- Malware Analysis
- Threat Intelligence
Russian APTs and Malware: IoCs, TTPs and Correlations with Caronte
We investigated 17 cases with Caronte, mapped a collection of 20 files and documented malware correlations and TTPs. Download hashes for the 20 files and 11 network indicators in STIX 2.1 and MISP.
Mario Candela
Founder and maintainer
We started with publicly reported Russian APT campaigns and Russian-speaking cybercrime operations, assembling a collection of malware samples for investigation with Caronte. The resulting collection spans 17 cases and 20 files, including Office documents, scripts, loaders and reconstructed payloads.
Caronte combines reverse engineering with malware detonation in the Azazel sandbox. The 19 saved analyses in this investigation contain static findings, with no sample-execution telemetry: we used Caronte to examine execution paths, recover configuration and compare findings across the collection. We reconstructed payloads from a Word document and an Excel workbook, traced command and data-collection routines, and identified a shared passphrase in two separate loaders. These findings form the basis of the interactive correlation graph, alongside campaign associations documented by the original researchers.
This post brings together the sample analyses, supporting evidence, indicators of compromise and documented tactics, techniques and procedures. Select a node in the graph to inspect its findings and relationships, or open a case for the technical details.
At the end of the article, you can download the 71 reviewed IoCs in both STIX 2.1 and MISP formats, with their sources and context for threat hunting.
What the refreshed reverse engineering adds
The recovered Gorbag executable collects browser data and documents, then uploads them through Telegram. The file cataloged as CornFlake includes webcam, microphone and keystroke capture. The Gentlemen’s Linux code stops containers and database services before encryption. Each case below follows those routines to their functions, configuration and host artifacts.
In the sample catalog-labelled LockBit (Caronte: family possible), a WinHTTP request controls whether the encryption stage can proceed: the server must return a 2xx status. We found the URL’s UTF-16LE bytes at file offset 236048. Its URL and hostname/port pair are the two additions to this edition’s feed. Byte verification.
Explore the correlation graph
Select a file to read its findings, indicators and Caronte analysis, or an actor to see the associated cases. Reports are matched by SHA-256. Drag nodes, zoom and filter by actor or hash; the selected view can also be downloaded as a text brief. Dashed lines show published campaign associations. The extraction and shared-passphrase edges identify the relationships we checked in the files.
Actors, files and shared evidence
Select a node for its analysis, indicators and sources.
Try another name or hash, or reset the filters.
The strongest cross-case link: two loader DLLs
The Covenant-tagged DLL and PixyNetLoader contain the same passphrase: 838645f4bab7458fb130c7120a500982. We found it in both files, XOR-masked in one and plaintext in the other. Caronte traces matching container and decryption designs around that constant, giving us a specific pair of loaders to compare for code reuse.
We verified both DLL hashes and searched their bytes in memory, without executing either file. The shared passphrase appears at these offsets:
| Specimen | Byte check | Loader design traced by Caronte |
|---|---|---|
Covenant-tagged DLL, SHA-256 beginning c03f09eda8c1 | Passphrase at decimal offset 190001, masked with XOR 0x68 | Proxy DLL; external icon.png; HIDE container; PBKDF2-HMAC-SHA256 with 20,000 iterations and AES-CBC |
PixyNetLoader, SHA-256 beginning c6f13923f131 | Same passphrase at decimal offset 147232, in plaintext | Proxy DLL; external EdgeLogo.png; HIDE container; PBKDF2-HMAC-SHA256 with 20,000 iterations and AES-CBC |
The matching passphrase, HIDE container and key-derivation parameters suggest shared loader code. Zscaler documents APT28’s PixyNetLoader chain delivering Covenant through a PNG stage (Zscaler research); the HIDE/PBKDF2/AES container and shared passphrase are the findings this comparison adds. Determining whether the DLLs deliver the same final payload requires the external PNG stages. The loader match alone does not identify their operator. Byte-verification record.
For the two extraction edges—HOOKEDGE document to batch and Gorbag workbook to PE—the graph records the hashes of both the container and the recovered file.
How to read the correlations
No reviewed command-and-control indicator is shared across cases. The connections in the graph rest on file derivation, loader code and cited campaign research.
The 11 network indicators come from ChocoShell (five), Prime ReverseShell (one), Gamaredon (one), HOOKEDGE (two) and LockBit (two). HOOKEDGE uses separate paths on a legitimate hosting service for tasking and result submission. LockBit’s URL and hostname/port entries describe one endpoint in two matching formats.
