stealerium | c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac15ae1e49f4272e8d38b5fd5573ce35.exe
Size 81KB
Sample240130-egsgnagab2
SHA256 c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149
MD5 ac15ae1e49f4272e8d38b5fd5573ce35
SHA1 93a70b449926995d458b9513b8b36e988f73dc8a
SHA512 23d7977aeac5a2f1856861519b34dbbd4aa52ed003d4001b73435024266d258d765613a3be8a1e2ae67548f9eb69f662925d663f8321f1610f200af6258025f8
SSDEEP 1536:D7Vs/tSdQLcSjAA0C0rEr2ofgNTX0g/+PmN/10BmglZqiqazVkP5tJCFPzRUR2lX:D5MmQLcxAarEDINTD/+Pmn0BmgnpzmcP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium zgrat collection rat spyware stealer

Malware Config

Extracted

Family

stealerium

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/2888-5-0x0000000008710000-0x0000000008C7A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-6-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-7-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-9-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-11-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-13-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-15-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-17-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-19-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-21-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-23-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-27-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-25-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-29-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-31-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-33-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-35-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-37-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-39-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-41-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-43-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-45-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-47-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-49-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-51-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-53-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-55-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-57-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-59-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-61-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-63-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-65-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-67-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1
behavioral2/memory/2888-69-0x0000000008710000-0x0000000008C74000-memory.dmp	family_zgrat_v1

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	ac15ae1e49f4272e8d38b5fd5573ce35.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	@dr@[email protected]

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Update.exe	@dr@[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Update.exe	@dr@[email protected]

Executes dropped EXE 3 IoCs

pid	Process
2936	@dr@[email protected]
4832	build.exe
4624	CamSnap.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	4832	WerFault.exe	96

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	build.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
4832	build.exe
4832	build.exe
4832	build.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe
Token: SeDebugPrivilege	2936	@dr@[email protected]
Token: SeDebugPrivilege	4832	build.exe
Token: SeSecurityPrivilege	2180	msiexec.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1552	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	95
PID 2888 wrote to memory of 1552	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	95
PID 2888 wrote to memory of 1552	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	95
PID 2888 wrote to memory of 4060	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	94
PID 2888 wrote to memory of 4060	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	94
PID 2888 wrote to memory of 4060	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	94
PID 2888 wrote to memory of 4384	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	88
PID 2888 wrote to memory of 4384	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	88
PID 2888 wrote to memory of 4384	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	88
PID 2888 wrote to memory of 4744	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2888 wrote to memory of 4744	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2888 wrote to memory of 4744	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2888 wrote to memory of 3928	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	91
PID 2888 wrote to memory of 3928	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	91
PID 2888 wrote to memory of 3928	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	91
PID 2888 wrote to memory of 4756	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	90
PID 2888 wrote to memory of 4756	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	90
PID 2888 wrote to memory of 4756	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	90
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2888 wrote to memory of 1824	2888	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 1824 wrote to memory of 2936	1824	ac15ae1e49f4272e8d38b5fd5573ce35.exe	97
PID 1824 wrote to memory of 2936	1824	ac15ae1e49f4272e8d38b5fd5573ce35.exe	97
PID 1824 wrote to memory of 4832	1824	ac15ae1e49f4272e8d38b5fd5573ce35.exe	96
PID 1824 wrote to memory of 4832	1824	ac15ae1e49f4272e8d38b5fd5573ce35.exe	96
PID 1824 wrote to memory of 4832	1824	ac15ae1e49f4272e8d38b5fd5573ce35.exe	96
PID 2936 wrote to memory of 4624	2936	@dr@[email protected]	100
PID 2936 wrote to memory of 4624	2936	@dr@[email protected]	100
PID 4832 wrote to memory of 1040	4832	build.exe	105
PID 4832 wrote to memory of 1040	4832	build.exe	105
PID 4832 wrote to memory of 1040	4832	build.exe	105
PID 1040 wrote to memory of 1624	1040	cmd.exe	108
PID 1040 wrote to memory of 1624	1040	cmd.exe	108
PID 1040 wrote to memory of 1624	1040	cmd.exe	108
PID 1040 wrote to memory of 3524	1040	cmd.exe	109
PID 1040 wrote to memory of 3524	1040	cmd.exe	109
PID 1040 wrote to memory of 3524	1040	cmd.exe	109
PID 1040 wrote to memory of 4100	1040	cmd.exe	110
PID 1040 wrote to memory of 4100	1040	cmd.exe	110
PID 1040 wrote to memory of 4100	1040	cmd.exe	110
PID 4832 wrote to memory of 4884	4832	build.exe	117
PID 4832 wrote to memory of 4884	4832	build.exe	117
PID 4832 wrote to memory of 4884	4832	build.exe	117
PID 4884 wrote to memory of 3256	4884	cmd.exe	115
PID 4884 wrote to memory of 3256	4884	cmd.exe	115
PID 4884 wrote to memory of 3256	4884	cmd.exe	115
PID 4884 wrote to memory of 3216	4884	cmd.exe	116
PID 4884 wrote to memory of 3216	4884	cmd.exe	116
PID 4884 wrote to memory of 3216	4884	cmd.exe	116

