sliver | 5dc8b08c7e1b11abf2b6b311cd7e411db16a7c3827879c6f93bd0dac7a71d321

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 99KB
Sample240930-pptpssvglm
SHA256 24385d352b83222dc5ab92fa57b6649854ecd74de378e279d8ac20a0b3b16009
MD5 9f12ba143f629152084c17c9cb9dc148
SHA1 ff1d704ff11695ab49074c45f05542b32ca00b9e
SHA512 421252c50737b3bc07f43cbcab9f34e6895d28c45027086142cb34101df6772c90aec9cc5b2d2695408c62f409bdc69260c68f7656745bb92659a6f0947c5e4d
SSDEEP 1536:IqRuhIxHHWMpdPa5wiE21M8kJIGFvb1Cwn/z5sz7SyUPx9c:IqYSwMpdCq/IM8uIGfV/z5szqx9c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sliver backdoor discovery trojan

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
behavioral8/memory/4544-1207-0x0000000213AD0000-0x00000002144DC000-memory.dmp	SliverRAT_v2

SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 3 IoCs

pid	Process
4484	Advanced_IP_Scanner.exe
4396	Advanced_IP_Scanner.tmp
4544	pythonw.exe

Loads dropped DLL 33 IoCs

pid	Process
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4396	Advanced_IP_Scanner.tmp
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe
4544	pythonw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner.tmp

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 4484	2160	setup.exe	82
PID 2160 wrote to memory of 4484	2160	setup.exe	82
PID 2160 wrote to memory of 4484	2160	setup.exe	82
PID 4484 wrote to memory of 4396	4484	Advanced_IP_Scanner.exe	84
PID 4484 wrote to memory of 4396	4484	Advanced_IP_Scanner.exe	84
PID 4484 wrote to memory of 4396	4484	Advanced_IP_Scanner.exe	84
PID 2160 wrote to memory of 4544	2160	setup.exe	85
PID 2160 wrote to memory of 4544	2160	setup.exe	85

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
  "C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\is-3TV7H.tmp\Advanced_IP_Scanner.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-3TV7H.tmp\Advanced_IP_Scanner.tmp" /SL5="$B0118,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4396
- C:\Users\Admin\AppData\Local\Notepad\pythonw.exe
  C:\Users\Admin\AppData\Local\Notepad\pythonw.exe C:\Users\Admin\AppData\Local\Notepad\slv.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__init__.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__init__.py
Size 2KB
SHA256 c33ff384c31cc8a6d095f1708bb2090b38563b3ee0a127a546ace5815a104aec
MD5 31c5de18019727c2dbb04f0a9d2b6caf
SHA1 d7efd7e56bdd5cedbbf1b1259726fc13a214e630
SHA512 0e28065b3e0727739532fd0d9a7752f76eafa1ac4af8146a9145320f333c57ddc8a89ead94458bef48809f047615c281c058ffa19bf0cd5239f14dc124d1a873
MD5 SHA1 SHA512

Submit Download

_mode_cbc.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_cbc.py
Size 11KB
SHA256 737447b035e06784504ba1de08f37b704b59d3f86e46388842b281860e5ac803
MD5 845406947584227c6c1f9f1178f604f8
SHA1 5b6dd35315d100a9da74634c72a6a5318da080d7
SHA512 9735ba8222b2dfaef6dc33f6c2bc2e9867f5dd497ce4dfd74338d24ea05d11da91cfc918cca317ef8f76afc75f05ead212872f9a0cc99d918928c25245fb31a0
SSDEEP 192:9qrskrs9t3q/IC/5xlJT9O+wU4/u+2U4OB0+gRz:0rskrs9VqNzJJ4TW+2TOBE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_mode_ccm.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_ccm.py
Size 24KB
SHA256 980583c12ebfe4fca03c8cfa6a813c134bfbbb0d804a9b50dbe4f4f808e828ca
MD5 ba799f1c166357601a3ca931ebcbd699
SHA1 fa695985ad6c1323eafe846fe486b6c24c76464f
SHA512 c96c610b81ed71a1007cc1eda463d6dd56c389de7a330bd9899fa12fd31eba97b36f8e6e928235a0e51b72fb4df9b551c1905f1623ca6562fa7766ee936a28f2
SSDEEP 192:9qrskrs9t3q/I+Nn1nXrBamtA6/c1VCO37n2x46g4wCu4gDNMVRWPv8GvvBsm:0rskrs9Vqj1n71/wf2x40wYgJMXWHzv5
MD5 SHA1 SHA512 SSDEEP