Prime and RedLine both contain ipinfo.io, but Prime uses the name in HTTP-like framing and RedLine has a public-IP lookup helper. The optional grey edge marks this overlap and is hidden by default. Neither that service name nor common process names such as regsvr32.exe and explorer.exe establish shared command infrastructure.
| Evidence | What it establishes | What still needs evidence |
|---|---|---|
| Hashed container and extracted file | The file can be recovered from that container | Whether a victim executed either file |
| Same loader passphrase | Both files contain the same constant | Code lineage, final payload identity and operator |
| Exact hash in a cited campaign report | Connection to that report’s specimen | Operator of every later copy or individual victim |
| Family/catalog tag plus public actor research | A research lead and campaign context | Specimen-level attribution where no hash match was established |
| Shared legitimate service or process name | A contextual overlap | Malicious use without execution and network context |
What matters for government and defence teams
Start with HOOKEDGE. The document and reconstructed batch match published indicators from research on government, diplomatic and defence targeting. Its macro installs a scheduled task that runs every 61 minutes; the batch uses an off-screen Edge window to retrieve commands. Separate HTML wrappers submit the results. Hunting for the batch alone would miss part of that workflow.
On a matching host, trace the attachment to task creation, child files and process launches. Preserve any external loader stage under its own hash. Tie each event to the user and time: a quarantined attachment records delivery, while a task and its child processes provide evidence of execution.
European and Italian reporting reviewed for this edition
| Publication | What it reports | Connection to this analysis |
|---|---|---|
| 20 October 2026 — Symantec | HOOKEDGE activity at a naval shipbuilder, military aircraft engine manufacturer and law enforcement agency in two unnamed NATO states. The shipbuilder timeline runs from 24 July to launcher activity last observed on 24 September. | Our document hash matches a published indicator. Credential theft, an SSH tunnel and a loader are reported campaign activity; they are not all established by the extracted batch. Symantec research. |
| 23 October 2026 — Telsy | An Italian-language roundup covers the HOOKEDGE campaign against NATO targets. | Coverage of the reported incidents; no Italian victim is identified. Telsy roundup. |
| 6 November 2026 — CERT-EU | The October Cyber Brief includes Swallowtail/HOOKEDGE under European cyberespionage. | CERT-EU cites Symantec’s reporting; it does not disclose a separate November intrusion. Cyber Brief 26-11. |
The reviewed sources identify no Italian HOOKEDGE victim. The two NATO countries in Symantec’s report are unnamed. Our recommendation for Italian ministries, diplomatic offices, law enforcement and defence suppliers follows the overlap in targeted sectors: search retrospectively for the document, scheduled task, batch and Edge command chain where staff handle externally supplied Office files.
Evidence of execution should trigger investigation of the host and associated accounts. Establishing information theft requires additional evidence of collection or transfer.
The 17 case dossiers
Open a case for its campaign source, file record, code findings and host investigation steps. The detailed Caronte briefs follow all 17 cases.
The sample collection was assembled on 8 November 2026. We checked the SHA-256 of each file and the two reconstructed payloads locally. Encrypted archives are stored outside the website. Local file inspection and byte checks were static; no sample was executed on the analyst workstation. Catalog dates record when a file was first cataloged, not when a campaign began. The collection includes older representative files and leaves 12 research leads without acquired samples.
The criminal cases are included because of reported developer or Russian-speaking ecosystem links. Those links do not establish state sponsorship or identify the operator of each copy. Campaign-specific attribution and confidence are given in the individual cases.
HOOKEDGE · document and reconstructed batch
Research and attribution
Recorded Future attributes HOOKEDGE activity to BlueDelta, overlapping with APT28, with moderate confidence. It describes government and diplomatic targeting in Romania, Spain and Türkiye between September 2025 and April 2026. Our reconstructed batch hash and both webhook URLs appear in its Appendix A. Recorded Future research.
The document’s SHA-256 also appears in Symantec’s dropper indicators. These exact matches connect the files to the published research; they do not identify a recipient or the operator of every copy. Symantec, 20 October 2026.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495 |
| Catalog filename | 0032.doc |
| Catalog file type | doc |
| Catalog first seen, UTC | 2026-10-20 20:10:30 |
| Acquired size | 39,811 bytes |
File structure
The document is an OOXML ZIP package with 24 members, including word/vbaProject.bin. Its macro contains the installer and the batch script reconstructed during static inspection.
