4ca00b7269898825c3903a5ef99e1a62f1e3c2fec471df5e5c6009c31b7f6521

Resubmissions

02/11/2026, 12:34

261102-pr5vvacs6q7

02/11/2026, 12:30

261102-ppg11afb396

02/11/2026, 12:02

261102-n7lw8sszgt8

Sharing

Copy URL Twitter E-mail

General

Target
hotel-dusk-decomp-main (1).zip
Size 2.5MB
Sample261102-ppg11afb39
SHA256 4ca00b7269898825c3903a5ef99e1a62f1e3c2fec471df5e5c6009c31b7f6521
MD5 1a5a6126057aa6d6b02f5e28ba2100f5
SHA1 f90dd42eda85f7e77661ff904ea83dba4459ac2e
SHA512 1ab4792d5ca80d0a6613393caf60af44d4ca92f79356264746bffe10cc856a2c103294b7d459ba462d209e12628b7de316834dc109fe297168184ef8bfd385fe
SSDEEP 49152:l8UrmJ+aWTuELq9+qWxP+7j2XwocZ04xVtH75Ue0JzSN0AVOwH0J8:lBLTuELfpJ+v6w5bboSWLm0J8
TLSH
T103C53398784CBF9ED1FFDABD5E13C6103358A391D90E2E2F260B601DD9FB7122A61215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution

