stealc | 86bb9a397e62d756578dbe6c40cc07050f2066db6fb5d54499e03469a7cdccd5

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02/09/2024, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66d5ddcec1520_shtr.exe
Size 206KB
Sample240902-tnj67avdkf
SHA256 86bb9a397e62d756578dbe6c40cc07050f2066db6fb5d54499e03469a7cdccd5
MD5 ab68db6a238464a75b669938a3512ae1
SHA1 48a7e2ed179d29d783d55fe610598474825bdf95
SHA512 b811a8f5d3d2fab469a97a9a0d59d6b132b4fecbc7048dd203d25c938e7047b487e9a85799f8d9b04c0e01f307f3ff1bd0c3af967a8813c3ab0d72c69650364c
SSDEEP 6144:DYwI7yviKKJGngBT7nI5n6gtJuMM2lxG5IvjKEO:DYwIueBT7IRntJuMPXZKEO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar default credential_access discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

vidar

https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

Detect Vidar Stealer 20 IoCs

stealer

resource	yara_rule
behavioral4/memory/1968-95-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-98-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-103-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-127-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-128-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-143-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-144-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-160-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-161-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-168-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-185-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-186-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-193-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-194-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/5532-232-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/1968-235-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/5532-242-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/5532-243-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/5532-258-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral4/memory/5532-259-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1500	AdminEGHJKFHJJJ.exe
4136	AdminDAAFIIJDAA.exe
108	FCAECAKKFB.exe
6080	GCGDGHCBGD.exe

Loads dropped DLL 4 IoCs

pid	Process
4800	RegAsm.exe
4800	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 1500 set thread context of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 4136 set thread context of 468	4136	AdminDAAFIIJDAA.exe	94
PID 108 set thread context of 1852	108	FCAECAKKFB.exe	104
PID 6080 set thread context of 5532	6080	GCGDGHCBGD.exe	111

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1472	468	WerFault.exe	94
2820	1852	WerFault.exe	104
3120	1852	WerFault.exe	104
2196	1852	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminEGHJKFHJJJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminDAAFIIJDAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCGDGHCBGD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FCAECAKKFB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66d5ddcec1520_shtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3480	timeout.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4800	RegAsm.exe
4800	RegAsm.exe
4800	RegAsm.exe
4800	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
1968	RegAsm.exe
5532	RegAsm.exe
5532	RegAsm.exe
5532	RegAsm.exe
5532	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2176	4060	66d5ddcec1520_shtr.exe	82
PID 4060 wrote to memory of 2176	4060	66d5ddcec1520_shtr.exe	82
PID 4060 wrote to memory of 2176	4060	66d5ddcec1520_shtr.exe	82
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4060 wrote to memory of 4800	4060	66d5ddcec1520_shtr.exe	83
PID 4800 wrote to memory of 400	4800	RegAsm.exe	85
PID 4800 wrote to memory of 400	4800	RegAsm.exe	85
PID 4800 wrote to memory of 400	4800	RegAsm.exe	85
PID 400 wrote to memory of 1500	400	cmd.exe	87
PID 400 wrote to memory of 1500	400	cmd.exe	87
PID 400 wrote to memory of 1500	400	cmd.exe	87
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 1500 wrote to memory of 1968	1500	AdminEGHJKFHJJJ.exe	89
PID 4800 wrote to memory of 1232	4800	RegAsm.exe	90
PID 4800 wrote to memory of 1232	4800	RegAsm.exe	90
PID 4800 wrote to memory of 1232	4800	RegAsm.exe	90
PID 1232 wrote to memory of 4136	1232	cmd.exe	92
PID 1232 wrote to memory of 4136	1232	cmd.exe	92
PID 1232 wrote to memory of 4136	1232	cmd.exe	92
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 4136 wrote to memory of 468	4136	AdminDAAFIIJDAA.exe	94
PID 1968 wrote to memory of 108	1968	RegAsm.exe	99
PID 1968 wrote to memory of 108	1968	RegAsm.exe	99
PID 1968 wrote to memory of 108	1968	RegAsm.exe	99
PID 108 wrote to memory of 2380	108	FCAECAKKFB.exe	103
PID 108 wrote to memory of 2380	108	FCAECAKKFB.exe	103
PID 108 wrote to memory of 2380	108	FCAECAKKFB.exe	103
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 108 wrote to memory of 1852	108	FCAECAKKFB.exe	104
PID 1968 wrote to memory of 6080	1968	RegAsm.exe	109
PID 1968 wrote to memory of 6080	1968	RegAsm.exe	109
PID 1968 wrote to memory of 6080	1968	RegAsm.exe	109
PID 6080 wrote to memory of 5532	6080	GCGDGHCBGD.exe	111
PID 6080 wrote to memory of 5532	6080	GCGDGHCBGD.exe	111
PID 6080 wrote to memory of 5532	6080	GCGDGHCBGD.exe	111