Reverse-engineering findings
The recovered macro installs a scheduled task with a 61-minute interval and writes the command-loop components. The reconstructed batch launches Microsoft Edge in a 1×1 window at off-screen coordinates 10000,10000, with an inline base64 HTML document that redirects to the tasking webhook.
After a 20-second wait, the script assembles downloaded task material into a command file, executes it with call, and captures standard output and error. The original macro supplies separate HTML wrappers and the result-submission webhook. Task retrieval and result submission therefore have distinct URLs and roles.
Output filenames are generated from %random% expressions. The command loop also terminates processes and removes files after preparing the results.
What to investigate
Correlate the document hash, the derived batch hash, scheduled-task creation, off-screen Edge launches and the two exact webhook paths. Search for the reconstructed execution chain on endpoints used by government, diplomatic and defence personnel.
Covenant-tagged proxy DLL
Research and attribution
ESET documents Covenant use in Sednit operations. MalwareBazaar tags this file APT28, CovenantGrunt and Loader, but supplies no family signature. Because multiple actors use Covenant, these tags remain attribution leads for this DLL. ESET’s Sednit research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86 |
| Catalog filename | default-20241101-1112.dll |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-10-19 09:05:08 |
| Acquired size | 218,112 bytes |
File structure
An AMD64 DLL with an empty CLR directory and KERNEL32.dll in its import table.
Reverse-engineering findings
The DLL resolves the genuine idstore.dll and forwards DllCanUnloadNow and DllGetClassObject. Its activation logic checks the host process, uses the resolvefree mutex, and reads %appdata%\Microsoft\Network\Cache\icon.png.
The container uses the HIDE marker and version 1. Caronte traces PBKDF2-HMAC-SHA256 with 20,000 iterations and AES-CBC decryption, followed by PKCS#7 unpadding and allocation of executable memory through a resolved NtAllocateVirtualMemory function. The loader retries on a 15-second cycle.
The passphrase 838645f4bab7458fb130c7120a500982 is independently verified in this DLL after XOR-0x68 decoding and also appears in PixyNetLoader. The acquired artifact is the proxy loader; icon.png is the separately staged payload container.
What to investigate
Correlate DLL sideloading, the host process, resolvefree, icon.png and executable-memory allocation. Recover the PNG as its own artifact when available, preserving the parent and stage hashes.
PixyNetLoader · encrypted-stage loader
Research and attribution
Zscaler describes PixyNetLoader in APT28’s Operation Neusploit. The file selected here was first seen in June 2026 and carries a PixyNetLoader catalog signature. We have not established an exact campaign-hash match or reproduced the associated exploit. Zscaler research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5 |
| Catalog filename | EdgeSyncPr.dll |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-06-05 08:21:49 |
| Acquired size | 232,960 bytes |
File structure
An AMD64 DLL with six sections, no CLR header and KERNEL32.dll imports.
Reverse-engineering findings
The DLL presents itself as EdgeSyncPr.dll, resolves stobject.dll and forwards COM exports. It decodes XOR-0x57 strings, checks regsvr32.exe or explorer.exe as its host, and applies a Sleep-based timing check before the staged execution path.
The loader reads %programdata%\Microsoft\DeviceSync\EdgeSync\EdgeLogo.png, extracts image bits, derives a key with PBKDF2-HMAC-SHA256 at 20,000 iterations, and applies AES-CBC. The recovered container is checked for HIDE and CRC32-related consistency before executable-memory allocation and invocation. The cycle includes a 20-minute sleep.
Its plaintext passphrase matches the independently decoded constant in the Covenant-tagged DLL. API resolution uses an export-table hash walk with seed 0x1E9A and multiplier 0x21. The acquired DLL and its external image container are separate artifacts.
What to investigate
Look for EdgeSyncPr.dll sideloading alongside the DeviceSync/EdgeSync path, the unusual PNG access and subsequent executable-memory activity. Use the shared loader constant to guide code comparison between the two acquired DLLs.
Gorbag · workbook and recovered PE
Research and attribution
ESET describes Gorbag as Russia-aligned and documents its use of BeautyStealer and Prime ReverseShell against Ukrainian organisations. This workbook’s hash matches an ESET indicator. Its role is to deliver the executable reconstructed below. ESET’s Gorbag research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927 |
| Catalog filename | додаток податкова.xlsm |
| Catalog file type | xlsm |
| Catalog first seen, UTC | 2026-11-03 10:16:11 |
| Acquired size | 3,212,016 bytes |
File structure
The workbook has 14 archive members, including xl/vbaProject.bin. Its macro reconstructs a PE from worksheet cells. We extracted that executable and verified its hash separately.