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
"C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        
        PID:3524
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        
        PID:4100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 2924
      4⤵
      Program crash
      PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4884
- - C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
    "C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
      "C:\Users\Admin\AppData\Local\Temp\CamSnap.exe"
      4⤵
      Executes dropped EXE
      PID:4624
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:3144

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:3256

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ac15ae1e49f4272e8d38b5fd5573ce35.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac15ae1e49f4272e8d38b5fd5573ce35.exe.log
Size 1KB
SHA256 f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256
MD5 c3941d9fa38f1717d5cecd7a2ca71667
SHA1 33b5362675383b58b4166ed9f9a61e5aa6768d2e
SHA512 98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45
MD5 SHA1 SHA512

Submit Download

@dr@[email protected]

Path C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
Size 92KB
SHA256 0729cb927eb057acf0cfb1392a7d6ea3904efca670e2b15fc0358dc604b296a9
MD5 db1db944d15a0e73b92e0110276a32bc
SHA1 52316cb8d918733518dc684bf8a308454d753a2d
SHA512 186d31c263602015cc91ee3b78f2bdd1d285d02a8dc2bf17e9e4fe132f3b96be14a2c2acd873054539e1dd3316b8d7c82c522a9ad51b5beb56dfca4672fbf85d
SSDEEP 1536:T6+emAKTnKmQSNNzxURHE0l8kj0x8qdPonn011ZBRYOUr1jwkS2i:TwmDKrEm8aa8IPonn01Kr1jwkSP
MD5 SHA1 SHA512 SSDEEP

Submit Download

@dr@[email protected]

Path C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
Size 47KB
SHA256 9b6213486ab54b419a2bba93b40fb081c481cd0a5aba53f3517338958a4a22d9
MD5 7d94b62e7228aa24d9d615ce543414d1
SHA1 2b30facea676f15c07fa9b9b5b6ca7839d3eb75a
SHA512 b3c79aad0f96ccfc661f7da670c3cb1371271ea488fe07fa22f3cd75adc5696e6fd9e75078a737962d35e578e447c2b01d69b06daad38d75bd458e0292b9b6bd
SSDEEP 768:2Y6+emZaJztLKxFtZKmQyXb3NNzbagURHE0l8kj0x8qdFlonn0v6zy+GhQ:T6+emAKTnKmQSNNzxURHE0l8kj0x8qdA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 78KB
SHA256 4c8a524e7fa23252edaadca238b377a438a6240a45540b664662f5e58f539c6e
MD5 ccb34b0822f97823271f54f8f3317aef
SHA1 63208b33284d3577aa08ea5cc2acdc6e2c2eba35
SHA512 e19a228bf4d8cf61276b2f2872255269c894a9299970c44d5827feed6606821dbd863d71a00d294444a44f98800a71713bd998a5ac050622f793771a859efd9f
SSDEEP 1536:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2XbObiPUA7bf2OpzQw+gyuiHiuLCAGo4D9:KkkWWkk6nG8vvRRPPdqggyyAAux2XbOe
MD5 SHA1 SHA512 SSDEEP

