Overview
overview
4Static
static
3MosaicVPN/...PN.exe
windows10-2004-x64
1MosaicVPN/...PN.exe
windows11-ltsc_2024-x64
1MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1MosaicVPN/dartjni.dll
windows10-2004-x64
1MosaicVPN/dartjni.dll
windows11-ltsc_2024-x64
1MosaicVPN/data/app.so
ubuntu-18.04-amd64
1MosaicVPN/...ld.svg
windows10-2004-x64
3MosaicVPN/...ld.svg
windows11-ltsc_2024-x64
4MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1MosaicVPN/...ws.dll
windows10-2004-x64
1MosaicVPN/mosaic.exe
windows10-2004-x64
1MosaicVPN/mosaic.exe
windows11-ltsc_2024-x64
1MosaicVPN/mosaicd.exe
windows10-2004-x64
1MosaicVPN/mosaicd.exe
windows11-ltsc_2024-x64
1MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1MosaicVPN/...ox.exe
windows10-2004-x64
3MosaicVPN/...ox.exe
windows11-ltsc_2024-x64
3MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1MosaicVPN/...in.dll
windows10-2004-x64
1MosaicVPN/...in.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
MosaicVPN/MosaicVPN.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
MosaicVPN/MosaicVPN.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
MosaicVPN/app_links_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
MosaicVPN/app_links_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
MosaicVPN/dartjni.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
MosaicVPN/dartjni.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
MosaicVPN/data/app.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
MosaicVPN/data/flutter_assets/assets/maps/world.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
MosaicVPN/data/flutter_assets/assets/maps/world.svg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
MosaicVPN/flutter_secure_storage_windows_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
MosaicVPN/flutter_secure_storage_windows_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
MosaicVPN/flutter_windows.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
MosaicVPN/mosaic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
MosaicVPN/mosaic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
MosaicVPN/mosaicd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
MosaicVPN/mosaicd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
MosaicVPN/screen_retriever_windows_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
MosaicVPN/screen_retriever_windows_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
MosaicVPN/share_plus_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
MosaicVPN/share_plus_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
MosaicVPN/sing-box.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
MosaicVPN/sing-box.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
MosaicVPN/system_tray_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
MosaicVPN/system_tray_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
MosaicVPN/url_launcher_windows_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
MosaicVPN/url_launcher_windows_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
MosaicVPN/window_manager_plugin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
MosaicVPN/window_manager_plugin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target MosaicVPN/MosaicVPN.exe
- Size 106KB
- Sample261027-q6fpyass3q
- SHA256 c01d7f03f73fb9620009322fb29e1b88ee7cfd808b66c45cbfeb6630529a89c1
- MD5 806119aaca481c8a5f30f479b043f13b
- SHA1 af94d501984c23c1f300029b7cb158a7bb3b7e86
- SHA512 0a265f0e1fd7352cc053f54568f5271b9387c09e4b4171776d467762a32fe1a300ec9d07efe776015e3edc9eea13ec17ce5a89e92782b191a43cd5166b9711e1
- SSDEEP 1536:nDFsCuarCM0nji2Z60sZb/cYM4b79Gz3Z1bEfIMB7PExXP+vrZkHGQx0JA:nhsvdji2kvZb/cJ4X9GvEptPiPi6R6A
- TLSH T1EFB3AE56DB2550EBE36D9D78CA030A05DE72BC864BA1A5CF67F08DDA0E11ED09F3E201
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\DefaultIcon MosaicVPN.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\shell\open MosaicVPN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MosaicVPN\\MosaicVPN.exe\" \"%1\"" MosaicVPN.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn MosaicVPN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\ = "URL:MosaicVPN Protocol" MosaicVPN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\DefaultIcon\ = "MosaicVPN.exe,0" MosaicVPN.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\shell\open\command MosaicVPN.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\shell MosaicVPN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mosaicvpn\URL Protocol MosaicVPN.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3228 MosaicVPN.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3228 MosaicVPN.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3228 MosaicVPN.exe 3228 MosaicVPN.exe