Submit Download

_mode_cfb.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_cfb.py
Size 10KB
SHA256 8a1f6035bfa01f6dbfd2dd2610e3bc8bb7d7b4db9bc8bc63d80aa42fc30d1569
MD5 1f99bc4ad70c9d9d823e087b64109d36
SHA1 64b5616367505d67b912b62a2a4137924e0c528a
SHA512 2ce953170c6f81e047d7b43ac2b5c0ca556197d65f9a2f280a8517f1dd9020741a70c7fb6820ee83e15f66d4473fd9d1d339b937cf03f38d44e34e1e4959a5e9
SSDEEP 96:dSMFQHvo5i4mILXEwOOscx2JL5qwG47W9stU4p2EVQd7T1qytU4epqtAVwqWFZb0:dSCQHvSyOH2JLcOqwU4SkYU44bKZDmJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_mode_ctr.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_ctr.py
Size 15KB
SHA256 b8f1a6a8d6af32ec989877fe2825cb62050bd5bb5f13d4ca3bb685eec94a7c51
MD5 469265d5a46060b924e0fb8eeda46a79
SHA1 d19afbb455578a82ec95babf539740d0e67b9f72
SHA512 9e1957b43205358092c1c67833b6e670c8480c4333b928fad473501d10d0a199f45886e930e772f8b9a85e7c5d353d3490727e2abfbc9e6354e9392b33ef55b0
SSDEEP 192:d5QHvCtxqH2LakMiITNEriO+uU44o2U4GzCgShWWwBil3iYelIisiSSZD:DeIF7AmT4o2TGzrShGaSnlL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_mode_ecb.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_ecb.py
Size 8KB
SHA256 d0a75e9cc56230e1c044411a1a6760ff7678d449e1263aeffef7e2752e360ff8
MD5 6cbc08e85c2f37d641be890f91b0c1f3
SHA1 54525c6cfb8431f5249fddde29b1cc27107f1d68
SHA512 89e08b33a85fddfa417cd6d3bf7c1bbec94f280c5d2dd43ae82d9a12c4cc25a9057b0e87f50ff27f1491c18c754aefa7daa190eeb0edd3baccbcfd6a5abe0a96
SSDEEP 96:dBFQHvoWnpqW8XSXMxJYuwG2m0/EfQb7nk+qIbpktAV7+qWKWJRI:dfQHv1z8XjJYuwVkZi7Z1WJRI
MD5 SHA1 SHA512 SSDEEP