Malware Config

Targets

- Target
  hotel-dusk-decomp-main/build.bat
- Size 181B
- SHA256 713333c49cc625679d41b1603a01a635f74728143f99b40b36476f7e6b92d4e5
- MD5 3bfd313583b960f68eefd5f7fb1ebe3c
- SHA1 fc48cc0cd47448e27347eff3cb20afb137bee756
- SHA512 38b0f110ddeb2a18a0ee1a938f005a4dac8e18ce27402adb86d62bba536a49920ea469f116477017123c59af64ddb9c2d19c182cda574bf3abbf6155132c5543
- TLSH
  T1B9C0C0136065003330FF4C40CE656080C45C8AFF204DBCC1709220142F0D1E88DE57C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1
- Target
  hotel-dusk-decomp-main/pc/build_pc.bat
- Size 2KB
- SHA256 39cb48e688800ea08ec30b282c11ebf69da695a63fc5524883b7dfaa39cb7475
- MD5 2c31a4d5afc9cae4e2c8a876fef79587
- SHA1 ab13f5f67d0c8c368e92202552c6864ec5aa9ac1
- SHA512 e075ed72075f918a1445b508a5cfb7ab8f48870bcee3947921c4a3b9e9a7409405e77ffc51ab7c2dec8573b9542c928ecd290d24342eb7d430b13a3aa68d8672
- TLSH
  T1E751646AE16D4335700769119B25DAAABA2CC1AF42D04D98361A22292F1E3805FFF6D8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion execution
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral2
- Target
  hotel-dusk-decomp-main/pc/include/animation.h
- Size 982B
- SHA256 9bb11e5c66f8cc33fe9341fae9da97c48784bff0ab59e572ff37c65d3b74b8dc
- MD5 1e63edb3dbd7e0f23b294a6a58c0c0a5
- SHA1 c5bb906a28a3ba6278fc8fb0963220adae069afb
- SHA512 a6fe65f56286a371777e6c9b00d7cec5336a1b91d880f176b2520db39a979b4434ba0c700e29b8c471c38843937a0048808d5550750310cffb8f82536846e670
- TLSH
  T14A1121169C9F15C323A909210F9A325020C5A513F1CAF9AA3C4F33727FA51F846747AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  hotel-dusk-decomp-main/pc/include/audio.h
- Size 788B
- SHA256 c6231d426e22da05d941a8cad32cc8bcbc3cd6f4a377b9bff0b2e64e61fece44
- MD5 2b2b21ae55502fe2d06e45877910d076
- SHA1 7960dee75043d839f3fe639d39067661e49a26bd
- SHA512 a2b58c108822e643da6d270b1e26d2922d6f2590444001d6504909535c7faf41f3a3bb6026d0a82ce09dbffeeb76b37a15715ee2dfb410dd9de719f30d08b4de
- TLSH
  T1D401265A06581941849187F2A537E5892E0039B36D85B4D33E0BBB045F6FDBC74B1B6C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  hotel-dusk-decomp-main/pc/include/dialogue.h
- Size 1KB
- SHA256 6b7043ffd82ec14176082f7179ca1551d7fe9a8d303b846d49a01083fd0af9ef
- MD5 5a2266e0225faf0562d3a44fcd96f88a
- SHA1 045c0635c4d3959a979e52ffff634cf6a5b960f1
- SHA512 700d9a291ef03c20f614cb558d638c6d0351c7b658da104fdd003c509a0f69d0fca50fb88b9550ac1c217921693d81de7671407e2fac15809acc5aa98b9863e8
- TLSH
  T15B1180F598EF0A839CD10D769FE730956449907326C1F5583C9B6A2C6F115CC63B43D8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  hotel-dusk-decomp-main/pc/include/font8x16.h
- Size 11KB
- SHA256 3973decb3ec8f0834f8f75f08305c85687075a65b1dfad14a595825eae3bba60
- MD5 9636eef4784762d3d91ddc258b19ee82
- SHA1 53c1a70c3effc58f5048c8cac1da9b136ea72a32
- SHA512 5fb8243d4c4051a12a5bbd328a3d318bb4d91b06bd9d5a17bd818590d1917356fd751d15004dbedaacb74a520d4f1138ff8b7d149615117ce18e6df3385b7d81
- SSDEEP 96:BnNCML8+CyLg0cORZCY9mSrHensci1D9KEjqwOdcoaRLMAo0Smuix3iWhQLcOXf0:LaZuD+w3MN5PrXeAQ1
- TLSH
  T149324DFA361D69C57983B79DC3228456D5DD143215C4688EFB8D868AFACFA08C580F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  hotel-dusk-decomp-main/pc/include/hotel_dusk_pc.h
- Size 2KB
- SHA256 4b4d0f8d1ce9fb14974d751ac9daac73683d1413e0b62625bb9bdccdc1c889dd
- MD5 c0ad2a397c69fcc8212e42f8715549b8
- SHA1 dd863e96a4a28f04843d485af033b065fb5a12b4
