc151306166295af238
- MD5 2c834f16e319c48813a7366cc42d9c62
- SHA1 8caa32bbda1278f7e9c01fd4319a2af7fb3701ec
- SHA512 1b54edad363360ef99968ed2f38ecce0dbac5da8ffe265797719832e2245b17fe5f4f696cf5430fa42338c4e4d2a5b921e76b9cc8c6130bf8d1d98f36441ff65
- SSDEEP 49152:BP7qY4ctjNE3KrfHEh1UBi0L//+eKVmQbJhvTxDUG5t9xi2QMJxUVlEQj0Ey4oB4:BThPD41Uge//WPd5t9xi2QMJxUVlEQjz
- TLSH
  T101E59E03F6D650DDD029D57097AB9313F631340A8B205AEF268089253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libEGL.dll
- Size 492KB
- SHA256 09dc89e7a401f272d29ef445f1825f4ef4422c6844892a6d8a56108b47a69504
- MD5 e795c02f5692460c2ac566d5d53972bd
- SHA1 80bafe27b2af747e768ab36cf7fa5c1f072ca530
- SHA512 400478284147691a25a6eebbcff4726dffceb4e7ef4e5a77ee170cc9fa1c3831d11138dac091266c017d2c4c65f93fd5141066839e80b05e001ea6b21f2d883d
- SSDEEP 6144:FUfgtSXLx7WDlUD3ntOb5EkMNvutTutO8PcRWLMJ85IeVeRAKx/b0:eZ7olUBObyNkutO8PcRW8mIegzb0
- TLSH
  T17DB49E15F3E545A9E07AC1388A434602DB76B8560B65FAEF03E093792F37BE45B3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 e5d96fb54dfbbf676b0b37c7915bcd907ff28f2ba63b49a72736a43ba3939a4e
- MD5 e83cfc0b54e74499d3aece7ecd449edc
- SHA1 cd18a077a977912fc16f6f9d77477bc1291b9b5e
- SHA512 22f00196d2905d50f62636e6c628efacec3cfba69981769cbf44806fee5c0bdc07b0c593cb0177ff94433eade1a7410298dcfd5a074abaf0f76fe256e0902104
- SSDEEP 98304:tsGAgRCWeWU4Wvy0jgjZQegl99ZmD3w4r/KlX26M:S+ervqggMqgUKpN
- TLSH
  T17B868C03F29640DDD05DE2B897579227FA34B8450734B2CF2A9457252F67BE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  resources/native/Slide.Executor.exe
- Size 6.3MB
- SHA256 f1488b504cfbdcfafad94ca3f65de0ef2aa1fc606436a24523c1215311886487
- MD5 a3f0636c32eeb54ec5004e8063d3e66e
- SHA1 3113857cefe257afda6cc383c2032f90e7412729
- SHA512 a9d72c4209629c891204066db29808704dae31c5c2e0975cf87725c1a7391ffb0b85d036673ce816d56d9847f530b26188439e0fa8d82f5445fb10db3fc5d5aa
- SSDEEP 49152:bl5fZqVjJFpNSM9R7m+IFFQUOoedlo6uTj6iKZ87qEK/l61Xa6YpRN0/uf0L3RRg:bh2NoOC6Sn4myCR7W8
- TLSH
  T139669D09EBE84AE5D127D776CA56C333DA717C461235C60F0256F2272F336908FAB629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
- MD5 57ed221051a5124546848d413c7bf534
- SHA1 37fa025e93d7fbeb3a6eeb21660221a35b3bc917
- SHA512 c9ce057dd2f166cf75b2d4a4d8a6ef90376cba15ad182708ba24504cc7ee11f7937feb5414a874df573a1aa7e51c23e257e611300725315a11de6f34fef3fc09
- SSDEEP 49152:ljso2Wp9s18LbsQCgJxAhgK4axTciCuE2aRj6q8U45uqPppkBXqyWwBgVGdWyKQS:ljd2WpM99ZKtA8h8AHwv
- TLSH
  T1E7462703F28680E9F05DD679875BA622F632F8814B2276DF56A01F192E77FE06739704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
- MD5 84ad45974c4d28380280efe0c25137c9
- SHA1 0b6740c39c53fcfcd98c0e82bc3878ff0371d2dc
- SHA512 0c0d7454cdd38146e9ee7bf296bde8fb368e3131a6da9b204bd4b02025de1cf9a44085c5f6741159f39f82284d7dcbb9078389bd9960d9d9da08b3b7ff2b5ceb
- SSDEEP 24576:FgQmQinxRotX321+hvdK2S6Z5WGcSDYsHQDi6g3P0zAk79oOHHe:+N5nfotX32qFKb6Z5WGcSDYsHQDi6g3L
- TLSH
  T1DF155B1396958569D57AD038CDD28607C9B178822326B9CF02A817087F6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23