5e2e1cbe34d26120995480e027e8531a51e474b38d901185dcc0ce53d5b6000d

Resubmissions

02/11/2026, 00:06

261102-adts4ayye16

02/11/2026, 00:05

261102-ac8wmadf597

Sharing

Copy URL Twitter E-mail

General

Target
MoonSweepers_Fix_Repair_Steam_Generic.rar
Size 10.7MB
Sample261102-ac8wmadf59
SHA256 5e2e1cbe34d26120995480e027e8531a51e474b38d901185dcc0ce53d5b6000d
MD5 99a30c40b3b597deee0644cb34b4aa3b
SHA1 407d5954d612c87a8ed6a6bde4a2c359dd28c5f3
SHA512 3b153d7ba14b979d5fdfe75021d5e90e533974debffa9e2e076e25520f991c3bb2c8b8391c48143021987e89b4370124295e16eca5df4b7ecfaa8a5615813db3
SSDEEP 196608:8S+5ksQLs/nfgDHCgrYfJWNfMBpRWi7w12kYD66dpY9UABfxjVVI+P:xxLs/nf3VSMBN7RkTcY9JffVI+P
TLSH
T170B63327B9C338154BF5E7F1338E7FC582B6A29411D2050E7B72457EE31F69B8688688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  MoonSweepers_Fix_Repair_Steam_Generic/MoonSweepers_Data/Plugins/x86_64/steam_api64.dll
- Size 291KB
- SHA256 a44e5537939ae4eebc69000589aa9b2437a667813a1657cc779198bae9b815a9
- MD5 f3db5801dc9b75da671b39041e2e8bcf
- SHA1 40d0ae44e090db49b2309fb152fbd3e11124a376
- SHA512 9abeb8542ce48f3d263e9924a82cafa80b42b730636f1df6e594679482b6638997563b5d752d5505f25596a5d0e2f56f1255e4a94bb9523d47c180bc131e22f9
- SSDEEP 3072:B8Y+BDOgGIWcXSEJeRhqTMdU55UuT7+7JtN3RUOj65lhTbCMTiGu2ZvJpKCZyq+g:BYPNrQheMW5vTKxRo8CgCZyqO2CM4OYS
- TLSH
  T18B545976A2750CF4E076C13989565E0FF671744B23219EFF226053368E67AC21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MoonSweepers_Fix_Repair_Steam_Generic/OnlineFix.ini
- Size 489B
- SHA256 4b8d3e6cf5a263b7e26cc2b8fdef4145d68583d16bf3522c447b604a92ed0be1
- MD5 4f365979ba7e00f6d86f4204845dfa37
- SHA1 eecc3edfa189815d84a39c3463c42984b05ce008
- SHA512 daa3810f08d43bb5f66acae963dec147e93ef1ccb8ca49618ef3d8b890277fe6ceebbe46471d4288d61ebad4d70241847d5bacc128e6d3b8c86231f776da9317
- TLSH
  T1A3F097F87B6D7239E5354D4F2CC3FCC3BA6A2AA6B00B490179130E892801E92B21A10D
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  MoonSweepers_Fix_Repair_Steam_Generic/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

7^/10

discovery
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral5 behavioral6
- Target
  MoonSweepers_Fix_Repair_Steam_Generic/OnlineFix64.dll
- Size 12.8MB
- SHA256 ae23f76254fbcd88d36ff5d15f958708638cb63e6cebdc1d30247aa559c2340f
- MD5 0fe9abef0db903d05b11dca762fcd35b
- SHA1 41bafe6a9bac5b9baff6acbfb61093d075bc5248
- SHA512 a08c8b07a5c933ef162e37efc29728290a04c5b4ce94d453048a176b50b95eec5ffe72baeaa23d1d97aa415cfb72dc81d19526bfb7fe2e4ad71d2a20cbb3f7bf
- SSDEEP 196608:RBaZquxob+fHgdbRUf/kUiuJVZlTMWLgKjPId+LvApzm30aUJfc0FnglAw65P29b:R3ugRQx1hq5IAdLaEaUJQQMjq
- TLSH
  T159D6129569D497BCC4418578E24516FCF0D57C898CF9882AFFCB48213EB0C99C8B6BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  MoonSweepers_Fix_Repair_Steam_Generic/SteamOverlay64.dll
- Size 114KB
- SHA256 f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df
- MD5 0a5429b888c75f6525e1100e32dd2b69
- SHA1 8ae224580aa0838a7b1570c79d4d8f27a1b46d19
- SHA512 5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef
- SSDEEP 1536:h1iaPnCtV4+1/IGiaA7bSMhP3rOy843NxnpWJtRsWkd09dl38s6BtcBRXh4:h1iaPn5+uGi/7bpxaX43Ni3aMLJB1h
- TLSH
  T163B34A5B73E500BBE0768239C8A71A15D376B8110760DBEF03A0466A1F277E19D3EF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  MoonSweepers_Fix_Repair_Steam_Generic/dlllist.txt
- Size 35B
- SHA256 662dd415e2796635702c49586fb99ae62a3c6f595976d6923ec8a4e7c23fa8fe
- MD5 ff98c62757cb7c9f5dbedcd67d3781f6
- SHA1 82076991ee9a824bcf9969b416fcc163d02a6160
- SHA512 42973bbb4feb375354684c0356c45bfa7f0bf63056906244c2c0ac89720326cfa41c9aa51e2522d1d9da66c019ccf3dba570a732007e8b3306e66920faaae791
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral11 behavioral12
- Target
  MoonSweepers_Fix_Repair_Steam_Generic/winmm.dll
- Size 490KB
- SHA256 063a8d5e57cd760a8eafb3573146cc97e18180412a5a0efc23614e23dc1a2568
- MD5 3fb1fae80a788ffd42b7f7047bc0903d
- SHA1 079be776a6618e43865bb4c033e119fcb7ae3306
- SHA512 08f994f0f4e8f268e77d29556eef805cb3405862fa9986c7e7dd15d5257e2d7366a4e77e07d6a4ba693fc2bc53be0f13eb36a5ee36b8e1dd2d05a8c394f14221
- SSDEEP 6144:zz01cAnrjsEtjiT5BZhK6H8jEY6tbNUvvJgVGs3YUlXULmyU1vwjmvy:vecAnrJjefK6c5vqVGGNXULmJvmk
- TLSH
  T178B48F19A2A842B9E567E178C9430A07E7B1BC464761D7CF03E09BBB2F277E0563E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14