Submit Download

_mode_ofb.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_ofb.py
Size 10KB
SHA256 ca448c52d111614036df2c489ca8150c4a6e3d31608ea76ce518d12bd7051524
MD5 701bf588bdf378dc9b22376f555a72d5
SHA1 53357492c8df955f5b9511dffa79271753d94495
SHA512 26d7f9f6bcac8f90adc3740c134faa68f7b6f5e34a1eb0a28e849be859d091b91b6d8777588fb1041aea7eb98b040eec30a2b57a6969d736e7f41a2f7242a8e7
SSDEEP 96:dLFQHvoPoxi4mILd52ALFxKiDqwG4rW9stU4p2EVQd77BqotU4SpqtAVsqW1vYhH:d5QHv/XwADKKqO6wU4SQ2U483avgQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_mode_openpgp.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_openpgp.py
Size 7KB
SHA256 46650bb1bb4a35ee304abac23817a48704babe4f93ecec4ce62ee97d49c44189
MD5 ea825091932b4cfc4f055f098a96940a
SHA1 1e5bb37cd61fdc47a24f32ee9dee5b4e277c6237
SHA512 f851f5a70c5e4be206849496c16fabea11cee30839a618aaa98ef3177e8c48946e8c4fb7dfdd1af90889d6470c1a4983fdaa7cb887bdc125170c8ab3dc3f60e2
SSDEEP 192:9qrskrs9t3q/ItB4RK0tUU4cp/6U41k2T:0rskrs9VqeJ0tUTccT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_cbc.pyd
Size 22KB
SHA256 67a9dab77636add5b40664715ac5f8e819669d9135f9771399f48a511738f576
MD5 65c8f7779eb42c0cb8b6f28a59d1cdf5
SHA1 8eee6c791fd709f7cac8b085b8ed0436752468f3
SHA512 0badeb94ac9d2e689c09e95d5215cc4c7e0da897aed726abe5286c5386677aa0081b7dc6bc23ec56f5044c97052ac1a9e9c8331702fe18370d8d7106f9b7adf2
SSDEEP 384:L5OH7LVilCS9HOxmbUDy3s/e3ZvYfDaRa/w/sGyL36SUlH:GLV9zEvSl5fLKS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_cfb.pyd
Size 23KB
SHA256 3927a407c7703b0103b93a1cd1e7493f99806407f95cc99a6ed92cbd64a92ab7
MD5 17327f64191cb4fed9bc1380847d3ff1
SHA1 f139bfb3ae59224c28e12bd7b5fc56e8224a9c27
SHA512 24082030495fc39864f408df872784940da3bcad96c8948e1e2c9341ec4b08ea10996e32c9698d04f73776631a6344286b6938d02e4b00c23d9eb1a96831be3c
SSDEEP 384:sih/LVilqSOH6vxbJ3KVFwdc1tvYfLOSYM/w/MKGyL36Mt:VLVwj1MvS73KfLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_ctr.pyd
Size 25KB
SHA256 3840fc7cabeb4bf9dc45fd923c61b775c71fec9d42b4e672c30ba4e111507042
MD5 46cbd5f5403355255b3c5a7616c2196d
SHA1 513f7effc0a74e25650b9eed957ba1ff42b36cf9
SHA512 1301b26ad3858802df044b27b9a1ed43ba93db24ec28119919f7838c79fd5f419f5ad8dc13ec1919b3a49f0cbbd1a9fb98095bd37bc8d9015b872e9e27a6c6aa
SSDEEP 384:1hYBkBJIiYnGdG7GQ2buUK4MHSixS0CqeSbT5YfS7J/w/SURLauhh:He4JBri3yik0CkVSMNURLau
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_ecb.pyd
Size 21KB
SHA256 261be657b6eb3e70880cb540282f571944798472439c6d37588ba6716fb4226d
MD5 a5347fcb730a307e36e78699e6abc030
SHA1 536bbbced6692d63dfa89972310990405207b880
SHA512 974628c4122c2962576abebf3fbe9f4a2975c18607c45f9b7099ca798caa1810b7452218bbc7f9be196b99b892ce316f2305357a1cdf6f36743a7ad29c239056
SSDEEP 384:A8H6sZoaIHcvaGbwTB69j5iYSvYfG1k/w/iXol8H:3ZfSvRvSGSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_ofb.pyd
Size 22KB
SHA256 bbacc58fdf2872717750a1c7edbac37cbdaa2de73819b2a5011d2c936d626927
MD5 25500c65641e2b904135e6f75cb4e42b
SHA1 19c9346684a3bca1ecd6d55c9916bd1445854d36
SHA512 4cbf2f82f73c64890804ebb3f230ad5e2f28de9576d5686caa912cb44afea2ad8602749c564d9fb931f3a83d97673040e5f4d5beeded4c19f5e5e108aa51f6d7
SSDEEP 384:L5eH7LVilCS9HOxmbUDy3i4OvYfOhJ/w/sGyL36olH:2LV9zjHvSu5fLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Random\__init__.py
Size 1KB
SHA256 6970818adb817aa3021e624c7bfaeac0ebe70179f38d832ecb8fb82f77f9cf69
MD5 87ae3374b1199d28c142c3d10ee9a49e
SHA1 0bdecb65022283399b0e2972b032a05f7514074f
SHA512 e76586ef455b723037c0ab07df0e3d2b9317df7b5c98be8bd0270710e03565ef20b084bb10823359f345ec2c8a14d9169d1429c3299a06471490381aaec12044
MD5 SHA1 SHA512