Reverse-engineering findings
The recovered PE collects Chrome and Edge Login Data, Cookies and Local State files, Firefox profile data, and OpenVPN configuration. Its document sweep covers 21 extensions, including Office documents, archives, email files and images.
The upload routine at FUN_1400026c0 builds https://api.telegram.org/bot%s/sendDocument and uses libcurl multipart form data with chat_id and document fields. The decoder at FUN_1400014b0 applies two layers of XOR to configuration, with constants including GY8RPV3HOMKGNSWMFLHP and 4543geqsccegrth.
The executable also transforms files in place with a derived XOR key, creates a self-deleting batch component, checks for debuggers and resolves APIs through LoadLibraryW and GetProcAddress. The Telegram URL contains a bot-token placeholder, so the feed records it as a service template rather than a unique attacker endpoint.
What to investigate
Connect the workbook delivery to the recovered PE hash, browser-profile and document reads, OpenVPN configuration access and outbound Telegram uploads. Review the process responsible for the traffic and the uploaded file set.
Prime ReverseShell · embedded PowerShell
Research and attribution
This file’s hash matches an indicator in ESET’s Gorbag research. ESET describes Prime ReverseShell as PowerShell embedded in a .NET binary with PS2EXE; Caronte recovers that script and its TcpClient command loop. ESET research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8 |
| Catalog filename | wintel |
| Catalog file type | exe |
| Catalog first seen, UTC | 2025-04-08 07:16:55 |
| Acquired size | 43,008 bytes |
File structure
An I386 PE with a CLR header and an mscoree.dll import. The managed host identifies itself as Windows Telemetry, version 6.34.21.0.
Reverse-engineering findings
The managed entry point reads the manifest resource nnnnrth.ps1 and feeds it into a PowerShell runspace. The script delays execution with a Get-Date/Start-Sleep loop before reconstructing the destination from 89n44n9n186_3240.
A System.Net.Sockets.TcpClient connects to 89.44.9.186 on port 3240. A StreamReader loop passes received lines to Invoke-Expression and writes output plus the working directory back with HTTP-like status and JSON framing.
The literal Host: ipinfo.io is part of that framing. Other embedded addresses have different, unused roles in the traced connection path. The feed keeps the configured destination separate from those contextual values.
What to investigate
Correlate the wrapper hash, the embedded PowerShell resource, delayed execution, Invoke-Expression and outbound TCP/3240. The ipinfo.io string alone is not a destination match for this reverse shell.
CornFlake
Research and attribution
The selected SHA-256 matches Microsoft’s CornFlake indicator in its CaptiveCrunch report on Storm-2945, a Midnight Blizzard subcluster. The catalog first recorded the file on 1 August 2026. Microsoft’s CaptiveCrunch research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 |
| Catalog filename | 123.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-08-01 05:53:40 |
| Acquired size | 8,113,978 bytes |
File structure
An AMD64 PE with eight sections and no CLR header. Build metadata identifies Go 1.26.4 and the module path iwj1w4iploo/cmd/agent.
Reverse-engineering findings
The CornFlake name follows the catalog and Microsoft hash match. Caronte classifies the code as a RemusStealer-style Go infostealer/RAT. Collection routines target Chromium and Firefox browsers, SSH keys, RDP server lists, Office recent-file data and USB history.
The report traces screenshot, webcam and microphone capture, keystroke and clipboard monitoring, document watching and USB-file collection. Persistence paths include registry Run keys, a scheduled task presented as Windows Update Setup and a service presented as Cloud Sync Service, with svchost32.exe as a process name.
The connection chain runs from connectLoop at 0x140311160 through serverList and tryDNSFallback. Defaults are localhost:9000 and 127.0.0.1:9100. DNS TXT lookup parses s= host/port records from a domain supplied at runtime. The feed records these loopback defaults and the lookup mechanism as context; they do not supply an external command-server address.
What to investigate
Prioritise process-correlated browser and SSH-key access, surveillance APIs, new services and scheduled tasks, and WebSocket or DNS TXT activity. Recover the deployed configuration to determine the destination used on the affected host.