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 92KB
SHA256 97a03af43afdff2cb79e15f7de780684ded4bd31f87f5cdac821844ad99dab0d
MD5 098a6c62ab4520953a52d8c84053269e
SHA1 92ba08d9b34114f1d412b33d2d1f0190fe20426d
SHA512 f55c35ff15f30820cf359d5dbf626a683e7ab2062d103b48d8869f60f0cfe9bb0d4ccd2efab9a835b32c09e0f7066b1071a3408ccea0c58e83c0821b244a106d
SSDEEP 1536:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2XbObiPUA7bf2OpzQw+gyuiHiuLCAGo4Dk:KkkWWkk6nG8vvRRPPdqggyyAAux2XbOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 94KB
SHA256 09d95d73ac6828138201142cc519ac46a0456db2ea71240c3fa51d569b0242aa
MD5 550628b16ef8c4e27c4081950cf8fd66
SHA1 ab11427c02cb53b70816b06d5a950b5f52c935eb
SHA512 e74009391d29a1c305edf099ed506c0d573e6b3bc1ea7230545af2d0fbefb02122a99b9810cdf3686634fe61cc560cc61a1939da1913167941b755dceda5ed01
SSDEEP 1536:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2XbObiPUA7bf2OpzQw+gyuiHiuLCAGo4Df:KkkWWkk6nG8vvRRPPdqggyyAAux2XbOW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autofills.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Autofills.txt
Size 234B
SHA256 5bc3a7ced261f235f4a30797ad96f803c9e022a95ad6bc7fedc06d0fd2a0abeb
MD5 6be6fdca0cfa94635b8689b2b0bf2bee
SHA1 379c61029b5443c3d3df7c770423e40618b36d15
SHA512 7955fb48977c971563b10420e379ebea01e42582a8dfe2719ec756dda7e757168031a58a3c9fef061c0abb6c799579f7c8b46de4fc5b4ab3519d735092848cd8
MD5 SHA1 SHA512

Submit Download

Histories.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt
Size 234B
SHA256 eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe
MD5 412ec159e4b14be1ca93db473e80acc2
SHA1 8909b6f7fc8715a749270b6ceb8f05f823f59fd3
SHA512 a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4
MD5 SHA1 SHA512

Submit Download

Passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Passwords.txt
Size 234B
SHA256 8a947e0921f9cfada15c19a72f0ff31b38ad4602106c6ee95685d61c223c9a35
MD5 36f6acc2229073f5bb4074cee73d1d5b
SHA1 b2adbb44350d984dff40c15fcbbeb3379c7ec0e5
SHA512 da8b627bd674ceb0da7e30ba543ab82ab694d3f6e0474b48ca343ee74e20147440d2205b6ce66f5caa2a39061dedd2ca4146e263fac9f146a228c5b5cba4aaad
MD5 SHA1 SHA512

Submit Download

Stealerium-Latest.log

Path C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log
Size 320B
SHA256 8440b832e76e67a1efa1e9cb714f4f9a44e8085ab91de1e42b584ab54d0ac775
MD5 7e44134c2971c088e32a25bb7a4cfc27
SHA1 0ae6c37a546699d871e60449e9225a79ec71ac53
SHA512 902b8fc80eb3aacd3c05cab653a26e55d04559b631b718412569d02981d3fa434d78d152b826bd70763e560f22f800c9d67deed2edb0f219b47333bb0db0de8a
MD5 SHA1 SHA512

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 45KB
SHA256 363917fd8f2abd3877c6baac7a8572550519258e4bcd219cdd28a36837245eec
MD5 a6635a39646b32c5504c4601765f3872
SHA1 c1e80bf3a60a0f0c059e96aba88957f1f14c9c1f
SHA512 0ef9a3fe068b1317ba2e18739aa8c9002d1be4a4fd789d27beceed9e4c9bd4c44e67e9ab91d1c67e429e4843a969434be3a318168b2a710d64c50487849e2831
SSDEEP 768:T3R/65uoijtU6Oxc+dDyycnXcjXAQGHtlWgE5SA87/ll/Zpu8UO+TXMVkOG2zJP0:DwrxNyycn7tDfMCw/BKaGTm795V
MD5 SHA1 SHA512 SSDEEP