C:\Users\Admin\AppData\Local\Temp\66d5ddcec1520_shtr.exe
"C:\Users\Admin\AppData\Local\Temp\66d5ddcec1520_shtr.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEGHJKFHJJJ.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Users\AdminEGHJKFHJJJ.exe
      "C:\Users\AdminEGHJKFHJJJ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1968
      - C:\ProgramData\FCAECAKKFB.exe
        
        "C:\ProgramData\FCAECAKKFB.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:108
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:2380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1264
        8⤵
        Program crash
        
        PID:2820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1276
        8⤵
        Program crash
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1320
        8⤵
        Program crash
        
        PID:2196
      - C:\ProgramData\GCGDGHCBGD.exe
        
        "C:\ProgramData\GCGDGHCBGD.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5532
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HDBGHDHCGHCA" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDAAFIIJDAA.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\AdminDAAFIIJDAA.exe
      "C:\Users\AdminDAAFIIJDAA.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 1264
        6⤵
        Program crash
        
        PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 468 -ip 468
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1852 -ip 1852
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1852 -ip 1852
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1852 -ip 1852
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AEBGHD

Path C:\ProgramData\CAKKEGDGCGDA\AEBGHD
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

AEBGHD

Path C:\ProgramData\CAKKEGDGCGDA\AEBGHD
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

JDGCGD

Path C:\ProgramData\CAKKEGDGCGDA\JDGCGD
Size 20KB
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc
SSDEEP 24:TLYP1kwIrnLbXYFpFNYd+6UwcQ8ri5fB:TcPawkLLopFsU1+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDAKFC

Path C:\ProgramData\HDBGHDHCGHCA\HDAKFC
Size 112KB
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
SSDEEP 192:EAogLUJAIH9IqR2nrQTjHbRmn8HKuqrTPGTATVumQ6:EAofJAa9Ijnh8HKuqrTxVumQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JDGCGD

Path C:\ProgramData\HDBGHDHCGHCA\JDGCGD
Size 114KB
SHA256 51e234c09098ea32dd1422ce8304a043ace2962e24528988df220cc4f5358191
MD5 b90a70d7e385373c8edebf0c3ff549f0
SHA1 cdf4fb34071fc79c144fbd3a4d4a58c703701841
SHA512 b7c2f2a46d624148629e306b7298b4ed6eb5742c79458f84c5d70dd8e9159fd72996556988156bf6649d00e90b98cd9311ae037733a14abd7adb3eed8327ac3e
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cFqLVumf:I02m/lxhlnmhouHMVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

JEBKJD

Path C:\ProgramData\HDBGHDHCGHCA\JEBKJD
Size 10KB
SHA256 9ec49336ffbe79b410b811702a0910be82b270459e0d9e9eb006676ce84a9a42
MD5 b8638d6c7e15e7bf2ebbf58e3007aedb
SHA1 a5e2ff904f0b3ee4a7a43966a69806d7ebb02452
SHA512 2e373b1115ab29b03e15ee6b936a59af9412869171f8a168d5cbf5ae79e5b93af9c5c67f5a207174e13421895deb76499b2a9551dabb4a8d855c0c8139f7b205
SSDEEP 192:r5nMRefCNsU1Rf9tv2xCJ32cdx8TfOtb5xK0HaX3lUeSiBw8VF:vq1R3vkQj0TUtaZw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\ProgramData\freebl3.dll
Size 669KB
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
SSDEEP 12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\msvcp140.dll
Size 439KB
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
SSDEEP 12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\ProgramData\softokn3.dll
Size 251KB
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP 6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\ProgramData\vcruntime140.dll
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminDAAFIIJDAA.exe

Path C:\Users\AdminDAAFIIJDAA.exe
Size 334KB
SHA256 c45735085c630196f711708160c78f204d8fa3fd36dc7c49cfc039442ae4c9d7
MD5 24b1ff1f8ba8c5e20613a652b7ddcafb
SHA1 48cb72e8fb1bb1d586ccde26de74154130d2b219
SHA512 d277a6a0830dabc5b7d535f3d84c948a70ae3fd9a16948b55ccd69340726390f6346c91098c0a48d8f40cb76a83299fcfccf92b59675f36692b8537bbd720c8c
SSDEEP 6144:FxpZyOaZfFb7BrazG0/yWbFmss4GgI7k4nab/hY/ryS4tURNBFmfa8X7HqvIJ3EO:FxLyrRFb7hoG06WbFmhs4naIGtU5FQZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminEGHJKFHJJJ.exe

