daa6b690a17e1c775a1084b686605a637a864bd943498530de41330c5ec01d9b

Resubmissions

10/11/2026, 04:26

261110-e2plhayzav9

10/11/2026, 04:23

261110-ezzcxstw3m7

Sharing

Copy URL Twitter E-mail

General

Target
WarpDeskDesktop-x64-1.0.91-installer.exe
Size 28.9MB
Sample261110-ezzcxstw3m
SHA256 daa6b690a17e1c775a1084b686605a637a864bd943498530de41330c5ec01d9b
MD5 a18f1110ba943004615d99cf6fcb4b12
SHA1 e02d1c930b3c98db72f760f892beb7a0d27bfd9f
SHA512 410fb92517fdbf60a773dafbb72d0c5775469938032bf7e4d7981d5c5bee605473eae39d06cce4d0edab5ef75aa45ee9bbf4426c5dcdf7239fb9869ac4dc7fd1
SSDEEP 786432:HFbHb1QWDGKoFDbrc8F8fcG/O1BNsPRW3yKJ:Hhb1QWqKoBbJF8chEAf
TLSH
T1A26733B7F6A55D21E23CB53417FD4370CF81E859D29339A54BB262E709E27E88E81035
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  WarpDeskDesktop-x64-1.0.91-installer.exe
- Size 28.9MB
- SHA256 daa6b690a17e1c775a1084b686605a637a864bd943498530de41330c5ec01d9b
- MD5 a18f1110ba943004615d99cf6fcb4b12
- SHA1 e02d1c930b3c98db72f760f892beb7a0d27bfd9f
- SHA512 410fb92517fdbf60a773dafbb72d0c5775469938032bf7e4d7981d5c5bee605473eae39d06cce4d0edab5ef75aa45ee9bbf4426c5dcdf7239fb9869ac4dc7fd1
- SSDEEP 786432:HFbHb1QWDGKoFDbrc8F8fcG/O1BNsPRW3yKJ:Hhb1QWqKoBbJF8chEAf
- TLSH
  T1A26733B7F6A55D21E23CB53417FD4370CF81E859D29339A54BB262E709E27E88E81035
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH
  T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral19 behavioral20
- Target
  lib/gstreamer-1.0/libgstamfcodec.dll
- Size 275KB
- SHA256 dc0c0d2f3fb93260d8a93e76cce141fbe9214fc4703190ce4f61049c07748681
- MD5 5f06ff90c2d2577c8c8d9b5404e1b293
- SHA1 984cbcefd198c46e4b8678dea24f4300e0c8bb36
- SHA512 ba74f6025b814ec6bd525ddaa0a8a080cb7240ccfb9852c51fcffe5f175ec75f60827399123c23b3b2586fd90762b6d373f5dd635bc74119b81b4750990e9af6
- SSDEEP 6144:D5vfj5qSRKCfOz+LWnot54b5CecsNvKecfXRz5koaqSvT3au2m0fElJw6ivzu1Le:FvfjYSRzO04boF3aDX2m0fL6iCL3wuQX
- TLSH
  T1D2542927D29260ECD877D13996DAE232FA35B8189334BD7F4B508A353F20F50A279719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  lib/gstreamer-1.0/libgstapp.dll
- Size 12KB
- SHA256 f77db9aab613daf4eef5d3ac55f89d50f0832da5c4bb573002aa395c6903f45f
- MD5 378006ccc033ee764a9b6ddf681f5876
- SHA1 667b382a097f7a97f8b950bce25162c9c21dc03d
- SHA512 3f41c379ab4df3d205b027d97400a229c0bdc34ecfdab36a9d25bc5182f5e434904c821ef3d331fe179a71bd20f9757f8f5079dbd2cce0483a77a607d45e9c60
- SSDEEP 192:IyznBVHyd3fk2BTjMKqxLQcSSSSSSSSSSSSSSSSSSOxtSwKMHRCdA+4Y3Xqf8yqd:Iew3jAV0RxtS+HRoD36z8R3
- TLSH
