fe2a9c0c9f0e3ccd5dad6266a8cb3afdfd8c9a8b8b883dad02258c2b68ff6e08 | Triage™

Login
Reports

Overview

overview

7

Static

static

1

GoogleOneO....0.zip

windows10-2004-x64

1

GoogleOneO....0.zip

windows11-ltsc_2024-x64

1

GoogleOneO...DME.md

windows10-2004-x64

3

GoogleOneO...DME.md

windows11-ltsc_2024-x64

3

GoogleOneO.../bg.js

windows10-2004-x64

3

GoogleOneO.../bg.js

windows11-ltsc_2024-x64

3

GoogleOneO...mon.js

windows10-2004-x64

3

GoogleOneO...mon.js

windows11-ltsc_2024-x64

3

GoogleOneO...ver.js

windows10-2004-x64

3

GoogleOneO...ver.js

windows11-ltsc_2024-x64

3

GoogleOneO...ud.css

windows10-2004-x64

7

GoogleOneO...ud.css

windows11-ltsc_2024-x64

3

GoogleOneO...hud.js

windows10-2004-x64

3

GoogleOneO...hud.js

windows11-ltsc_2024-x64

3

GoogleOneO...lay.js

windows10-2004-x64

3

GoogleOneO...lay.js

windows11-ltsc_2024-x64

3

GoogleOneO...ook.js

windows10-2004-x64

3

GoogleOneO...ook.js

windows11-ltsc_2024-x64

3

GoogleOneO...t.json

windows10-2004-x64

3

GoogleOneO...t.json

windows11-ltsc_2024-x64

3

GoogleOneO...up.css

windows10-2004-x64

7

GoogleOneO...up.css

windows11-ltsc_2024-x64

3

GoogleOneO...p.html

windows10-2004-x64

3

GoogleOneO...p.html

windows11-ltsc_2024-x64

3

GoogleOneO...pup.js

windows10-2004-x64

3

GoogleOneO...pup.js

windows11-ltsc_2024-x64

3

GoogleOneO...��.txt

windows10-2004-x64

1

GoogleOneO...��.txt

windows11-ltsc_2024-x64

1

GoogleOneO...��.bat

windows10-2004-x64

3

GoogleOneO...��.bat

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
GoogleOneOfferRunner-v1.1.0.zip
Size 44KB
Sample261104-x52pcaee63
SHA256 fe2a9c0c9f0e3ccd5dad6266a8cb3afdfd8c9a8b8b883dad02258c2b68ff6e08
MD5 0119785c22f9abf9f9baab735c8001f4
SHA1 e6ba7e69d068ec4c89dc826fb6bad12a1166ec06
SHA512 4bde9fcb3e3de75069cbed7923062675b88de7dbb288d31528780c28dbfb9d4777ac70b241ffc3d6851b80bbe889c345c98db527e4946bb882ef83b95fbd1574
SSDEEP 768:QhPUmc5D1A2flw/8G4JoLzLdxxwd/F/59ZiHOewKFpOc88gOUfCEQwZSMYhgM/8:g7c5D1AaOz4JmzL9wdpTs8KFpDPtDElz
TLSH
T1CE23F136F696A406E629D53DDB41AF0BCC24512CEC06D62F3C8417F6AD3F141ABA8326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution ransomware

Static task

static1

Behavioral task

behavioral1

Sample

GoogleOneOfferRunner-v1.1.0.zip

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

GoogleOneOfferRunner-v1.1.0.zip

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

GoogleOneOfferRunner/README.md

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

GoogleOneOfferRunner/README.md

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

GoogleOneOfferRunner/bg.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

GoogleOneOfferRunner/bg.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

GoogleOneOfferRunner/content/common.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

GoogleOneOfferRunner/content/common.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

GoogleOneOfferRunner/content/driver.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

GoogleOneOfferRunner/content/driver.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

GoogleOneOfferRunner/content/hud.css

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

execution ransomware

Behavioral task

behavioral12

Sample

GoogleOneOfferRunner/content/hud.css

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral13

Sample

GoogleOneOfferRunner/content/hud.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

GoogleOneOfferRunner/content/hud.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

GoogleOneOfferRunner/content/play.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

GoogleOneOfferRunner/content/play.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

GoogleOneOfferRunner/inject/hook.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

GoogleOneOfferRunner/inject/hook.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

GoogleOneOfferRunner/manifest.json

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

GoogleOneOfferRunner/manifest.json

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

GoogleOneOfferRunner/popup/popup.css

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

execution ransomware

Behavioral task

behavioral22

Sample

GoogleOneOfferRunner/popup/popup.css

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

execution ransomware

Behavioral task

behavioral23

Sample

GoogleOneOfferRunner/popup/popup.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral24

Sample

GoogleOneOfferRunner/popup/popup.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

Behavioral task

behavioral25

Sample

GoogleOneOfferRunner/popup/popup.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

GoogleOneOfferRunner/popup/popup.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

GoogleOneOfferRunner/安装说明（Windows）.txt

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

GoogleOneOfferRunner/安装说明（Windows）.txt

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

GoogleOneOfferRunner/检查安装.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

GoogleOneOfferRunner/检查安装.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  GoogleOneOfferRunner-v1.1.0.zip
- Size 44KB
- SHA256 fe2a9c0c9f0e3ccd5dad6266a8cb3afdfd8c9a8b8b883dad02258c2b68ff6e08
- MD5 0119785c22f9abf9f9baab735c8001f4
- SHA1 e6ba7e69d068ec4c89dc826fb6bad12a1166ec06
- SHA512 4bde9fcb3e3de75069cbed7923062675b88de7dbb288d31528780c28dbfb9d4777ac70b241ffc3d6851b80bbe889c345c98db527e4946bb882ef83b95fbd1574
- SSDEEP 768:QhPUmc5D1A2flw/8G4JoLzLdxxwd/F/59ZiHOewKFpOc88gOUfCEQwZSMYhgM/8:g7c5D1AaOz4JmzL9wdpTs8KFpDPtDElz
- TLSH
  T1CE23F136F696A406E629D53DDB41AF0BCC24512CEC06D62F3C8417F6AD3F141ABA8326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  GoogleOneOfferRunner/README.md
- Size 16KB
- SHA256 64841fb148de89c354d5368aaca0b6bdf6bfa61e91db5f0a5e60881b9067ad62
- MD5 0b0ee3debe89476840c21efe7850f965
- SHA1 668567a86425478616d9e20de4d323adc22b95a7
- SHA512 a0bbb9de090f38f01615d6b759a597a134a66319be150c8a06a179e07f3e91eafcd8555e2adae2985ff5f6126eaef4dbe2311ac2a3224d7d10a5a52ff19d340c
- SSDEEP 384:QqSRZFuy5inAzkHj0Bty+OUsrMB5h4VDD6WMkV8rkPRAHKFXSI:QjHT55kHj0Bty+rYVSWMapZZUI
- TLSH
  T17B721A7648D86D8D3627F8CC7B572029B818BD06F026B064F6ECB8685BDCB784185B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  GoogleOneOfferRunner/bg.js
- Size 15KB
- SHA256 21805ff2ed7e2a24473aff43dffb608d992c07773d5678524c17d4b791f3d8fa
- MD5 3095ad703e63b8563f24eaaefd1b8d49
- SHA1 1edc272b4915c8fe8e39d58fa1f20fd8a3993c7f
- SHA512 b7fbb17168c93f643610c6a2430298dc45b655d9b378c9e76df1e3b84377cea2d813b8a5ab0565299c943ce4e4744cdf0c4a798a427604fd51218ebe796083c4
- SSDEEP 192:BLhr1GCFXowaRBQeE6cE6SqiDZ96S2OPEnpOzFSvr7Ue9Y7mu9lLMb6cYv0oUhWc:BdrVOJCSqc8OnQCKG/c
- TLSH
  T18B6295CA68FF19318233A0AD8A3BB006BA21C51B615CDDB1BEDDD1205FAC3560995FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  GoogleOneOfferRunner/content/common.js
- Size 8KB
- SHA256 8dfb220bf47d1adaca42d600c92afd301e7bcccaa67de970f67cc849ad1295ad
- MD5 74e10e4c8e0a1b357dd80fcb0fc44052
- SHA1 ab744f0ec8110ab34b37acba7ca29217b007f027
- SHA512 c6caf84c7aacdbe6515adf64331fe708720a965ccbf344148c086a6ee2f1435be8531be28021430260c2c404a5f31c697189c124af19914baf706ac1d13fdb0a
- SSDEEP 192:BLhPVBuh4PY6w2EQkepHaE6RMmTv0l35QztlSI:BdPXhY67DkiIRNcInSI
- TLSH
  T15012D8E218F7A4384122D1BE7687D096F61840A3B6DEE5D8F55D4CA02FD4F2442FEAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  GoogleOneOfferRunner/content/driver.js
- Size 8KB
- SHA256 2d10b818eb358e41b1dbe9959fd9226604716f99d6ba9c94f203f5131fc39f5d
