Resubmissions

02/11/2026, 15:19

261102-sqlblaxs6j10

02/11/2026, 14:52

261102-r85yaaay4y10

02/11/2026, 14:22

261102-rplqaswz6m10

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 15:19

General

  • Target
    Gajim-2.6.0-64bit.exe
  • Size 152.1MB
  • Sample261102-sqlblaxs6j
  • SHA256 ac99c3e04a1282cc47346b75bcc597062a2d4ab4e246d32b52290a7821b4251c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\Gajim-2.6.0-64bit.exe
    "C:\Users\Admin\AppData\Local\Temp\Gajim-2.6.0-64bit.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    PID:3308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imagingtk.pyi

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\PIL\_imagingtk.pyi
        • Size 63B
        • SHA256 ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe
        • MD5 SHA1 SHA512 TLSH

        __init__.py

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\cryptography\hazmat\decrepit\ciphers\__init__.py
        • Size 216B
        • SHA256 c0709b59f69e7daf9f93a4c74b0f6d87d7c952c4ad268ef6e39c1f141aa676e0
        • MD5 SHA1 SHA512 TLSH

        INSTALLER

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\emoji-2.15.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512

        gajim.mo

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\gajim\data\locale\hu\LC_MESSAGES\gajim.mo
        • Size 141KB
        • SHA256 e9512cd35963a3e0968c49be5417a486f2e4342d3f2efe1abf13baa3fa028463
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WHEEL

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\pycparser-3.0.dist-info\WHEEL
        • Size 92B
        • SHA256 a842dba36b35633977f599ab0226d70368e33cb5187e756150d4e5c85d6bab46
        • MD5 SHA1 SHA512 TLSH

        WHEEL

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\setuptools-83.0.0.dist-info\WHEEL
        • Size 91B
        • SHA256 2b6eb4118ce7cd7b09601406aa623c553c4476265836f0d9c16f5c061f7efcc0
        • MD5 SHA1 SHA512 TLSH

        INSTALLER

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\setuptools\_vendor\jaraco.text-4.0.0.dist-info\INSTALLER
        • Size 2B
        • SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
        • MD5 SHA1 SHA512

        LICENSE

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\setuptools\_vendor\jaraco.text-4.0.0.dist-info\LICENSE
        • Size 1023B
        • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
        • MD5 SHA1 SHA512 TLSH

        top_level.txt

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\setuptools\_vendor\jaraco.text-4.0.0.dist-info\top_level.txt
        • Size 7B
        • SHA256 d099cddcb7d71f82c845f5cbf9014e18227341664edc42f1e11d5dfe5a2ea103
        • MD5 SHA1 SHA512

        WHEEL

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\WHEEL
        • Size 91B
        • SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
        • MD5 SHA1 SHA512 TLSH

        WHEEL

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\setuptools\_vendor\more_itertools-10.8.0.dist-info\WHEEL
        • Size 82B
        • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
        • MD5 SHA1 SHA512 TLSH

        WHEEL

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\winrt_windows_data_xml_dom-3.2.1.dist-info\WHEEL
        • Size 113B
        • SHA256 7bf61f8fe80b8b36297a0c6d83cfca401ef42778eaff3b2c93475188b1048b58
        • MD5 SHA1 SHA512 TLSH

        top_level.txt

        • Path C:\Program Files\Gajim\lib\python3.14\site-packages\winrt_windows_foundation-3.2.1.dist-info\top_level.txt
        • Size 6B
        • SHA256 073c106f875946dd0dc425e2d740118d6b28c7b02c9ad7ff957af0fca47e0ff1
        • MD5 SHA1 SHA512

        messages.xml

        • Path C:\Program Files\Gajim\share\djvu\osi\zh\messages.xml
        • Size 410B
        • SHA256 f1a11857a3ec6896ea9fb1fb17753c85fcdb7ffcb9b9ba38520eeff87a4bcbbb
        • MD5 SHA1 SHA512 TLSH

        folder-open.svg

        • Path C:\Program Files\Gajim\share\icons\Adwaita\scalable\status\folder-open.svg
        • Size 1KB
        • SHA256 1ad4aea2e388f553fd958fa0ce8120fb80d48319a004d48ce777d89e051c179d
        • MD5 SHA1 SHA512 TLSH

        media-optical-dvd-symbolic.svg

        • Path C:\Program Files\Gajim\share\icons\Adwaita\symbolic\devices\media-optical-dvd-symbolic.svg
        • Size 629B
        • SHA256 400909b4e6008b6a90e83e5bac3338ca96b068a6e765b548ce8af87e090054b1
        • MD5 SHA1 SHA512 TLSH

        system-lock-screen-symbolic.svg

        • Path C:\Program Files\Gajim\share\icons\Adwaita\symbolic\status\system-lock-screen-symbolic.svg
        • Size 457B
        • SHA256 1ae63c45551ac54158a0d5a8131feeb56f1055f9099dd2fb7a60cd8630ec7bae
        • MD5 SHA1 SHA512 TLSH

        LangDLL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsrE193.tmp\LangDLL.dll
        • Size 8KB
        • SHA256 4a067fe60c0af5c6bb2def26e563ed44f3e0aa6b32196fb336af5776f6c44b21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartMenu.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsrE193.tmp\StartMenu.dll
        • Size 11KB
        • SHA256 59bdb5856ac000e657c5ee33b4ee380c215f0fab371c6e9146fb11f76563f08e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsrE193.tmp\System.dll
        • Size 24KB
        • SHA256 a8c5b0e013a646d8edd4c838e2c2942c5b37fffa8f4c8f48773268a2a00b2277
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modern-wizard.bmp

        • Path C:\Users\Admin\AppData\Local\Temp\nsrE193.tmp\modern-wizard.bmp
        • Size 150KB
        • SHA256 7d63e63a8504e6d67293642abdd93f28a817c53f2647640a9bd330b9241bbb37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsrE193.tmp\nsDialogs.dll
        • Size 14KB
        • SHA256 6af12deb32fd7c09b9b31c8a5f58f0751ed52c950b1d3c4cce2b76180a1f28dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3308-61-0x00007FF8310C0000-0x00007FF8310CD000-memory.dmp

        memory/3308-20-0x00007FF8310D0000-0x00007FF8310DE000-memory.dmp

        memory/3308-6-0x00007FF8310D9000-0x00007FF8310DA000-memory.dmp

        memory/3308-21-0x00007FF8310C0000-0x00007FF8310CD000-memory.dmp

        memory/3308-9658-0x0000000140000000-0x0000000140202000-memory.dmp

        memory/3308-6560-0x0000000140000000-0x0000000140202000-memory.dmp

        memory/3308-19-0x0000000140000000-0x0000000140202000-memory.dmp

        memory/3308-58-0x0000000140000000-0x0000000140202000-memory.dmp

        memory/3308-3611-0x0000000140000000-0x0000000140202000-memory.dmp

        memory/3308-62-0x00007FF8337C0000-0x00007FF8337CD000-memory.dmp

        memory/3308-854-0x0000000140000000-0x0000000140202000-memory.dmp