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\__init__.py
Size 1KB
SHA256 089f8ec508f03dec008884e1824b9793f9f37a486aed7eafef943cc365f8fccd
MD5 34bc84ac54671e8d63783ab7b87550ff
SHA1 fe7255aa8bb0ea5ab3061477f40d96f3a2ce64ea
SHA512 5b11fcab4c1602d3b4b4ab6e38ea94a2c564e6fd514ca89d77c25843bb8b2a865776f36ffff9f23596c9e8df66db91c18bf88761b698384595113132e0dfcf4a
MD5 SHA1 SHA512

Submit Download

_file_system.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\_file_system.py
Size 2KB
SHA256 33a36137b3f9b3cf48eccd7012dae2ac898e593888b60206ba4c320b13c87573
MD5 eeb607d9ec66ed0d94a36bb9fda8a92b
SHA1 ba9f0f28e184f44c877be831784a4569508ad582
SHA512 057004f4e0f2980dda6c98e6f8df956454cb0b68eb20fc08bd1faace644b68ba0f385a5453dbe599a5f6a95f94379d31b34ad359d46096e32ae8fa659b1e8594
MD5 SHA1 SHA512

Submit Download

_raw_api.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\_raw_api.py
Size 10KB
SHA256 b3e1026515b5b21dee0efe54e75ab490444735fcf490f6777bff8ee35ec2d178
MD5 e20b027dd23c16fcde676c244454eb58
SHA1 cbd115d23d907e9bc989afbc634c02d1752b0e7c
SHA512 8eeedcde06f7654d63dbb8b619814794e195afd76166cd6c8ec9aef926d95dcd9ea2e8f712dfe359085809fe9a31c4cd378753aaa9201dce540463469ea7dad5
SSDEEP 192:9qrskrs9t3q/IPHqYqt+DqX5WZ0cKqRlpZK0Xn4n/noOKcaeJWAc:0rskrs9VqkKZt+DqX5WZrKq7pZpX4/or
MD5 SHA1 SHA512 SSDEEP

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\_strxor.pyd
Size 21KB
SHA256 9f6913ce81d7b8cac4494429ead14a2d36ffce79655061b95bfafc27b64959c7
MD5 4733c1eceaabba9b7e0ee7e8033862ae
SHA1 7e820be960118bbd46052f39031febeabe05e4ea
SHA512 6eb8fe9430c2f32acf786bd93c43daf585c34608d7dcb53edabfd4d33738603c76daaa126c61c9ac890be7866cb5062966d994518925e2fbdc0864c1d8f32498
SSDEEP 384:+8H6sZoaIHcvaGbwTB69j5i2W6vYfAdBo/w/ijol8H:hZfSvMvSiC/
MD5 SHA1 SHA512 SSDEEP

Submit Download

number.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\number.py
Size 94KB
SHA256 eb4a68ea878dc0d7b4699ff2f68685ead066114dd64b25e64a482b01f0890d4e
MD5 d4c4d733649db31a639053acaa0dce7b
SHA1 275d471d5c06dd156f0da96367c64ae36fd9f9d7
SHA512 71557e08b6dcc55ccf8ed9f896ec3d12bc1f2d0ba7ac761b9c5455a53f387220279a7d91f1204650518483074ab98bc9e4f4ca768599a035223b17718f23bda8
SSDEEP 1536:EndT5QeQcUkknbkEEpeoc06BsJ7rajyCJrOiVDtT5U1464iPpAji6R449qVnSPt4:0d1XrtNajhJrOs5uPqe6CJn6KEVama39
MD5 SHA1 SHA512 SSDEEP