ChocoShell
Research and attribution
This PowerShell script’s SHA-256 matches the ChocoShell indicator in Microsoft’s CaptiveCrunch report on Storm-2945 and Midnight Blizzard. Its catalog date is 1 August 2026. Microsoft research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c |
| Catalog filename | 123.ps1 |
| Catalog file type | ps1 |
| Catalog first seen, UTC | 2026-08-01 05:56:27 |
| Acquired size | 55,877 bytes |
File structure
A PowerShell script, submitted to Caronte in its original .ps1 format.
Reverse-engineering findings
The script includes an AMSI reflection bypass, a WinHTTP COM wrapper, a timing check and elevation paths involving SilentCleanup, wsreset.exe and sdclt.exe. Its elevated stub retrieves a second-stage resource from the configured HTTPS server.
Collection includes Chromium-family App-Bound Encryption key handling, DPAPI and NCrypt/AES-GCM operations, VSS-assisted database copies, Chrome DevTools Protocol cookie access, Firefox-family cookie stores, Microsoft Token Broker .tbres files and netsh-based WiFi credential collection.
The upload path gzip-compresses and base64-encodes the results, then submits JSON to /t/event. The feed preserves the configured server, beacon, download and upload paths as distinct indicators and includes their documented query-matching rules.
What to investigate
Correlate PowerShell elevation attempts, browser-database and Token Broker access, VSS use, CDP activity and the specific configured HTTPS paths. Treat token theft as a reason to review authentication sessions alongside endpoint artifacts.
Matchboil
Research and attribution
ESET describes MATCHBOIL as a downloader used by UAC-0099, which it assesses as Russia-aligned with medium confidence. Our file has a catalog family label, but we have not established an exact hash match to ESET’s report. Caronte assigns the file no family, its assembly references no networking APIs, and its embedded stage was not extracted, so this analysis does not confirm MATCHBOIL or its downloader behaviour. ESET’s MATCHBOIL research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11 |
| Catalog filename | file |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-10-09 07:58:48 |
| Acquired size | 572,416 bytes |
File structure
An I386 PE with a CLR header, an mscoree.dll import and .text, .rsrc and .reloc sections. Its assembly and module are named Yhosh and Yhosh.exe.
Reverse-engineering findings
Caronte reconstructs string-split resolution of VirtualAlloc, VirtualProtect, WriteProcessMemory, OpenProcess and CloseHandle, binding the resolved functions to delegates with Marshal.GetDelegateForFunctionPointer.
The loader handles four encrypted resources, hooks AppDomain.ResourceResolve and combines Rijndael/AES, TripleDES, MD5 and decompression routines with Assembly.Load, Activator.CreateInstance and assembly-entry-point invocation. The largest resource is 215,580 bytes.
Caronte recovers an AES-256 key/IV pair for one routine, native trampolines and RSA/MD5 anti-tamper material. The embedded stage derives its own configuration at runtime.
What to investigate
Correlate protected managed assemblies with dynamic delegate binding, memory-protection changes and in-memory assembly loading. Capture the resulting assembly or process-memory stage as a distinct artifact for subsequent investigation.
Gamaredon · UltraVNC delivery package
Research and attribution
MalwareBazaar assigns this package the broad Gamaredon signature. ESET supplies the public actor context. The extracted delivery chain deploys a renamed UltraVNC server; the catalog label does not specify a Ptero or Gamma subfamily. ESET activity report.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73 |
| Catalog filename | 7ZSfxMod_x86.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-10-02 21:26:53 |
| Acquired size | 1,305,670 bytes |
File structure
An I386 executable with an 822,342-byte appended archive.
Reverse-engineering findings
The SFX configuration selects silent extraction to %APPDATA%\Adobe and hidden-console execution of 68083.cmd. The launcher opens a decoy document, copies the disguised archive member FwYmY8YvYxYMYVYi.ini to explorerr.exe, then starts the renamed UltraVNC server.
The reverse-VNC command uses -autoreconnect -connect seemsurprise.com:443 and a MAC-address-derived client identifier. UltraVNC.ini specifies a local listening port of 5612; the package includes an RC4 DSM plugin and key file.
The launcher also cleans up the staging directory. A password configuration is bundled with the remote-access files.
What to investigate
Investigate the SFX-to-explorerr.exe execution chain, the Adobe staging directory and outbound reverse-VNC traffic. Correlate UltraVNC usage with installation history and approved remote-administration software.
