gh0strat | abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
Size 3.6MB
Sample240603-ptplmsga24
SHA256 abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e
MD5 2e6670919c6543821f012cfc845334f4
SHA1 616b3a36aa0d2029bd7fba4701ca6ae72bbdec61
SHA512 3677002d409d38e0cb7ebbfe17201770dc636b33ba42372c8756a40937ff83e122a9f0e89b76190fcbd1ee09f5e13e583c63964c40c9bcd1e9124de1745e647a
SSDEEP 49152:wCwsbCANnKXferL7Vwe/Gg0P+WhI7vtCXWPtvz5crlBU50MOn:bws2ANnKXOaeOgmhI7vtCXWP5S+50P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3180-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3180-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3180-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/892-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/892-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/712-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/712-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/712-56-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233fe-5.dat	family_gh0strat
behavioral2/memory/3180-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3180-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3180-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/892-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/892-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/712-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/712-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/712-56-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240618500.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe

Executes dropped EXE 9 IoCs

pid	Process
2116	R.exe
3180	N.exe
892	TXPlatfor.exe
712	TXPlatfor.exe
4256	HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
4852	BlueStacksInstaller.exe
4880	HD-CheckCpu.exe
4536	HD-CheckCpu.exe
3468	Remote Data.exe

Loads dropped DLL 3 IoCs

pid	Process
2116	R.exe
4400	svchost.exe
3468	Remote Data.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3180-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3180-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3180-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3180-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/892-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/892-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/892-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/712-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/712-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/712-56-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240618500.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3132	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
4852	BlueStacksInstaller.exe
4852	BlueStacksInstaller.exe
4852	BlueStacksInstaller.exe
4852	BlueStacksInstaller.exe
4852	BlueStacksInstaller.exe
4852	BlueStacksInstaller.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
712	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3180	N.exe
Token: SeLoadDriverPrivilege	712	TXPlatfor.exe
Token: SeDebugPrivilege	4852	BlueStacksInstaller.exe
Token: 33	712	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	712	TXPlatfor.exe
Token: 33	712	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	712	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2116	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	83
PID 3760 wrote to memory of 2116	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	83
PID 3760 wrote to memory of 2116	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	83
PID 3760 wrote to memory of 3180	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	86
PID 3760 wrote to memory of 3180	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	86
PID 3760 wrote to memory of 3180	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	86
PID 3180 wrote to memory of 4544	3180	N.exe	89
PID 3180 wrote to memory of 4544	3180	N.exe	89
PID 3180 wrote to memory of 4544	3180	N.exe	89
PID 892 wrote to memory of 712	892	TXPlatfor.exe	90
PID 892 wrote to memory of 712	892	TXPlatfor.exe	90
PID 892 wrote to memory of 712	892	TXPlatfor.exe	90
PID 3760 wrote to memory of 4256	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	92
PID 3760 wrote to memory of 4256	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	92
PID 3760 wrote to memory of 4256	3760	abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	92
PID 4256 wrote to memory of 4852	4256	HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	93
PID 4256 wrote to memory of 4852	4256	HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe	93
PID 4544 wrote to memory of 3132	4544	cmd.exe	95
PID 4544 wrote to memory of 3132	4544	cmd.exe	95
PID 4544 wrote to memory of 3132	4544	cmd.exe	95
PID 4852 wrote to memory of 4880	4852	BlueStacksInstaller.exe	98
PID 4852 wrote to memory of 4880	4852	BlueStacksInstaller.exe	98
PID 4852 wrote to memory of 4880	4852	BlueStacksInstaller.exe	98
PID 4852 wrote to memory of 4536	4852	BlueStacksInstaller.exe	100
PID 4852 wrote to memory of 4536	4852	BlueStacksInstaller.exe	100
PID 4852 wrote to memory of 4536	4852	BlueStacksInstaller.exe	100
PID 4400 wrote to memory of 3468	4400	svchost.exe	103
PID 4400 wrote to memory of 3468	4400	svchost.exe	103
PID 4400 wrote to memory of 3468	4400	svchost.exe	103

C:\Users\Admin\AppData\Local\Temp\abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
"C:\Users\Admin\AppData\Local\Temp\abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3132
- C:\Users\Admin\AppData\Local\Temp\HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
  C:\Users\Admin\AppData\Local\Temp\HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\BlueStacksInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\BlueStacksInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\HD-CheckCpu.exe" --cmd checkHypervEnabled
      4⤵
      Executes dropped EXE
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\HD-CheckCpu.exe" --cmd checkSSE4
      4⤵
      Executes dropped EXE
      PID:4536

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:4108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240618500.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3468

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\backicon.png
Size 15KB
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
MD5 SHA1 SHA512 SSDEEP

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\custom.png
Size 17KB
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\installer_bg.jpg
Size 78KB
SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
MD5 3478e24ba1dd52c80a0ff0d43828b6b5
SHA1 b5b13bbf3fb645efb81d3562296599e76a2abac0
SHA512 5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d
SSDEEP 1536:/8jAVIA5IyKedQSsmprMWI/xKdefJeGhuvIDU1pY7EQGZRV3/X35ev:IAVPVsylI/xJfJHovsU1poEBZP/H5ev
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\installer_logo.png
Size 14KB
SHA256 9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183
MD5 e33432b5d6dafb8b58f161cf38b8f177
SHA1 d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a
SHA512 520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf
SSDEEP 384:APozDg4Z4zsdNDNDTex/fsjmL6XLVY1mp2cU:soDh9DcImMVY1mp2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\installer_minimize.png
Size 113B
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
MD5 SHA1 SHA512

