60b903d64745fb24b0c9c94104bcba80c171a877a56a787d2ec8e349f8e573cc | Triage™

Login
Reports

Overview

overview

9

Static

static

3

Cheremsha.zip

windows10-2004-x64

9

Cheremsha.zip

windows11-ltsc_2024-x64

1

al_w_gi.dll

windows10-2004-x64

5

al_w_gi.dll

windows11-ltsc_2024-x64

5

hyperland_driver.sys

windows10-2004-x64

3

iqvw64e.sys

windows10-2004-x64

3

iqvw64e.sys

windows11-ltsc_2024-x64

3

statstrack_l1.exe

windows10-2004-x64

9

statstrack_l1.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
Cheremsha.zip
Size 12.1MB
Sample261029-2hkvjatvbx
SHA256 60b903d64745fb24b0c9c94104bcba80c171a877a56a787d2ec8e349f8e573cc
MD5 e99ca70fcde3a5dd14b597ba7cfef728
SHA1 34e7bdf4ca95aa1c160b97024265d0a4ef8b7858
SHA512 2fe8c4c6526db329d4e0ba3f54c1ba2faaf0a6aba202162304c729ce459f245f6656e0d506e7707ad275c0097f5cc46d761fdc1f1381cea4fef0d0808c59075a
SSDEEP 196608:QX7/ZdtEjakNPq1aLd7dhVjJVnCIx4Bs9qgvgxih5Zhn4QeSZu8a8WOZi68:QX7Bdtoak4oLdpfnnCfB23dh4QLjni68
TLSH
T199D6332258F54B3F50BE7683490B5F3F038C867386A6ADA9FFCF01499A8E58DD1B5508
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Cheremsha.zip

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

300 seconds

defense_evasion

Behavioral task

behavioral2

Sample

Cheremsha.zip

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

300 seconds

Behavioral task

behavioral3

Sample

al_w_gi.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral4

Sample

al_w_gi.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

300 seconds

Behavioral task

behavioral5

Sample

hyperland_driver.sys

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral6

Sample

iqvw64e.sys

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

300 seconds

Behavioral task

behavioral7

Sample

iqvw64e.sys

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

300 seconds

Behavioral task

behavioral8

Sample

statstrack_l1.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

9 signatures

300 seconds

defense_evasion

Behavioral task

behavioral9

Sample

statstrack_l1.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

300 seconds

defense_evasion

Malware Config

Targets

- Target
  Cheremsha.zip
- Size 12.1MB
- SHA256 60b903d64745fb24b0c9c94104bcba80c171a877a56a787d2ec8e349f8e573cc
- MD5 e99ca70fcde3a5dd14b597ba7cfef728
- SHA1 34e7bdf4ca95aa1c160b97024265d0a4ef8b7858
- SHA512 2fe8c4c6526db329d4e0ba3f54c1ba2faaf0a6aba202162304c729ce459f245f6656e0d506e7707ad275c0097f5cc46d761fdc1f1381cea4fef0d0808c59075a
- SSDEEP 196608:QX7/ZdtEjakNPq1aLd7dhVjJVnCIx4Bs9qgvgxih5Zhn4QeSZu8a8WOZi68:QX7Bdtoak4oLdpfnnCfB23dh4QLjni68
- TLSH
  T199D6332258F54B3F50BE7683490B5F3F038C867386A6ADA9FFCF01499A8E58DD1B5508
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Xen via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral1 behavioral2
- Target
  al_w_gi.dll
- Size 16.2MB
- SHA256 947ef60f767229d5d9b5a36db3c3522dfa33cb28e5b014e981e65308b76fd957
- MD5 d000c4e217da031f2f539e6d8dc139d2
- SHA1 2ed401c03eb32d480cee4c62be598f9ac4e63768
- SHA512 32fb0c5cd4a47d4c984132b8b00cca22675c99e56b914f00d3e79fa7c1306310da77b966621d95d7718d9194f67581c28b426cf4a7bc59ffd817f5be8a5a0eb2
- SSDEEP 196608:AziGFW97jkv5hTLC1qQtDGILFVaUDnY3+9HlsEZG4W6cwMx3D0Bnw0px:Azi5QbTL7Qti+83+9H57XB23sR
- TLSH
  T1800715A1D96C82DCD4547FA43E6FAA6C09222145350F9D5BD0782391AFAFAE433740EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  hyperland_driver.sys
- Size 222KB
- SHA256 9cb333b8dec617d1231f5b68fc23726d47a7b3a07ac7ccf019c317fa8f594b6a
- MD5 b8caffe4de326af1db9e26741ee1e275
- SHA1 1121a4be953cab756d1b341cf979de68cdb73cf9
- SHA512 cb2b49e466d823d5a224cc3bf824954914fd46a319a13204e07a0362f1e4aebb59a8c47c955e3fc8f00e9ad978d5e37d991462ab71c032db2427602205fdcd23
- SSDEEP 6144:m5zvzt/Pge/bKznJGZSbZxAfoQ5RAqPWt:St/Pt/bKJK8ZxAfNJE
- TLSH
  T1AA247C5AF2E15DB4C097D274C656CB23EBB238090326A5DF45E0CE7A3B22BD0A63D745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  iqvw64e.sys
- Size 33KB
- SHA256 4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b
- MD5 1898ceda3247213c084f43637ef163b3
- SHA1 d04e5db5b6c848a29732bfd52029001f23c3da75
- SHA512 84c3ccc657f83725b24a20f83b87577603f580993920cc42d6da58648c6888d950fd19fbb8b404ce51a3eab674066c5cefe275763fbdb32e1ae1ba98097ab377
- SSDEEP 384:gxdNvW7C8naMYCjizSO/YWwhtSgvNR0m1us7pfBMRKr+PLDRfvgXifBMRg6PWNTj:gHNwmJ/7UtSwR317uPPlvgXiu/6Tbf
- TLSH
  T109F23BC746186065E697C5FDC2B98B12CAF071981B24A3CF727481690F93FE87A3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6 behavioral7
- Target
  statstrack_l1.exe
- Size 825KB
- SHA256 8d78180e893337ae2256aaf4d66771f90ca97c0cc6b739bf8ad10367583f6b5e
- MD5 ab7682085b9b022a689b969dda04669b
- SHA1 6b198e2e4a926b67deda17300c8943be2ae4e73e
- SHA512 c2d38a573f828b43c4f0507c9998b3f26c765f4041dd5e76caa72d48f5533c2db02c319afb4addcae9143886aec0cd353ac5ccfeefe2f29260e0a541751c1143
- SSDEEP 12288:NJ5kkx0oFFY941/Z2/rWI29sfO7y8OTRFoznhlgM:NjRFiG1Q/rWNGfO7u/0YM
- TLSH
  T1C705C0CDC506A6C6ED510831CE020127BFF8CBB45C47711295BDFA8679E2B581BEEEA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Xen via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
behavioral8 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasion

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

defense_evasion

behavioral9

defense_evasion

© 2018-2026

Terms | Privacy