DynoWiper
Research and attribution
ESET attributes the DynoWiper activity it investigated to Sandworm with moderate confidence. We selected this older representative file from four catalog records; its first-seen date is 30 January 2026. ESET’s DynoWiper analysis.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160 |
| Catalog filename | schtask.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-01-30 11:53:32 |
| Acquired size | 167,424 bytes |
File structure
An I386 PE with a KERNEL32.dll import table, no CLR header and no appended overlay.
Reverse-engineering findings
The orchestrator seeds a Mersenne Twister using RtlGenRandom, enumerates logical drives and selects fixed and removable volumes. Its directory walk applies an exclusion list that includes Windows and Program Files paths.
For selected files, it clears attributes and writes a 16-byte buffer at the header and at up to 4,096 PRNG-selected offsets. After five seconds, it recursively deletes files. This overwrite-and-delete sequence implements the wiping behavior.
The executable contains the build path C:\Users\vagrant\Documents\Visual Studio 2013\Projects\Source\Release\Source.pdb. Caronte identifies the enumeration and write functions responsible for local file destruction; no command-channel role is assigned.
What to investigate
Prioritise rapid containment when file-corruption and deletion patterns coincide with the specimen hash. Preserve incident telemetry and review offline recovery sources before reconnecting affected storage.
LummaStealer
Research and attribution
Microsoft identifies Lumma’s principal developer as based in Russia. This file enters the collection through its Lumma catalog label; the developer’s location does not identify the affiliate that distributed it. Microsoft’s Lumma investigation.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9 |
| Catalog filename | 3837B2AE95F88EC677F83FA95AC50A79.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-11-04 04:20:11 |
| Acquired size | 466,944 bytes |
File structure
An I386 PE without a CLR header. Its import table includes WINHTTP.dll, WININET.dll and CRYPT32.dll.
Reverse-engineering findings
This entry documents the file identity, PE metadata and imported libraries. SHA-256, SHA-1 and MD5 are available for exact-file searches. Collection routines and network destinations are not assigned from the Lumma catalog label.
What to investigate
Use the verified file identity to locate matching attachments, downloads and endpoint artifacts, then correlate any match with its originating process and execution history.
RedLineStealer
Research and attribution
The US Department of Justice documents international action against RedLine and Meta. That investigation supplies criminal-operation context; the operator of this particular executable is not established. DOJ announcement.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5 |
| Catalog filename | A5C45448100C2A173F73D339BBEE9B47.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-11-08 10:30:05 |
| Acquired size | 97,792 bytes |
File structure
An I386 PE with a CLR header and an mscoree.dll import. The managed assembly is named Happy.exe; the version resource names Implosions.exe.
Reverse-engineering findings
The report maps EntryPoint configuration fields, EndpointConnection WCF methods and ResultFactory collection actions. Collection routines cover browser credentials, cookies, autofill and payment data, with SQLite parsing and DPAPI/BCrypt AES-GCM operations.
Additional targets include wallet extensions and wallet folders, Telegram tdata, Discord leveldb, FileZilla and VPN configuration. Host profiling uses WMI and screenshot capture. DownloadAndExecuteUpdate, CommandLineUpdate and OpenUpdate implement operator-task handling.
Caronte lists 194.156.79.165:55615 and its HTTP URL as endpoint candidates, alongside code references and the campaign marker cheat. They remain in the feed’s context section. Services such as ipinfo.io serve a separate public-IP or geolocation lookup role.
What to investigate
Correlate the file identity with managed-process browser and wallet access, Telegram or VPN data reads, and subsequent task-driven process execution. Review endpoint candidates with the affected environment’s network evidence.
LockBit
Research and attribution
The file carries the LockBit catalog label. Caronte rates the family only as possible: it found no LockBit-specific mutex, ransom-note filename, file extension or decryption ID. The US Department of Justice charged a Russian national with developing and operating LockBit. That concerns the ransomware operation; it does not identify who built or distributed this executable. DOJ charges.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658 |
| Catalog filename | ThermoCalc2026a-CrackedBy-DoCrackMe.exe.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-08-19 09:11:13 |
| Acquired size | 267,264 bytes |
File structure
An AMD64 PE with seven sections, no CLR header and WINHTTP.dll/WS2_32.dll imports.
Reverse-engineering findings
Strings are decoded with per-string modular multiplication, and an API-hash resolver caches function addresses. The code deletes shadow copies through WMIC, uses Restart Manager to unlock files, traverses drives and directories, and implements file encryption. CryptoAPI provider names and ChaCha constants appear in those routines.