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 1KB
SHA256 5c0dabbdfabeefebf94162eb4759280feccbe166668a35bf16393f251eb28bde
MD5 bb851671c57c35af348ee2a2b6126953
SHA1 c4ba1ac94bc814c748af7db68a844431b90ccb3b
SHA512 8de8eabc73305ef306b6a67f41d24baf6833caed2c73a6082f63e898ac3615dc324134dfb4ecae9df600be18ced3c63c87dfd1f0fc4be486c2c487115a3be1ef
MD5 SHA1 SHA512

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\a656771e61d467c3c5fb7c927bb190f1\Admin@FMAEQIOU_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

memory/1824-984-0x0000000075190000-0x0000000075940000-memory.dmp

Download

memory/1824-950-0x0000000005960000-0x000000000596A000-memory.dmp

Download

memory/1824-949-0x0000000005A40000-0x0000000005A50000-memory.dmp

Download

memory/1824-948-0x0000000005880000-0x0000000005912000-memory.dmp

Download

memory/1824-947-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/1824-946-0x0000000075190000-0x0000000075940000-memory.dmp

Download

memory/2888-940-0x00000000072D0000-0x000000000731C000-memory.dmp

Download

memory/2888-19-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-35-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-37-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-39-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-41-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-43-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-45-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-47-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-49-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-51-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-53-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-55-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-57-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-59-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-61-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-63-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-65-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-67-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-69-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-938-0x0000000003040000-0x0000000003041000-memory.dmp

Download

memory/2888-0-0x0000000000D80000-0x0000000000D9A000-memory.dmp

Download

memory/2888-939-0x0000000009110000-0x0000000009612000-memory.dmp

Download

memory/2888-941-0x0000000009BC0000-0x000000000A164000-memory.dmp

Download

memory/2888-31-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-29-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-25-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-945-0x0000000075190000-0x0000000075940000-memory.dmp

Download

memory/2888-27-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-23-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-21-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-33-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-17-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-1-0x0000000075190000-0x0000000075940000-memory.dmp

Download

memory/2888-15-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-13-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-2-0x0000000005880000-0x0000000005890000-memory.dmp

Download

memory/2888-11-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-3-0x0000000005710000-0x0000000005716000-memory.dmp

Download

memory/2888-4-0x0000000005730000-0x0000000005736000-memory.dmp

Download

memory/2888-5-0x0000000008710000-0x0000000008C7A000-memory.dmp

Download

memory/2888-6-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-9-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2888-7-0x0000000008710000-0x0000000008C74000-memory.dmp

Download

memory/2936-985-0x000001E574430000-0x000001E574440000-memory.dmp

Download

memory/2936-971-0x000001E571BA0000-0x000001E571D18000-memory.dmp

Download

memory/2936-1002-0x000001E5765E0000-0x000001E576630000-memory.dmp

Download

memory/2936-981-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

Download

memory/2936-1046-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

Download

memory/4624-999-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

Download

memory/4624-998-0x000001CB5E550000-0x000001CB5E56E000-memory.dmp

Download

memory/4624-1001-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

Download

memory/4832-982-0x0000000075190000-0x0000000075940000-memory.dmp

Download

memory/4832-983-0x0000000005090000-0x00000000050F6000-memory.dmp

Download

memory/4832-1049-0x00000000057D0000-0x00000000057D8000-memory.dmp

Download

memory/4832-1048-0x00000000057A0000-0x00000000057C6000-memory.dmp

Download

memory/4832-1047-0x0000000005710000-0x00000000057A2000-memory.dmp

Download

memory/4832-1051-0x0000000006600000-0x0000000006608000-memory.dmp

Download

memory/4832-1052-0x0000000006620000-0x000000000663E000-memory.dmp

Download

memory/4832-1050-0x00000000065F0000-0x00000000065FA000-memory.dmp

Download

memory/4832-980-0x00000000006A0000-0x0000000000832000-memory.dmp

Download

memory/4832-1000-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/4832-1119-0x0000000075190000-0x0000000075940000-memory.dmp

Download