stealerium | 6ba75d8e032bf1a23d50f4426c9f00444bec1b5396f29042a72b652a515b4247

Analysis

max time kernel
148s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01a908923cbc76874658c47d432424a0.exe
Size 86KB
Sample240130-ejskfahcgm
SHA256 6ba75d8e032bf1a23d50f4426c9f00444bec1b5396f29042a72b652a515b4247
MD5 01a908923cbc76874658c47d432424a0
SHA1 5397fdeeb8e9365b3d9a6b8f599e658e050de1d7
SHA512 77b789fd17f8ea650ecb68a04238b195d1cfea9885f7fce637c83bfada95974326831b610509e18b5886fe48bb5ec0f70b57a835bc565af655a7ab0253614140
SSDEEP 1536:Em65rG4SzbXVzjvf1nRmyr20DmjyleT0FfWU4f23F0Wbub7B4B/:E6HXVzhvI0FfWU4O10kuPKF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium zgrat collection rat spyware stealer

Malware Config

Extracted

Family

stealerium

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/4048-3-0x00000000087B0000-0x0000000008D1A000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-4-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-5-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-7-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-9-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-11-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-15-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-13-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-19-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-21-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-23-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-25-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-27-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-29-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-31-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-33-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-35-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-37-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-39-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-17-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-41-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-43-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-45-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-47-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-49-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-51-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-55-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-57-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-53-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-59-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-61-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-65-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-63-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1
behavioral2/memory/4048-67-0x00000000087B0000-0x0000000008D14000-memory.dmp	family_zgrat_v1

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	01a908923cbc76874658c47d432424a0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	KORID0R.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Update.exe	KORID0R.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Update.exe	KORID0R.exe

Executes dropped EXE 3 IoCs

pid	Process
1092	KORID0R.exe
3972	build.exe
2640	CamSnap.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com
36	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe
3972	build.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	01a908923cbc76874658c47d432424a0.exe
Token: SeDebugPrivilege	1092	KORID0R.exe
Token: SeDebugPrivilege	3972	build.exe
Token: SeSecurityPrivilege	4916	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	build.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4048 wrote to memory of 4588	4048	01a908923cbc76874658c47d432424a0.exe	92
PID 4588 wrote to memory of 1092	4588	01a908923cbc76874658c47d432424a0.exe	100
PID 4588 wrote to memory of 1092	4588	01a908923cbc76874658c47d432424a0.exe	100
PID 4588 wrote to memory of 3972	4588	01a908923cbc76874658c47d432424a0.exe	95
PID 4588 wrote to memory of 3972	4588	01a908923cbc76874658c47d432424a0.exe	95
PID 4588 wrote to memory of 3972	4588	01a908923cbc76874658c47d432424a0.exe	95
PID 1092 wrote to memory of 2640	1092	KORID0R.exe	99
PID 1092 wrote to memory of 2640	1092	KORID0R.exe	99
PID 3972 wrote to memory of 2384	3972	build.exe	106
PID 3972 wrote to memory of 2384	3972	build.exe	106
PID 3972 wrote to memory of 2384	3972	build.exe	106
PID 2384 wrote to memory of 784	2384	cmd.exe	110
PID 2384 wrote to memory of 784	2384	cmd.exe	110
PID 2384 wrote to memory of 784	2384	cmd.exe	110
PID 2384 wrote to memory of 972	2384	cmd.exe	108
PID 2384 wrote to memory of 972	2384	cmd.exe	108
PID 2384 wrote to memory of 972	2384	cmd.exe	108
PID 2384 wrote to memory of 3796	2384	cmd.exe	107
PID 2384 wrote to memory of 3796	2384	cmd.exe	107
PID 2384 wrote to memory of 3796	2384	cmd.exe	107
PID 3972 wrote to memory of 2760	3972	build.exe	115
PID 3972 wrote to memory of 2760	3972	build.exe	115
PID 3972 wrote to memory of 2760	3972	build.exe	115
PID 2760 wrote to memory of 3964	2760	cmd.exe	112
PID 2760 wrote to memory of 3964	2760	cmd.exe	112
PID 2760 wrote to memory of 3964	2760	cmd.exe	112
PID 2760 wrote to memory of 4336	2760	cmd.exe	113
PID 2760 wrote to memory of 4336	2760	cmd.exe	113
PID 2760 wrote to memory of 4336	2760	cmd.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe
"C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe
  C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3972
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        
        PID:972
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:784
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2760
- - C:\Users\Admin\AppData\Local\Temp\KORID0R.exe
    "C:\Users\Admin\AppData\Local\Temp\KORID0R.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1092

C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
"C:\Users\Admin\AppData\Local\Temp\CamSnap.exe"
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:3964