The entry path at FUN_14001f880 passes the UTF-16 URL https://docrack.me into FUN_14001f480. Caronte traces WinHttpCrackUrl, WinHttpConnect, a GET request and a status check that allows the subsequent stage to proceed on a 2xx response. The endpoint’s documented role is an HTTPS execution gate. The filename also identifies a software crack; this check alone does not establish ransomware infrastructure or malicious ownership of the site.
We found the URL’s UTF-16LE bytes at file offset 236048 in the hash-verified sample. No server contact or sample execution was needed for that check. The feed includes the exact URL and hostname/TCP-443 pair.
What to investigate
Look for the file hash together with requests to the HTTPS execution gate, WMIC shadow-copy deletion, Restart Manager activity and rapid file changes.
Vidar
Research and attribution
Sekoia places Vidar in the Russian-speaking infostealer ecosystem. The family assignment for this file comes from MalwareBazaar; the Go implementation findings below are specific to its hash. Sekoia’s ecosystem research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2 |
| Catalog filename | Dol-stBootV2.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-11-08 15:49:40 |
| Acquired size | 4,780,992 bytes |
File structure
An AMD64 PE with eight sections and an 8,128-byte overlay. It has no CLR header. Build data identifies Go 1.23.5, the QuantumPointCollective module and 35 main-package functions.
Reverse-engineering findings
Caronte maps randomized main-package identifiers and a three-field template {{.canton}}:{{.field}}:{{.fly}}, alongside Adler32 and base32 operations. Windows interaction is routed through LoadLibrary, GetProcAddress, SyscallN and LazyProc.Call indirection.
Concrete API literals include VirtualAlloc and GetModuleFileNameW. The analysis separates roughly 540 KB of unreferenced, high-entropy .rdata padding from code-referenced data, using pointer, relocation and RIP-relative reference checks.
The module name and template are useful markers for comparing this file with other Go artifacts. Vidar remains the catalog label: the findings above do not establish browser theft, a network destination or a later payload.
What to investigate
Use exact-file identity together with the Go module and template markers when grouping related artifacts. Examine process ancestry and any separately recovered stage before assigning family-wide collection behavior to a matching host.
Stealc
Research and attribution
Sekoia reports StealC use in campaigns involving Russian-speaking criminal groups. MalwareBazaar labels the selected file Stealc. Stealc remains the catalog label: the findings below describe Go code and build artifacts and do not show stealer behaviour. Sekoia’s campaign research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f |
| Catalog filename | OurNew.exe |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-11-07 15:52:34 |
| Acquired size | 3,443,648 bytes |
File structure
An AMD64 PE with eight sections, an 8,128-byte overlay and no CLR header. Its build module is SterlingFieldVentures.
Reverse-engineering findings
The report identifies 37 renamed main-package functions while the surrounding Go runtime and syscall symbols retain their standard names. Build information records trimpath and CGO_ENABLED=0.
Three unreferenced .rdata runs total roughly 694 KB. Their byte differences repeat a +25/-3 arithmetic progression with period-256 autocorrelation, supporting their identification as generated filler.
The feed groups the application module, registry and API markers, Go runtime tables and certificate-validation URLs by their roles. Region fingerprints identify byte ranges within this file, not separately acquired payloads.
What to investigate
Search for the file hash, module name and renamed application symbols. For host matches, inspect the parent process and network activity to determine how the executable was used.
Rhadamanthys · two retained specimens
Research and attribution
Sekoia documents Rhadamanthys use by Russian-speaking criminal groups. The two files here carry that catalog label; the reverse-engineering findings apply to the smaller specimen. Rhadamanthys remains the catalog label: the findings describe the packed-loader structure and do not show stealer behaviour. Sekoia research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5 |
| Catalog filename | 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5 |
| Catalog file type | exe |
| Catalog first seen, UTC | 2026-08-10 14:44:46 |
| Acquired size | 766,976 bytes |
File structure
The analyzed file is the 766,976-byte AMD64 PE beginning 6e837d22a6be. The second specimen, beginning 7ca011030bdb, is 32,276,994 bytes and has its own hash records.
Reverse-engineering findings
Caronte identifies a 294,912-byte encrypted .data blob beginning at file offset 0x6a600, preceded by a plaintext offset table. A compiled Rijndael implementation includes forward and inverse AES S-boxes at 0x140055d20 and 0x140056d30.
LoadLibraryA and GetProcAddress populate a writable .fptable section at runtime. VirtualProtect calls at 0x140046390, 0x140046869 and 0x14004689a accompany the table and memory-permission transitions. The code uses CRC32 tables and a repeated arithmetic base constant 0xa6e3f6f3215ead45.
The encrypted blob, offset table and runtime API resolution describe the smaller file’s packed-loader structure. All addresses and region fingerprints in this report refer to its SHA-256.
What to investigate
Look for the smaller file’s hash alongside dynamic API resolution, .fptable writes and executable-page transitions. Compare the larger specimen separately.
The Gentlemen
Research and attribution
Check Point describes The Gentlemen as a Russian-speaking ransomware operation. The selected ELF carries the Gentlemen family signature in MalwareBazaar. Check Point’s ransomware research.
The acquired specimen
| Field | Verified record |
|---|---|
| SHA-256 | 53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa |
| Catalog filename | boom |
| Catalog file type | elf |
| Catalog first seen, UTC | 2026-10-22 18:10:35 |
| Acquired size | 2,490,504 bytes |
File structure
An x86-64 ELF, executable type 2, with Go functions and command-line options.
Reverse-engineering findings
The encryption tool requires password and target-path arguments and provides delay, silent, keep and wipe options, plus partial-encryption modes covering 27%, 9%, 3% or 1% of a file. The report identifies an embedded X25519 public key and linked AES, SHA and HMAC routines.
A pre-encryption command sequence mounts selected storage, stops Docker and Podman containers, powers off Nutanix guests, stops database services and Synology packages, and removes multiple log and recovery-related locations. The report also maps gautostart.service and an @reboot cron entry.
README-GENTLEMEN.txt supplies a victim identifier and negotiation contacts: a Tor site, a clearnet mirror, a SimpleX invitation and a TOX identifier. The feed labels them as ransom-note contacts; they are not identified as the executable’s command channel.
What to investigate
Correlate the ELF hash and command-line invocation with mass service/container shutdown, new autostart entries, ransom-note creation and file transformation. Separate negotiation-contact evidence from process-generated network traffic.
Caronte findings explained
Explore the 19 Caronte analyses retrieved on 9 November in the graph below. Caronte is the central node; select a malware node to open its saved analysis, including related files. Use the section index to jump to a finding, or expand all sections to read the saved record. The sections include technical summaries, family classifications, execution flow, functions and code locations, configuration, payload and C2 reconstruction, communication profiles, evasion, YARA assessments and scoring. The evidence trail includes inspection methods, locations, byte ranges and artifact hashes. Two saved responses, the Gorbag workbook and Lumma, are truncated.
The artifact cards state whether a value is a reviewed indicator or context, such as a service template or code constant. Extracted files have their own hashes.
Full malware-analysis details
Caronte combines reverse engineering with malware detonation in the Azazel sandbox. These 19 saved analyses contain static findings. Explore 17 cases: select a sample for its functions, payloads, C2, YARA assessments and supporting evidence.
CaronteRE + SANDBOX Try a malware name or part of a SHA-256 hash.
Download the indicator feed
Download the 9 November edition in English STIX 2.1 or MISP. Both contain the same 71 reviewed indicators, their sources and the associated file hashes. Network entries describe recovered configuration. Our own byte checks were static, but Caronte’s analysis made network requests to extracted endpoints in 11 of the 17 cases: it fetched some pages, including the docrack.me home page, while attempts to reach Prime’s 89.44.9.186:3240 and ChocoShell’s server failed. These requests are analysis activity, not evidence of malware execution. We have not rechecked endpoint availability for publication.
The 71 indicators comprise 60 file hashes—three algorithms for each of the 20 files—and 11 network indicators. Configuration templates, code constants and other hunting artifacts accompany them as context.
STIX stores contextual findings in Notes. MISP has 135 deduplicated context attributes from 140 case observations, plus 18 EventReports. These cover service templates, local defaults, code constants and ransom-note contacts. Automatic correlation is disabled for context attributes. All attributes have to_ids=false; the MISP event is unpublished and restricted to the importing organisation.
For import and matching:
- Use SHA-256 to group file records; SHA-1 and MD5 are alternate hashes of the same files.
- Match the exact webhook paths and destination ports. Their hosting services also have legitimate users.
- Apply ChocoShell’s documented query variants: STIX includes the patterns, and MISP provides matching notes.
- Keep RedLine’s unvalidated endpoint candidate in context; it is excluded from detection indicators.