Submit Download

py3compat.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\py3compat.py
Size 5KB
SHA256 d96866e681038889ea646f6e12c67aa281ed0ac30afb30e51018614f06615e73
MD5 f09941c682c76ad39c492cb98da81b9b
SHA1 7689df9d679816d7fc70b6e69e99156206c5f649
SHA512 3e7e27fb35212e26a944e136d403cc91dbb6dd2414472d9cf963d2b375004723cc07b66b8eb6972390299e0441f3ff2a68b78608f518efd62f445ae5ad7cf2fe
SSDEEP 96:WKYFQHvoA6pDLeAIefGtFaVBS3eKQM4ks58B1Su34eHPwAEx2pdDSSUS4Jn7RHUn:W9QHvilITwpK5lBsG4eldSEQn7R0ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

strxor.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\strxor.py
Size 5KB
SHA256 23e79442b11d45c61cc4d2e047f7981e73d3b44b5697cc2fc2210da53c239604
MD5 9ec7f6302ac9e3fe7d91fd1ef977e836
SHA1 98e40746b5d10eb868275ba98cf3e5aa4f711381
SHA512 4f461d8b2b9f7b9bc4882256c2285924370ab0a05b834a04cf704442114f21ce85d3ec6a60b557037f127031ea3b41eff1b040ee9a66d744b42d0a892711d87f
SSDEEP 96:MwDqrYJALrYJHdt3EHGuIW1IEbJRSTdOqvdJLb9YmPhv+h:9qrskrs9t3q/IU8gqlRdhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Notepad\Cryptodome\__init__.py
Size 191B
SHA256 43a7d0c9c6f95c2ec78ea30cbe83f1394458c1c1c1782f25e49ad7aabd2f2dc7
MD5 58d212404cfd4d5825716429c6ae3856
SHA1 a05b981ca0959a397c469f7f033cf4ed5ea999bb
SHA512 c54520897e9357c5f20dc605c555238e0bf5dc1c7f0d1728503d85fbab2701150f99303be510bf5d0d9d8fcdfd7eef15d855a518e56187cc57fc7136d732830c
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Notepad\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Notepad\_bz2.pyd
Size 81KB
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Notepad\_ctypes.pyd
Size 120KB
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Notepad\_hashlib.pyd
Size 63KB
SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
MD5 d4674750c732f0db4c4dd6a83a9124fe
SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
SSDEEP 1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Notepad\_lzma.pyd
Size 154KB
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Notepad\_socket.pyd
Size 77KB
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
SSDEEP 1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Notepad\_ssl.pyd
Size 156KB
SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
MD5 7910fb2af40e81bee211182cffec0a06
SHA1 251482ed44840b3c75426dd8e3280059d2ca06c6
SHA512 bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27
SSDEEP 3072:OwYiZ+PtocHnVXhLlasuvMETxoEBA+nbUtGnBSonJCNI5ILC7Gax1:FYk+PtocHVxx/uvPCEwhGJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Notepad\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Notepad\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Notepad\libssl-1_1.dll
Size 688KB
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
SSDEEP 12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Notepad\python3.dll
Size 64KB
SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
MD5 fd4a39e7c1f7f07cf635145a2af0dc3a
SHA1 05292ba14acc978bb195818499a294028ab644bd
SHA512 37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643
SSDEEP 768:t68LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqn:t6wewnvtjnsfwxVILL0S7SyuPxHO
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310._pth

Path C:\Users\Admin\AppData\Local\Notepad\python310._pth
Size 80B
SHA256 e9ae01c8efc72ff96484d7f54ae47805a16c0eb842721e6f03e677f356e781e9
MD5 0c2d1a15406e669769ac3e7808a815df
SHA1 9cf43b4194501b816dbbb83e2911db48f0a5ae11
SHA512 c88854660cd87c04138efaa867c84a8942272f607e1bc036b10195c154fb2eb339a58739d1388d9c0dcebda094fae47c28106f1da16837e3d817f439d0fcf6e8
MD5 SHA1 SHA512