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\Directories\Videos.txt
Size 23B
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\System\Apps.txt
Size 5KB
SHA256 b2a09980fccbdaa79f42dde31228d126f41fe2b0b32545e0fafae0ba1c5ba06d
MD5 fc1ec0cabb320b59693fa9a94fbbb93b
SHA1 9ce87f376d9c0d241a100651135143e57bd023e1
SHA512 b6de2cc74128e8c524babbc4e27972d0a567016173fb88fa3da4ebbf1e11555e76c1d5a2e1cccaed9024e5b88ce05cb22b33a21f13f53dfd6bee525c2e51f14d
SSDEEP 96:Ofp0X3fp0XPfp0mFfymQNpJfzQWEfdpKEfdDzfytvufzbfFZSfFZaiRpqffItrhv:wp0/p03p0iyTzn2dw2dXyyz7DsDkILIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Debug.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\System\Debug.txt
Size 1KB
SHA256 040b15d8981e0e3478fd3635fe9c3de3c83606bb94568763fbde9c5083c03f3e
MD5 c8ab0266b6df954614ce438b9c8821b1
SHA1 60e529c53b26c1e8f8a17eca4c810ab5a2c22681
SHA512 74a8d09d5a40be5821e836c37b19b249b118aa208525e6d918a9c1042698f4534a837b2ce4a2c7ddc0ce6ac5fe1dcf6a19f189b899c3f0f1b6fbaedf74bc7d22
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\System\Process.txt
Size 4KB
SHA256 f60758dfdb7b7c2ca8519c638912e2d96718cb9594bc2ed03f4dbe5e82fccea2
MD5 b09c719cb4032b045d7e9e3ac636bb16
SHA1 5ec072866582156edf8aa89f0d930c31d3f86ceb
SHA512 eec875a343cf0240c7d516f659c2845653af7aff5dc2f20be14950b6f7d706e1cc6a12b5308d57929c6a9156219298f8db7a156cfc8b39afc35fa02428ce8812
SSDEEP 48:gYObcIMb1unFMwi23i3JHVs2uFfTpllp/iNtEi+YgYKW:pOwIMBcqwi23i35aVF7Hlp/ijEi+YgYv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\Admin@AVCIKYMG_en-US\System\ProductKey.txt
Size 29B
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
MD5 SHA1 SHA512

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\8a9daa87b894ce5ab32ff416185f80c4\msgid.dat
Size 19B
SHA256 c6fa6d901b81abc2aef38f9db056012545ab593bd4ccb5a1658d352f09c23c3a
MD5 6ff76db9cb5c485bf793f26873fdb6a9
SHA1 2fc5561a33e3bdcead202c0658f3bbc96acb8b1d
SHA512 291fbeea82ff4b161f76f34d9fa4efe878692f4ca1d6bbb68f15b9c81540856b2d678f2439bdd5c3624584ae8d4864b49161235fb37cb61e2d45bb0d2bc8d178
MD5 SHA1 SHA512

Submit Download

01a908923cbc76874658c47d432424a0.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\01a908923cbc76874658c47d432424a0.exe.log
Size 1KB
SHA256 f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256
MD5 c3941d9fa38f1717d5cecd7a2ca71667
SHA1 33b5362675383b58b4166ed9f9a61e5aa6768d2e
SHA512 98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45
MD5 SHA1 SHA512

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 94KB
SHA256 09d95d73ac6828138201142cc519ac46a0456db2ea71240c3fa51d569b0242aa
MD5 550628b16ef8c4e27c4081950cf8fd66
SHA1 ab11427c02cb53b70816b06d5a950b5f52c935eb
SHA512 e74009391d29a1c305edf099ed506c0d573e6b3bc1ea7230545af2d0fbefb02122a99b9810cdf3686634fe61cc560cc61a1939da1913167941b755dceda5ed01
SSDEEP 1536:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2XbObiPUA7bf2OpzQw+gyuiHiuLCAGo4Df:KkkWWkk6nG8vvRRPPdqggyyAAux2XbOW
MD5 SHA1 SHA512 SSDEEP

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 31KB
SHA256 1a5dd5c0e3b007c6dc5cf866305f3f97fef34da70901d1e63a6bbff0415205d4
MD5 db1ad8b3140e175688f766be0d21649c
SHA1 f4ab6e40d4ff4cfc0cb82a152ebed24d62bc3758
SHA512 0131643df7ef1f2cedccfb6b129e62cc820460f7b80b59092753209d6242e8ef2b3d012c311d9036fc842bf30482cdcd4f670f2e85bd7e62ff1e7d0dbf1b235d
SSDEEP 768:yfBkkWWkk6nG3MvvRRPPdMZrDHASUyggyyAAuX3/pOglqjNXbbx8TBa/sW:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2q
MD5 SHA1 SHA512 SSDEEP