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
MD5 SHA1 SHA512

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\setpath.png
Size 15KB
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
MD5 SHA1 SHA512 SSDEEP

Submit Download

unchecked_gray.png

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Assets\unchecked_gray.png
Size 192B
SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
MD5 e50df2a0768f7fc4c3fe8d784564fea3
SHA1 d1fc4db50fe8e534019eb7ce70a61fd4c954621a
SHA512 c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998
MD5 SHA1 SHA512

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\BlueStacksInstaller.exe
Size 623KB
SHA256 48e6dfbc66f740b46ed2530e94c3ce2f154586ded094b9aba9e913be0cd7a6a8
MD5 afaa1ff1ca826fbd182cd68285a6fd40
SHA1 25982bd191895b0fe69c673fcf18a1bcd481b3d7
SHA512 7f84ecab7e8f531ef5b9e9b72ab17a9c8da7d4c91839872dce59e838a2d82a5acbba59e0b5a12799b18cfee15b1e87a958bf649c4b512127bd0b03ae0e9c8f05
SSDEEP 12288:AZ+dDmzKGQST1B3ZMx1cD5ivB5b6MCy1n1e:FmzBRNZocDCnk
MD5 SHA1 SHA512 SSDEEP

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
MD5 SHA1 SHA512

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\HD-CheckCpu.exe
Size 200KB
SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
MD5 81234fd9895897b8d1f5e6772a1b38d0
SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
MD5 SHA1 SHA512 SSDEEP

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\Locales\i18n.en-US.txt
Size 19KB
SHA256 27d611a71edf36307a7ed0651f6c5910292ac7e2b68074a7e33d306b3d93ec45
MD5 206562eed57e938afe21fc6942fa8e59
SHA1 779e90fec866c0fd2f47da020651db71c89ec3dd
SHA512 275c3192a7aee28fad31beb521cf5e7c66010e7562ce244ba9fc4de352f35b4ab63180ed12a56ea0b1458c185e076e2d07ba6d8797467177d3c5b2ac14371b26
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNsU6+FKvtCFV30Y4TWEac:aBvGqaKPsL/ds893l+WfacWRGjV+qXOa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zS0A0961D7\ThemeFile
Size 80KB
SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
MD5 c3e6bab4f92ee40b9453821136878993
SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895
SSDEEP 1536:Vq0UZUzBB6YjhX8knUVXVqlp1D88p/LUP8f/MPFntuevdxG+PchojU1yZwbP8fZS:pUFmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.7MB
SHA256 eb0f5f9a7d0d328e67c8e250a41decc5bcb0fe3935ad4c2eb27063beaa99fe08
MD5 b5d8bb398b8becec50bbfdc050092b1d
SHA1 d62c9521e0585b74183b51d921fcb06d114e8932
SHA512 7602c55cf3bd117bdc39375ac1fdc1fc49953e0f31e277207f1f90747c32f2b38d445c99ef4c1f4df9b2565499fcb77fc259b37084d6bfd6d981d68fcb913dff
SSDEEP 24576:wCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHA:wCwsbCANnKXferL7Vwe/Gg0P+WhI7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_abe350c97682d509dae94c89366883d3ba5dd91ba20066ea23bc9d8238774d2e.exe
Size 911KB
SHA256 5e1a07cb244d9af7c4259cdccd1d7ba2837bb9b71793019985bd6f889fc9b1ce
MD5 7dc4321f6abf7303d24f192ab8539d70
SHA1 f88604f35ddbe7dfa37a03b7a3e5124573c46b99
SHA512 f1078365d637ce237e09590013253d22b3d5a1ee05e0d20d86f9a0d8ca4555d2ec5d07fe2b53adfe7a50089789c5c878b51ec8cc6561d42bcb55ad2eb721a686
SSDEEP 24576:AivtCXWeGKU9Txt9OkcUm/lKACzmav0Tg90n:FtCXWPtvz5crlBU50MOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
MD5 SHA1 SHA512 SSDEEP

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
MD5 SHA1 SHA512 SSDEEP

Submit Download

240618500.txt

Path C:\Windows\SysWOW64\240618500.txt
Size 899KB
SHA256 b83fd739f5e2b20d6b6ecbc4518d8d6fc09dab1472513d888ebc5514b97e1106
MD5 4866cb16aa02afad6eea275a17c34517
SHA1 a3252550f456e4f2b215699530f3609f7c194a6f
SHA512 da8b4c78f3cd2c8d384bf713540d37cd8eafb5f1e86264e24027ba19bd054e654b9447df12f53be4a2e770402beb52985fe35fbef13448c410c462888f466019
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX4:7wqd87V4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Remote Data.exe

Path C:\Windows\SysWOW64\Remote Data.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/712-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/712-56-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/712-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/892-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/892-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/892-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3180-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3180-19-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3180-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3180-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4852-190-0x000000001C300000-0x000000001C338000-memory.dmp

Download

memory/4852-191-0x000000001C2D0000-0x000000001C2DE000-memory.dmp

Download

memory/4852-177-0x0000000000A00000-0x0000000000A9E000-memory.dmp

Download

memory/4852-187-0x000000001CCC0000-0x000000001D1E8000-memory.dmp

Download

memory/4852-179-0x000000001B720000-0x000000001B788000-memory.dmp

Download

memory/4852-204-0x0000000020670000-0x0000000020678000-memory.dmp

Download