- SHA512 f4c4beac5ba6b1f899b32bbd6605ec46c8ff05f6e4be93c04058cf44060f2e23004452fddc18e1048b187e4e86f0f476719c6bb1d7fbd15f0386aeeadc6075f8
- TLSH
  T16C417185896E1403EA11C756636B7C345040F19312D9F120BCBF732CAF9AB98637DAAB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  hotel-dusk-decomp-main/pc/src/animation.c
- Size 6KB
- SHA256 ac5ba30f767392ee157032fd9d30fdb385c868e55e7a5d2df1e2d3fcaab4c5a5
- MD5 8f66111343ef00fdbb7bfe60c20fe8d3
- SHA1 a61a8db757bfad7020a8910c3bdd3f87e8636b7d
- SHA512 eefd673883073ec96adc2159f2e5c3a4fef16486d8b87d258da9951d2bcbe88cc79dc856c9764d2852a85c32ec7c724aadf6577fcc7f2572abd8093bb2fe80a7
- SSDEEP 192:K8y6Potaa+3oIIla6FJhJyOJtu0W1qcIs+gbcy3M9eooHQuHyHuwr1DDL:xkt0T2a6FJhJht21RIs+GjkughdX
- TLSH
  T125E1614F0DF3A001528B692D6BCB880C3154D063F0CDD914BD6D6654AF916B9AB74F3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  hotel-dusk-decomp-main/pc/src/asset_loader.c
- Size 2KB
- SHA256 15902ce49130d05c3efe8605f7743066fe1aabd94df3592eef7820ee6c69def9
- MD5 436a6d67c95866e05b3b33d0f4f8eac2
- SHA1 e356b8657f3f67898e47771270f5e87843ae5f2e
- SHA512 7b660beb44bef211f4e33101f8cb052329e1035a4ceac6b991bad2c4f83dfd568b005cef7add6cef53c912d998cb3449a6368e7b02a087d87104e0169c5245d6
- TLSH
  T189411F9D099730061943256D2BCFED04D3289273A4D8E990FC3DB3287FD183D5294E1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  hotel-dusk-decomp-main/pc/src/audio.c
- Size 6KB
- SHA256 9d328fac1e8e64cdc5dad44774f67fd07716b18b5141ad43680195f110d68844
- MD5 c2ab73eef6a47729be538f43cdd0e6b0
- SHA1 b9bde37acae5779a9dabccbc7fd0ceba4c0e40e2
- SHA512 ec276f053b713c822c9f86d057ff897514be32ca579c0fab076dc83c12f491eb8a1dc20956eecfda25f6a6489a5815217514ed048b03c1c998e0e818332f4c6c
- SSDEEP 192:E9nABpJlsLsDBol+SczEV52j819Xgi8qw:E9A3B6R+
- TLSH
  T178E194CC549328025083B6E76F8A50E83725611344FDD642BE1E53B9DF9A43AA7F4F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  hotel-dusk-decomp-main/pc/src/dialogue.c
- Size 7KB
- SHA256 48695e14d5ffd87ca2c8e03a86093ac4b84a478bc8541dc9592727e1c06e7b9d
- MD5 162b51617dac013d99d43a8bfff89f5b
- SHA1 2dddd09d8e2adc5b5139252b320d14d7bf9fccd0
- SHA512 47c0f8fe3c1fddd9cde59e40c67aa093d3c6e7c59865112545d250905a648206ed87e68489dfe1429aa98ebc82ff882e33303ab732fac7d0a78b9caf795c1dc9
- SSDEEP 192:7mG+x+Wimz+PiQEQXFQN050WtJ/Er+yt+0G/s+KXh/CDurXfp3:7mHF03MGuxUoPx
- TLSH
  T15CE1124FA8FB0907DCB30433ABCF618A3AE5409F616BDA2538AF0155FF4165A516C7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  hotel-dusk-decomp-main/pc/src/display.c
- Size 14KB
- SHA256 084030c53f022f0c95260716a1300f72d57dd3def61d61a89844e4f34b6cf0fb
- MD5 950e0e685199f058568215745a0d1646
- SHA1 c31136b8f90375b936fc170d4346e5b8d0024a4f
- SHA512 67260742b1daf5f003d5a647185d34b48825d05d606b00a53739fd14dc9c829785990af767260b8c0b7c4c402ca31e17cf0abeaf93abf65b3a4b7d1a3ed1ff85
- SSDEEP 192:28SAySCy1zMnHO3BSCyiShXtX6H/i3XBCyiSCkLALMiYSSU5a/jSTfGSUFd9jiCM:28jdzWOI4EXmV5a/dS0zrKtpB
- TLSH
  T1A76232CC08F72A120A63B83DAB9BE90679555023158CED41BDBD63B4AFA1C7407B8F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  hotel-dusk-decomp-main/pc/src/main.c
- Size 11KB
- SHA256 a5de0bcce88213e5f8f290ae53b1e650d88e13329ef3661fbe89c83e6ec4c077
- MD5 1402425069185b086c61091c53aea701
- SHA1 10fdac8dbc562b5aa474bd2895a6b238d08d863f
- SHA512 47fecf5f2d9dff1015cab00bc06cd9aa16709f83bc6eade3326b7a87828ddcc1d427a7b7b8103d2244c2894d46a9a79cf5a7d494ead77edad4508f35174365d1