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 25KB
SHA256 4bc4b4ee5976b76bbd22d949c84390a0ed7126496c9b1ae7961bcf04bbded34b
MD5 290f3f28f585a7aa7c755fedb89cda08
SHA1 42a68c847a2ec87001a5675efc992ae7f5a5c35c
SHA512 8e9f2027f66c9237da081cb1c8ce7b8708dd5aa200bcec596e657f7cdea5de576640851955b32e8c735bf17325d1748fa2d9209f13077d6efadf7d5c8008a22f
SSDEEP 768:yfBkkWWkk6nG3MvvRRPPdMZrDHASUyggyyAAuX3/pOglqjNXbbx8TBK:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Passwords.txt
Size 234B
SHA256 8a947e0921f9cfada15c19a72f0ff31b38ad4602106c6ee95685d61c223c9a35
MD5 36f6acc2229073f5bb4074cee73d1d5b
SHA1 b2adbb44350d984dff40c15fcbbeb3379c7ec0e5
SHA512 da8b627bd674ceb0da7e30ba543ab82ab694d3f6e0474b48ca343ee74e20147440d2205b6ce66f5caa2a39061dedd2ca4146e263fac9f146a228c5b5cba4aaad
MD5 SHA1 SHA512

Submit Download

KORID0R.exe

Path C:\Users\Admin\AppData\Local\Temp\KORID0R.exe
Size 42KB
SHA256 4810a91635a3c53c20d341a714011364b3bcd17dafebe4d4149b763d993bf7f0
MD5 5fbc18872aeccdce137570b192f2e7ea
SHA1 f1d9705394d904f3d743d9042dbc50aab3323c15
SHA512 daa1729353897491271c9f7364a74a4d5c7f85cf2634d3b1d035ed16884fdd816c277c9d05175fb39923d49d4b211bd4c8ba083ccb775605bc62928dba6dbdbf
SSDEEP 768:aY6+emZaJztLKxFtZKmQyXb3NNzbagURHE0l8kj0x8qdFlonn0e:X6+emAKTnKmQSNNzxURHE0l8kj0x8qdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

KORID0R.exe

Path C:\Users\Admin\AppData\Local\Temp\KORID0R.exe
Size 139KB
SHA256 a9a7bec31dc945463227c1fbf5bfd7de9059f74ef4032c4179e8611b17fa55b2
MD5 e1cc8f7f0ef77803018a95f3ffdef12d
SHA1 9374c190afef46ecf9b9fffa9ba75e0b9ea070df
SHA512 c0f96137036fc7c92b534eafffd8e821384899ae252824d8a99842835f9e9bd2266bb0e01cab6d1f47c2fb1bad1ced87ac35256b7950ee4b33a68dffc442b9e9
SSDEEP 3072:XwmDKrEm8aa8IPonn01Kr1jwkSPwmpSM4mSzrOKtoFDq:zDKrEm8aa8IPonn01Kr18JwmpSM4+XF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

KORID0R.exe

Path C:\Users\Admin\AppData\Local\Temp\KORID0R.exe
Size 1KB
SHA256 c604edffe63bc68cddf7db0762aa4f67576490d57fe2170a2a438552e0ad394f
MD5 80710ae711a766a6fe9771e40c3e5070
SHA1 7140dc8a9cdacd760edbf310e382ec98a76bb4af
SHA512 571b8b9c23006d2af60f9862b2b94c07c7f25725ec0c4a05be3bd6fdfdb798f9b32b80762dedfd397d8c02b85e576f0c0952f42c1ca3c6d2d62c0017b2910900
MD5 SHA1 SHA512

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 114KB
SHA256 e36077bdd7b31ccaba7810553ee1d7998d54bfa45539bb8c45667d94f59e3cd2
MD5 ae78afa639b6be826b791759fb63fda6
SHA1 966c315bc736da5e374068df08efb286e300355d
SHA512 985463f3510fd57795fe0348134283ed2109e6a2d31dfd22975faa5351970c97fceb56c80f3833960c30f11027deb31ba73fd3fa9a04fc603c976218ac0be382
SSDEEP 1536:DwrxNyycn7tDfMCw/BKaGTm795/EsVaJMssxI9dEAvmh1eeTqvG9Z6/kHHbQye+x:kba7FfMVKRU5/KMssx+uHh1efaZ6/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 56KB
SHA256 03b40bd0ac0e945f50e7e3558af3954a6c13da5608774d28c9ef0729892b3935
MD5 cc81fbe241bc83f6f49708f262108e2f
SHA1 1ba57b66810be1ecd6dac9ef130f1a95ac97de5e
SHA512 982ce0e10fbc5e88c9e748bf408fea2e112143d12816c784f4ee4e51e95683f1b1b3b37a6db1616624188bffe76074ea9b2d773136e86d737e640ac212604f54
SSDEEP 768:T3R/65uoijtU6Oxc+dDyycnXcjXAQGHtlWgE5SA87/ll/Zpu8UO+TXMVkOG2zJPl:DwrxNyycn7tDfMCw/BKaGTm795/EsVah
MD5 SHA1 SHA512 SSDEEP