- MD5 ec87f833859e87e872d52a846969a5c2
- SHA1 0456af1afc6e734a0ed21335b69b4ee9f698b22a
- SHA512 956633cb2a8ff55ae637c4445294c46cc72c60cf049667d800b7ace648e9ef106ed8e807fd46e8272902c5498137d104bf53d846a7d05fb27ed353e83b15f028
- SSDEEP 192:BLhMeBs02h9WX/l4s+0QcR5Uzw3RoIqdssvc7NRpc5eM552ymOlphSsWx4qR:BdG0ClqYz5IqnUjFyct
- TLSH
  T10902B6E71AFF12164033A0BE0B9BB01AB132491B549DEA54FD8C63681FDC66D066E7C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  GoogleOneOfferRunner/content/hud.css
- Size 3KB
- SHA256 a9abf4f4337c1604cfb9e5fb71f2e651225d5f6395ad9cd336a99033b0c0b277
- MD5 a1e02c83b74afc607abe5ec9126a35f5
- SHA1 9ac460bc073314f47e61372d5710ae4e9668bf11
- SHA512 2e83b83d11fc0d0c03b7a93f870df1efd810ee0e9ac026417607141d51cf395e2def9f63dac0ce537eb6fc52157dd6fcfc2f190237b25f50c4de76d5eb381bdf
- TLSH
  T10D812143FDC50284751284885853BBFEBFBE54005305CE7917A6333A6B87AEBC9A2635
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  GoogleOneOfferRunner/content/hud.js
- Size 5KB
- SHA256 3fb89e7ebbc4dc78c10149ea928b461733aaaebaa50779ec14cd8ae63918deda
- MD5 6ef5aebb79a4b39a2b91deab71440226
- SHA1 41c61765f0cc70d10a256f203b38de7b4160fccf
- SHA512 449a548d442a40dbf446a50f40c88a358d33f5197b62c6900e4bf6951b314f589effc12c16214cc4913bb3cb06acf7dfb8d5ae01dce39d62691080d912d4f8b5
- SSDEEP 96:B41huZKB2FJvtEj8HOurOCh73OlKxAuMgW/rM92wNh1+7l9k2Cc8hXQ7:BEh+fe9urlbl9MgirtwN+ic4y
- TLSH
  T128C164662CA3163D0573C1EA66476129F522804B9157CE55776C83042FC1EBEC1BFBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  GoogleOneOfferRunner/content/play.js
- Size 11KB
- SHA256 7fd3d5c98b6d4e4d2b675b7c19bcff7ca39e2c61a6e2260e823ccd8f161edb13
- MD5 e05f956b76165fc4973da5e8c1ef44d7
- SHA1 86b3675c1e9434843fa3c4b90d82b502308efed2
- SHA512 28c2ad3b235aa51df944768c1227aaa1cc2305b38910bfe8cdfd3ec231d218f47e66240ecbe0842cad4e8c326ca910b06f6f684beeeb7a6f5f09796a52b34f51
- SSDEEP 192:BLhKyDEdCKas9aFSkFkdxcZ58hR6AHTxK6Q9gtIR9ldKURcKl34LslPpBmqQs+gB:BdK2EkKasoEYQYicbGDl4r
- TLSH
  T1C532959A29FB1626503360EE178FB04A711129136487DE94BE8C13101F993685BFAFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  GoogleOneOfferRunner/inject/hook.js
- Size 10KB
- SHA256 5ea42578c543c01f33a32a3b125dd92bdcaf3b809dfc260ef0b488e1e2858520
- MD5 cec73e1912bce9c55de1e3359db84fcb
- SHA1 949a4f8d7cf664c7c2b3d5d6f1099fcbbe385f47
- SHA512 d6a9f736afdb81173e43cd6398daef0a48479225cbbe26d2596782f2245e27b599a094c3fb6f5cbd169f7ef683601503de5db608aa8c45f2dd55d6c72808821c
- SSDEEP 192:BLhNvCLN5DUAty2AAQARXqyZu0tOLjO/lLWOqosoWMlujac0PrVZ4/7SUHGo9aEw:BdINNUWvDcuBUa9wDioTg06
- TLSH
  T1DE2264453CF711A1826371F84B9F906CF536D15B500FDEA8B98C49B02F8663982BAF9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  GoogleOneOfferRunner/manifest.json
- Size 1KB
- SHA256 56d77e7468de058a162bcd2f76cd5159191468e4713b8691440a410d61734d8c
- MD5 4d17081bc618de7fcde764213fe71ad6
- SHA1 508083ea8f85d35fb70de6018292d8d2d732628f
- SHA512 5c310f3c714fd265635414bebcd8c3469b31291b0f702ac0f99120d74f8b633ac581a1339befdfd6e710328e8bf897c5e439121785130cb1bb31df4d74749c8e
- TLSH