  T12342831AB341B8BBD9EBD238D4CB8B71F176FD011762A1274310E1380939EDB552CA83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  lib/gstreamer-1.0/libgstaudioconvert.dll
- Size 43KB
- SHA256 2ecfaa3906401e4034da987726b53dd216067bd4dff9739f63d1696ebe33d1cd
- MD5 7411c7b11c49472f5de2a73b11ead28f
- SHA1 a8d7f514e9433e1c2619de77af6e3384ac5fd513
- SHA512 3500ac08184a1f96bf6e6bdc94e4133dd8977fdb21e5c149bcec21902bf858d2d73d9a7a781fe021ece399afffe1f671cd2f03f29c5fc06706b8c8da8a5c6ccd
- SSDEEP 768:MBgKT1CuL69LFHTAvxUGajrXZtoEz7r+dTJ0fuV:MBLTUum9LtETCZtoEz7r+dTJ0fuV
- TLSH
  T13A13A637F6024C8EC4B3D73994CA9231B635BD486B1BB69F8F04B1395F71AA10639E85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  lib/gstreamer-1.0/libgstaudioresample.dll
- Size 38KB
- SHA256 44725c793cefa03bcd724507254f410a58c97928b61205a4dd0eaf59d5b225e4
- MD5 c916d05d7afc98992cfad711f54dc677
- SHA1 ff3f34a8e1579dbb1c57d9fa6bf9aaad317f239e
- SHA512 b0fd95d464309bb09dda42b532b1297872a337d21a585448f0ceb7f924c3373997bbb2ec616b554ac1995092a40361b8cec80db6c9e5cea255902b079a39740b
- SSDEEP 768:dwPlxQJVM4ugOSyk1PFabcdy9LpwiEdMebyxbyUW+O+zFq2mS1M:FukHVFMpBcmO+zFq2mEM
- TLSH
  T17F030976E6018D8AC4B3C33EE1DDA636B238BC8C7719B6AF4B5481344F60FB15179A49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  lib/gstreamer-1.0/libgstcoreelements.dll
- Size 505KB
- SHA256 36fd59eacd00c3e1395c7c77894c693099ba1706ce8b58d4ee16bef6eff2d3c9
- MD5 61d9bb05b30b2cb90f77836dea112d8b
- SHA1 8604a1cf3389dab10ae32aaf960042b8288a040b
- SHA512 b5a03c526059308fdda6f19dbfeccf9f0ead9baad0af6a10f5424af43e4e3e6e2eb965ed784cea7481f09b7b4e08ab4efc75bfd99a8fa0142d5c549d802c9823
- SSDEEP 6144:H2XeIH5o7pJfMi2goXk8DtlieDaJj7Zf+lrzVx4bdyaa4k690Qrku8O/odr+:HeDKfMiMXhDGJ+rxxPVzub/odr+
- TLSH
  T12FB43A6AD6021ADCD8BB92394B5BE633B970B45C67397D6FCE24C5306FA0E30513B918
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  lib/gstreamer-1.0/libgstd3d11.dll
- Size 7.7MB
- SHA256 7c872c8e77ca40904608e2238c905ba0cf8cc3e82f48e7c325ab5d85b632f752
- MD5 1e886f9b30e054b30eb1bd35a8b8e105
- SHA1 3cf3a77901f158e08fe652b187bcc8ae96dfb7cc
- SHA512 b67a1a19a505d1848fcf8b88d16019caf3c0d45b6b8df201398542b57d4179d4da6427200cc19f45c9e47d2f5ffbc17b12e13cfe2bb3e01402c1a82be28c8f63
- SSDEEP 98304:DIJge+w/dQA+4nqrHr+ToUffBiFdrYTcP8BydRJrAj+CY4CbA0IT7AV0qVwZ:DMPpc+eyCktAK
- TLSH
  T1A7869F48F685BC73CFA537BAA89B2B07636C75903728A76B811306548C633975F1EBC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Discovers running processes

Event Triggered Execution: Image File Execution Options Injection

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32