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 313KB
SHA256 1a377c77897df2c785791306b3a76bd323c56f6f6858b3026603901dc22644ac
MD5 3e613369ef9b446f36681f8150db4c03
SHA1 29d46f06f2a52a234dc4126f421e38a3f2fe3dd3
SHA512 9e486104d351ed15f3090fee342b933a01f83b0ac8559b696ecba82eb2a64e01653d3363050646c27f68a13906609e356fa3abad595071fc5ac3d1a65b518176
SSDEEP 6144:kEfMyU5/Nssx+uLeiZUZKAMXDDAuy3sXlwEDbddtsfsTUDUGg1:kEfMAbxi2QRXDD1yed0fsU4Gi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-983-0x000001B672430000-0x000001B672440000-memory.dmp

Download

memory/1092-1041-0x00007FFF930F0000-0x00007FFF93BB1000-memory.dmp

Download

memory/1092-979-0x00007FFF930F0000-0x00007FFF93BB1000-memory.dmp

Download

memory/1092-975-0x000001B66FC30000-0x000001B66FDA8000-memory.dmp

Download

memory/1092-999-0x000001B672F80000-0x000001B672FD0000-memory.dmp

Download

memory/2640-997-0x00007FFF930F0000-0x00007FFF93BB1000-memory.dmp

Download

memory/2640-996-0x000001D9B8440000-0x000001D9B845E000-memory.dmp

Download

memory/2640-998-0x00007FFF930F0000-0x00007FFF93BB1000-memory.dmp

Download

memory/3972-1313-0x00000000065D0000-0x0000000006682000-memory.dmp

Download

memory/3972-1032-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/3972-1047-0x0000000004DF0000-0x0000000004DF8000-memory.dmp

Download

memory/3972-1046-0x0000000005360000-0x0000000005386000-memory.dmp

Download

memory/3972-1045-0x00000000052D0000-0x0000000005362000-memory.dmp

Download

memory/3972-1048-0x0000000004E00000-0x0000000004E0A000-memory.dmp

Download

memory/3972-1050-0x00000000062C0000-0x00000000062DE000-memory.dmp

Download

memory/3972-1049-0x00000000062A0000-0x00000000062A8000-memory.dmp

Download

memory/3972-1239-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/3972-1241-0x00000000064A0000-0x000000000651A000-memory.dmp

Download

memory/3972-980-0x0000000004D30000-0x0000000004D96000-memory.dmp

Download

memory/3972-1315-0x00000000066D0000-0x00000000066F2000-memory.dmp

Download

memory/3972-981-0x00000000746A0000-0x0000000074E50000-memory.dmp

Download

memory/3972-1316-0x0000000007B70000-0x0000000007EC4000-memory.dmp

Download

memory/3972-1318-0x00000000746A0000-0x0000000074E50000-memory.dmp

Download

memory/3972-978-0x0000000000340000-0x00000000004D2000-memory.dmp

Download

memory/3972-1329-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/3972-1330-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/4048-41-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-45-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-943-0x00000000746A0000-0x0000000074E50000-memory.dmp

Download

memory/4048-0-0x0000000000FC0000-0x0000000000FDC000-memory.dmp

Download

memory/4048-2-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Download

memory/4048-3-0x00000000087B0000-0x0000000008D1A000-memory.dmp

Download

memory/4048-4-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-939-0x0000000009B40000-0x000000000A0E4000-memory.dmp

Download

memory/4048-938-0x0000000008DA0000-0x0000000008DEC000-memory.dmp

Download

memory/4048-5-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-937-0x0000000009090000-0x0000000009590000-memory.dmp

Download

memory/4048-936-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/4048-67-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-63-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-65-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-61-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-59-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-53-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-57-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-55-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-51-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-49-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-47-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-7-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-43-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-1-0x00000000746A0000-0x0000000074E50000-memory.dmp

Download

memory/4048-17-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-39-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-37-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-35-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-33-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-31-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-29-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-27-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-25-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-23-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-21-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-19-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-13-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-15-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-11-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4048-9-0x00000000087B0000-0x0000000008D14000-memory.dmp

Download

memory/4588-947-0x0000000005A70000-0x0000000005A80000-memory.dmp

Download

memory/4588-982-0x00000000746A0000-0x0000000074E50000-memory.dmp

Download

memory/4588-945-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/4588-944-0x00000000746A0000-0x0000000074E50000-memory.dmp

Download

memory/4588-946-0x00000000058C0000-0x0000000005952000-memory.dmp

Download

memory/4588-948-0x0000000005870000-0x000000000587A000-memory.dmp

Download