  T1D1415BB7DD680C270AD8ABA8947A634AFE20474B6DD97D48B38D013D0F5C62E113439C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  GoogleOneOfferRunner/popup/popup.css
- Size 6KB
- SHA256 59dbd368642b36cead5ca0fb8c1adb21a44df41108d8db9e2667b8635aaba4c5
- MD5 5b1036ed1634e0c610662c724c6bc16c
- SHA1 5554d92f3fa4a672e64278405c490c6ddd4c5fd4
- SHA512 14266bce182e3fe4a6eda5e021ab22e9c93107b4687433de00474b9bc49fa3e9d4bd60276be0c26d01bc5e7e16aa0fc95ae3172dade7104edc06519537919822
- SSDEEP 192:H3To+KT4YLzfIaFddJxBZqSQc7zuc+P17j96kXFPNhx:XTo+KTjzfzFJxBZqAO7j9tXFVn
- TLSH
  T15DD165A767144124B527FA603683D75AF3295903900EE7786EF0601CDDCE3B9A737B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  GoogleOneOfferRunner/popup/popup.html
- Size 4KB
- SHA256 fd05fb0d7066cdef9e98df1f13480fdee1cdcdc0795267428805d8bc1960043e
- MD5 f3a2a621e843546a5807b8c1aec8992b
- SHA1 075c75006c13567ad28d164475abb25b1210d432
- SHA512 e505e92f473f1c6e5a86c92bcf0c153b947c029134634795375ba832ff360cd2c81d4a8965ce8f25c65e215011f58e7b441fbd284d13358ff069abbcd54fe283
- SSDEEP 96:95iEsmxc48b4V1Mw9MEEjOHpyH90vN+0qepa9fGe1hr:aEsYD8b4VkmYGihr
- TLSH
  T1E6A127B1A0F95A77822380C7A59357263ED09513D5AA5200F1FD1FE01FEBD52AE0F52D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  GoogleOneOfferRunner/popup/popup.js
- Size 5KB
- SHA256 99e1df5eb5395af22d94aa87af1ec999079a136814f9b142b8fa71be5acec209
- MD5 bd877b725602737be88c27f89ea7e00d
- SHA1 7c1a232c18e0bf2da200479038ae5a0931974522
- SHA512 2e39cbc6d20951be9fae77171f88777bceb7cf11d4793a4dd27c7e408dc6d62bf0f3e552aa9dd70dd71da108bea68714611da78381773a1f1d393842028c93d7
- SSDEEP 96:B41hcaevr+BWech4mKXWuopc8CmP2X2VAqqkq1SNP8PQLQpJtEQGmGMboYZ:BEhcwBmh4mPuopaVmVskqU58oQpJ+75+
- TLSH
  T13BB1A7D9BEFA0F3C0871C666B97F7046FB0880017A48EC50BAACF4A40F49691219DBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  GoogleOneOfferRunner/安装说明（Windows）.txt
- Size 3KB
- SHA256 b78585f8fea9296ed655cda28f90a6e3b7508d6bd038b224b9405bff9c57208f
- MD5 6dc8f736eeed0a3b5561b9768f6fc1d5
- SHA1 f67daa0c220b2e54a798b55b5b3146277276afa9
- SHA512 50df880069a872c9583ee8e71bdddfd31580ad7401968f5dd27e4da217bbe898f7893dbc6af8281d4521a00564cb19424f8ee5eed08cbc23e756db0fbbaa20e0
- TLSH
  T14481D92158763E6D4773C3F23AE80448F5402D8EE4387381BB9E4FE46B6A718439654B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  GoogleOneOfferRunner/检查安装.bat
- Size 2KB
- SHA256 5424299639651204b562f7d23c2908d390cca3d40bacf6cd60a8ec139aa5cca9
- MD5 5b0186ec377ec462f6bc339b0fd49946
- SHA1 1258936577b5bcc12e07a047a34050690fef38f4
- SHA512 bfdf664c79183ae5403d0659943c16d2e4b6a47cfb94587cebd9ffa2f1cc5d153cb1f2cd77e77700a06b2c5694dde6080f7cd638fe1b62762d375da5b5c45430
- TLSH
  T14A5133A5B46CA18812BD57DC8EB54041F94805CF4561BD92BCEF51F43B863E02AFEA3D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

executionransomware

behavioral12

executionransomware

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

executionransomware

behavioral22

executionransomware

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

© 2018-2026

Terms | Privacy