- SSDEEP 192:riARWRLBtGeDOpgitbcQtyGyH/oR+iJ/RzG+kqPAx74:TWLivlg/oRpRzXAy
- TLSH
  T1B9427003149FA300E6A368255F739D527A0AC137666DFE40F93F9F54AFA5F708228E45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  hotel-dusk-decomp-main/play_hotel_dusk_pc.bat
- Size 318B
- SHA256 fe661bc79f8511825c3f8a629fda7b39e47d080934ba2618fbe048b1c5771710
- MD5 4c67b7c1d1c2716ea8aaa2687e2adece
- SHA1 80aaf81a31d2d9b30afd0105bdd829ce27efa13d
- SHA512 7f3b8665746fa47fb2747688f29aa455e6f4af71f91d65ab01085c5028a99c0aaa37e5e394c84559e092decfdaa25d210b5dc54d35a7e2b8eeca903b4cf3fa96
- TLSH
  T167E07D1AA62914231C177CC88FBB2758AD3DC03F40C85D773006E5A80E5F640A0FC2C1
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion execution
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral14
- Target
  hotel-dusk-decomp-main/tools/build.py
- Size 2KB
- SHA256 92d0812520d2a7bdbc05e24105e47fc4ef59984986d70ac4e1d28e94a4bf90dd
- MD5 31e8f4fec75b53687ede9998d1e3fbf9
- SHA1 fb11d2843c3a4044d0b1445f081bc3651b37d208
- SHA512 84c9537c782f3ec63d8b275399e48076666ad1c1ca029281cd4cf8c34512934b32dded3837bf04ef6cd4014b7090167deda44f5c71b0cbc85f9626d9dc909d0b
- TLSH
  T18741AB0B19D6A42452D3C38CBE515AC08A3F4DB79B8FB816B5DE09D8DFA93D0857D82C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  hotel-dusk-decomp-main/tools/build_rom.py
- Size 3KB
- SHA256 ba731e53f39851f21ba66d4daf33bf59344d68f2584028f2ff2a36aa5f72befb
- MD5 f0cc827454a683566331154e19c8a99e
- SHA1 27d329a6ae7ba126798b4714f8cf7d15ee960826
- SHA512 faaab0df99257948cbdcf08a410e7da93ce5e1c2ec57ef227f79a3b32233e8aa5d8909fe01c055eac0cd830c38c43370144c6417273020b04e80bbd1341587e8
- TLSH
  T1FC71532D5C5E1A64C3D3C7CEAF298C9742256467624F642C7BCF12E89F526B243258E8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  hotel-dusk-decomp-main/tools/extract_assets.py
- Size 9KB
- SHA256 f3dce63a8cf03de9cfb6db15f261daab1981cd60904f0811b0eeddc1ac238658
- MD5 e0353bf8916c9fc7c51e546d59d821ba
- SHA1 5f273d448da1a7b240f7f7344beb789c09da1987
- SHA512 6f99d4b5cee2338b6f70ca3726e725996a5ba123c5d11c38c315482388c36ddc90bebc7e8567798496ad898de8ecfc9ccbc9a305b15018889c40c11237a7d2ed
- SSDEEP 96:c5m/EJpYJqeLVbRXIR6t6hPw4AXWSIftn5M2aidhWTeYZVzvWghmq9:coMbaJLLWpZYsWCYZwghmq9
- TLSH
  T19D12965FA46119E0A383DE6C5D7F001947787723820328287B2E87C49F54A39EBF1E9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  hotel-dusk-decomp-main/tools/verify.py
- Size 1KB
- SHA256 438e567f2b2d283b97a6abf8d8d1cfec1406f0d4fc6775394bb51aa4c9297cd9
- MD5 be2b55f61a3a8ad93fbb82b1603f08ec
- SHA1 94dc44cf147f94695a45de17d667b2f62a861609
- SHA512 1d9e8399dd1cc449af8445e309907b0ef62e5de51954bc8dffd284317fae960c566e872b0dc96a2c10b02d2f61efb2fd5ad81a912cc50dc2feedd6ca5757631d
- TLSH
  T16E31E1066E4816944273C5CCEF2E8654532A19237A8E3865BB8D45E01F61B7283368BB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  hotel-dusk-decomp-main/verify.bat
- Size 182B
- SHA256 7189070190bb4cc348d4e9f2ba728ec9d77b32499c4835ecc864cd6300f2172c
- MD5 6281fb73ac4a194fae54d72c21ffd72d
- SHA1 513bedc8e1018476d084d3ea606833e2cb8b531e
- SHA512 806eb56dd0edcb5c06a80b335059678b123f6d4aa7ceccc292bb14a6ce77c80b45f47843275fa00c31646f42eaf10d77d798526690a6d2e075ac8a792c7563ff
- TLSH
  T11DC0C0037424003334FA4C40CF556080848C89EF504D7CD130C210513F0C1E48EFB7C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Indicator Removal: File Deletion

Indicator Removal: File Deletion

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19