Path C:\Users\AdminEGHJKFHJJJ.exe
Size 282KB
SHA256 90c0395f668f198d1aed010aaabbdab7c7f78b5a8c90072f4a2225683ebaac36
MD5 9d1e5520a634731ed9747be9e9af7c5d
SHA1 6bc547c7e26073f71be0017e29c8702ddea2fc11
SHA512 3cc597e4b451252361707740fe58ea18ff8734a9adad48458760518d1828beb55bd0ddb080daf7c1a29cda462b7cabab3c3829fc5c811b1d3069a5d507b7cbaa
SSDEEP 6144:A2nQ8BC0EIUnhElVMKMBMmhRbEiy+ssEO:pnQ8BCYhli3npyyEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 2KB
SHA256 2e0e9be598d0f657d9f1f3b4ff8bc5151751b7a639216bf362a40c6453cd6ce2
MD5 221cbda4be9defbf02dfd97302d75c46
SHA1 0d21680154fd26b408730476d1aaf6a845a929f3
SHA512 6c7299a7520afdd37872302dcb33cb732688e94e99674889aef12cd45a7be9213ffd3dbe22f39ec0d1a588f342cab24255cee6fa1d129185ec33c8aa7c84b305
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 235b6b76edce553b578f71630f2142d5912707668009d1d6e9616af094c0e966
MD5 3e10c8ad351895a4c7f0d67f068fe698
SHA1 7a78e8a78b1b5991152f4de1e2d4d5eb259cb942
SHA512 a2296585db1716f904f2758362207060b4bb3898556c43ef5bbfc1bb54bd2d3b36ebd84ff4791053ead37647561b07cbd526048d10c648c1060a89de5ffb8e0a
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 1KB
SHA256 cc4813486165df18b36b09814922c3f054897170ae412a7aa13c1178e25cf56c
MD5 4eb9f3b5c13e5f37ea56ec2861b48419
SHA1 5496b7e9b7d004f454fbfaa9a6b979e15ef44eb0
SHA512 13d71c96d91f116423918d6b0efa74e9d37eb8a876c44f7560f4bee21b74f5ebbb71d31198da5b344cbe03765bf1cc886f1e741fca68df9ee1a97773955d2579
MD5 SHA1 SHA512

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 458B
SHA256 b20ad68ff93ffb81c7c14fcc43af20d02495655d10e755a64ad474c7ca80a7ca
MD5 2f3d77fee3e0da82eb6dfaf59e4de76e
SHA1 5c9ae4c1cd5dd062c5a8c4fb51bd01b2ddc680a7
SHA512 bf64794e21a6d335e95fd53fc6ebe8913653589df750600d43c359c206064b5ea869f061418fc999aca7d9855a859b161cc75955f7df6c3447d7fa7f2f20763d
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 8f7087ee87f36403a48607704edc160a4bdcd310e72d14d8b3d9472c5e833856
MD5 27d7f925abbcf11030fb1cbe813b84a9
SHA1 aea4c0e7cf8bf74994f53011dd619d83b0cfe18c
SHA512 da9812fb6f06fc2ff3b8190655a5fb905270145e52832373ede3f3f34f64b39e82f77592812f8142a0998f078a832a276f72f36b97fa8dcd4d6a020071b265d4
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 458B
SHA256 dff826d6f708d57a1bdc841de8ac0cdb434981b1001483dd4d08b6f44316bf81
MD5 0f85ddbcb4599d766baf0f08b7795880
SHA1 d60edee0a8770709482687830d42cc21705941ec
SHA512 412f2253671ec9c5608fbe35ae3fdd96583275d6394a9048ce868ae0a9c4a40c389b74c9d4f1238d641746fcc020da49e06400775b91d63feca96d0abcee49b3
MD5 SHA1 SHA512

Submit Download

GCGDGHCBGD.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GCGDGHCBGD.exe.log
Size 425B
SHA256 85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4
MD5 bb27934be8860266d478c13f2d65f45e
SHA1 a69a0e171864dcac9ade1b04fc0313e6b4024ccb
SHA512 87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb
MD5 SHA1 SHA512

Submit Download

memory/468-109-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/468-113-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/468-111-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1500-102-0x0000000072210000-0x00000000729C1000-memory.dmp

Download

memory/1500-89-0x0000000000BD0000-0x0000000000C1A000-memory.dmp

Download

memory/1500-90-0x000000007221E000-0x000000007221F000-memory.dmp

Download

memory/1968-95-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-235-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-160-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-143-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-161-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-168-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-130-0x0000000022940000-0x0000000022B9F000-memory.dmp

Download

memory/1968-185-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-128-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-127-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-144-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-186-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-103-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-193-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-194-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1968-98-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/4060-0-0x000000007428E000-0x000000007428F000-memory.dmp

Download

memory/4060-57-0x0000000074280000-0x0000000074A31000-memory.dmp

Download

memory/4060-7-0x0000000074280000-0x0000000074A31000-memory.dmp

Download

memory/4060-1-0x0000000000D20000-0x0000000000D58000-memory.dmp

Download

memory/4136-107-0x0000000000410000-0x0000000000468000-memory.dmp

Download

memory/4800-6-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4800-58-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4800-10-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4800-8-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4800-260-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/4800-3-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/5532-242-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5532-258-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5532-244-0x00000000226D0000-0x000000002292F000-memory.dmp

Download

memory/5532-243-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5532-259-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5532-232-0x0000000000400000-0x0000000000657000-memory.dmp

Download