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Notepad\python310.dll
Size 4.3MB
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.zip

Path C:\Users\Admin\AppData\Local\Notepad\python310.zip
Size 2.5MB
SHA256 785b6e0911beda463342c9ba9eadc1841fcdf318c39c05554649cf9e7fda26ad
MD5 9ff31cf4b81e38e7663eb2db5e51253d
SHA1 e3fc5ebced06321f3d5899eff5353aa0a04a37de
SHA512 a61004a15cfe9f283f249871067cabeed119dcb7c6e51c7dd6e9e55517aab5ea77c8cd1814d897a141625b932741f3c7f7a3c7cdf9247f6c12ac3eb67aad684d
SSDEEP 49152:vmr8s8npx3SPwBbXVrq/JoZaB6ho91RKREBn7kAwqQ3zHyPy1O6V:+rr8n7p7JdaAy1RKOQYRE
MD5 SHA1 SHA512 SSDEEP

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Notepad\pythonw.exe
Size 99KB
SHA256 81918ea5fa5529f04a00bafc7e3fb54978a0b7790cfc7a5dad9fa9640666560a
MD5 b6c2cf15f7998bbdd36f3c9d7b5e9ec3
SHA1 c85dd8b79f85f1b37003864ca7d150b2d2ae265c
SHA512 2799d77cad08ad88d06592044ced6d9b77acf66cbce4c9a0dcaba7c5a9ae6d785532b2803e1a271a603f274f2d794182985c7c3e560f559a6165bea2aa6f456d
SSDEEP 1536:TSTbNhIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/O5s37Sy+Pxb:TSdSwMpdCq/IM8uIGf1/O5s3Ixb
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Notepad\select.pyd
Size 29KB
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

slv.py

Path C:\Users\Admin\AppData\Local\Notepad\slv.py
Size 580KB
SHA256 4ef1009923fc12c2a3127c929e0aa4515c9f4d068737389afb3464c28ccf5925
MD5 7a4cb8261036f35fd273da420bf0fd5e
SHA1 9648559769179677c5b58d5619ca8872f5086312
SHA512 71438141236cd401f30b2caf45f95db7bd566b1794d42df000af2dd06c7a8f57fe6f85582e9ea30c23404c014fbeb0ef6667cef7535a6ed71d6c2387b4d269fd
SSDEEP 6144:qCc50DCpTYDAFxeAqNgWBAK8umw1/7DpgLs7w2bJIkkWAM8F+uGmVmjNF/A5UV+a:q0CpTww8gWPVTv5kWQbzINF/0w7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advanced_IP_Scanner.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3TV7H.tmp\Advanced_IP_Scanner.tmp
Size 1.1MB
SHA256 ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7
MD5 b87639f9a6cf5ba8c9e1f297c5745a67
SHA1 ce4758849b53af582d2d8a1bc0db20683e139fcc
SHA512 9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0
SSDEEP 24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
MD5 SHA1 SHA512 SSDEEP

Submit Download

aips_is_install_dll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-NOIQS.tmp\aips_is_install_dll.dll
Size 149KB
SHA256 3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88
MD5 57e73855fad786a59893d6581e9fb5b9
SHA1 630e52b9e88a05add68401bd62790ed8e2c3282a
SHA512 be0cf0925535dd667488175f2eac660d1ebf8429ce6725252c59fb70b00fc2f21b1e0b7ce632eaa53337ae25e44c641e13a3df0b415724498d30daf00b296f4d
SSDEEP 3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advanced_IP_Scanner.exe

Path C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Size 20.1MB
SHA256 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
MD5 5537c708edb9a2c21f88e34e8a0f1744
SHA1 86233a285363c2a6863bf642deab7e20f062b8eb
SHA512 35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1
SSDEEP 393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2160-1078-0x00007FFE483D0000-0x00007FFE4ACB8000-memory.dmp

Download

memory/4396-1213-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/4484-13-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4484-15-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/4484-1212-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4544-1207-0x0000000213AD0000-0x00000002144DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads