stihat | cf8ac436c123618c052f4f3e84a6e3d321019ddfe7d4a4ced2146dc0fe628928

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
Size 4.7MB
Sample260416-rlgbeac13s
SHA256 cf8ac436c123618c052f4f3e84a6e3d321019ddfe7d4a4ced2146dc0fe628928
MD5 08edc69cfe0e9e9b275dc6a5b97e0e98
SHA1 d5e255367dc82a876bbfb0957b659b4eff660eb9
SHA512 09c229c572087926b7b385f789acc118bf09b96292dc3d3901231eb82bf4aff8cec311ec5e5ff960685410e0678b1f6b3258615844a8d0e1d57c70662355b0a5
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6I:+nqiTEh
TLSH
T18836BF42B3E4A4B5E0B702348927D739DBB6BC111A249B4F32947A4E2F33791B939717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 10 IoCs

resource	yara_rule
behavioral2/memory/1432-0-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x00130000000256dc-5.dat	family_stihat
behavioral2/memory/2412-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/2412-8-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002c-18.dat	family_stihat
behavioral2/files/0x000100000000002a-44.dat	family_stihat
behavioral2/memory/3420-50-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/1432-49-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/2412-53-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/3420-69-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/1432-0-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00130000000256dc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2412-7-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2412-8-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002c-18.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002a-44.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3420-50-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1432-49-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2412-53-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3420-69-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
2412	HelpMe.exe
3420	HelpMe.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\L:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\R:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\E:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\X:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\M:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\B:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\P:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\H:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\W:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\G:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\J:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\V:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\Y:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\A:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\O:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\S:	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	C:\AUTORUN.INF	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\Registry\User\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2244	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	explorer.exe
2244	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2412	1432	2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_08edc69cfe0e9e9b275dc6a5b97e0e98_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2412

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3420

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
PID:3008

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b7bf6ea1477d5f5c97fb979f6976081bb497029ef087cb189e11ce2b5589cfdb
MD5 a82241ac2258396836058c3cd262fd9c
SHA1 165adde7e0906c4f10c245bf73384e360a7d5dcd
SHA512 e99f452faf7cafd586db9f11d66a463b21d08ee9d6a330f6be8f81029e8ba9c96abeb95f641041987798bb84c1bf1a49636ab7ee2f2268ece8a25a05b37ce50e
TLSH
T1BB11CE2819D52F37D3B2563B41B63B22C3B77C16F6F64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5f3cef3cb3277024b7699193588c841e3005ceac82ecc02524b5ad3c2449276c
MD5 3ce9f495ca5acac090fffa09297da67f
SHA1 040b5d24e1de1a27b620a3a1ef9ef6f5d30196b3
SHA512 5bb7db6e02db047b6983fcfc9121741fa0d1e98bef2e02901bd3d2ac2a9ff69452418ca63c0187111897f648ce7cc5c255702f828fdd22f12094b3484e911096
TLSH
T17131A6198ED60F71F676957299F25792AB70B9A5B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0d427ebf467065b178485c46136b38f62ba6cae91c76a6b5d3bb75249b4c2161
MD5 891dcf98e2a6c0c898b72c96d717eeca
SHA1 d509364cbc133b443785ed804db052bf7b484646
SHA512 06e1c424235fedd13ed722e40bdd2f8c645c37569195a66df72baf748163239e61d3684ce223e17b15525f1b690f162e4310cfe283b895aa8129bb8ea4d9412e
TLSH
T1F611AB2819D12F26D3B2963A51B63B2283B77C16F6E64B9A005912E28C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ba19bda67e564f8fc401f38269e529cbf321a8a1681ab3d3872990f1c6f3c2f1
MD5 be8befbdc8a5260da85ad227df49ee42
SHA1 a1338bd8a1e74ef750f1a80aa56f22d03d11e003
SHA512 33d611ca77fe014b1af000a2260ab0cd3711fa64612a4112ebcdc5d73d80fecda7137e5867bf78e1081ae77e5092edbf02ff7cfa30fd2292278b95a5ac4b4295
TLSH
T1A411CE2819D12F37D3B2963B41B63B21C3B77C16F6F64B9A005912E28C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5445932f736e4a9d7bd70393485f509d857c2551ab27ca3c478c30258b956809
MD5 54480e3b2a9061b88b2a8965b5f6acaf
SHA1 169265caaf750f2988b1599bf27af5ad6056f886
SHA512 161e04cc0ddf9a1106461625d80ed62efb12a0f1feb1039d3a752b8ac8fde35dd92afce87bd010c01d36655d7d4ea8ec0280412c3a3d33a43b181e596078ab17
TLSH
T11031A6198ED60F71F676957299F25792AB70B9A5B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0d44adbcbac4a81f829cf880a7f278e41995a285236419db2c1275a37fa9e846
MD5 9060e4e4a42d89512a8727eff6f69216
SHA1 264dd907c6cda559141c761035db7383fd6fe0d0
SHA512 ce96f3321b81cf83cbb60b3308059afa62a3b96d555d11e2e45bc49401d08162d1997a0cdf5d9b9ade6894077f3b9c1b1dec2dbb8d1e5f5dab03d8bb7ac456b8
TLSH
T1B011AB2859D12F36D3B2563A41B63B21C3B77C16F6E64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ea8330ec4c2225207cec17d43bdc8235da214443fa555a21fa4008af4c07d8c0
MD5 c92729419508eea8edffa9e59b1df801
SHA1 db5a74c3db8e69963970b9a994a74b87ca91d450
SHA512 83ec97851dd90d32b166ea5ee6b5d28efce4d96cb89960d96c2a78517f66699a21695438c54177c14c6c54c1dcbd1c9782e758fd4f71db88c78c6c6df408dbf6
TLSH
T1EE11CE2819D12F37D3B6563B41B63B22C3B77C16F6F64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 994e30cc294e31a8bac568f9f9e4f441b5518bf91fb253e3c26b9b8e32edffbf
MD5 d5786fa107fd374d0173a219df9cfb25
SHA1 36ff66d67e861e9eedd19d0c687e12ece0ccacc9
SHA512 1527ddfccaf99c134559d349553cfedc5ad29ff276fcfd7dfef8d1106f0e6d7d3017e88f89dabfe83043289b24f6f8573857fff403a08d6781c248228fba7601
TLSH
T1C131A6198FD60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 11caa8129c3ece43d44dbddb8a12cfcccd73a79366bc6ecba24fab4ae3d267fd
MD5 65aab07847a66d1729565229b1f57878
SHA1 45ec868cfd844fc211d0356ee9f9c02d8faf5ba5
SHA512 9133d68cb1cddb65d1aa8926f897a44e7f54e2f44a03fac11a165446e5c45797b868bf5c54c86d03a79703a79339d6bbed3a756b075445ad5eeb8878c49f6d81
TLSH
T19011AB2819E12F26D3B2563641A63B21C3B77C16F6E64B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0b285aca26d4ce56aeb79c71fe5ec59dfac72bb71deed18df57d0f1929bb6cd5
MD5 d6ac738bce5798d0e11000b476e6b473
SHA1 f954f8bf63d6b9755d21c2d684c68c5e21c39d10
SHA512 99789ad3cc00a788ba878d0ac9222f8db22e50c3c38a3d8effee09c45aa55e955b0753c539a97eea9ffdd90cd18d7e203b47fdf7d3884c8463184b2eafca06cc
TLSH
T1C031A6198FD60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 75e61c65cf4a25f52b2409ab2b52598a78c98f393e65f16fa75db40446feed8b
MD5 42f2f569821a771ce974483fd394e4f9
SHA1 8aafa613816c4c2e14b2e86ff8afafe7b7f0ec52
SHA512 60e2facc9f474c7a10f57b9f7f195a9c02a73117e35bf67ca104fbb8e1064fab24b29025955dc07805ed24b946a91e8e186240d99e108181bd5e343b9ea06a04
TLSH
T1A611AB2819D12F26D3B2563641B63B2283B77C16F6E64B9A019912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1dc775677d0d7add4e5fa7dedb425874ca4535a2310318d8eaf686fd8812af1f
MD5 38fe94ef768feb6f0484a324fb5e420f
SHA1 171cbcb8dbdd58d51b15cbb0391a4c7583f938db
SHA512 67ae799cc16dbe2ef34b3ebecf1128cf0cadc2384565a68a5b93410973f1bed260159d6195c4b310234add903c38dc41f839061ce95064a988a3313d7e579eda
TLSH
T1D111AB2819D52F26D3B2563641A63B2183B77C16F6E64B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9dfa3e786f36b0f93d2cea8af124a04252d71c118b41192b6907bef3306d749c
MD5 256928b6a96fc918186c9565dc0c1cd9
SHA1 2fce9f05fc1faa45d0c07bd322b9421dcabc03cc
SHA512 0786141d2a95414f744c013940cced7bc217387beb61e38f4fa61d66bd00d5dc1eb3d205d553f2e724425de77339150affd5b5a5769bde0eb47a9960b407c344
TLSH
T1A331C6198ED60F71F276917299F24782AB70B9E0B342EF1C0014834E0C72B829E42F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fa8e9a0a8c11a67b41c9e94c4ac73f287dce35140f90d94637256ff436458ceb
MD5 765d6d09d4fa5835dcc74c25d20c5423
SHA1 901cbb67263e457f684185c1a49cc365a441052a
SHA512 fc63231ee446d0956fbb922c2f63f4bbfb45fd5a888ac4f943718028e2344c2f078cd706e7e72c5c11443992a186b4d7c1380519d4aeb249739782e6d0dbfb03
TLSH
T14B11AB2819D12F36D3B2563681A63B2183B77C16F6E64B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 601e0a69f4fbd740ca25a2171d8b0497f6164172de5269832b4ea76c749cb612
MD5 8a3c37b07691ec0666d3d64237627bbb
SHA1 3022c8fd36841dd891a22c1bfb28a517eee9940a
SHA512 9825669b4b628e9abe1c9f5dca5d728c6922038a8a99a2284e83615039320b94c89ae26e47a6502d1b81707b86cfb6103bacf5e26ea8efb8bb3f114116ec6e4b
TLSH
T1EC31A6198ED60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E46F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2a04e940f288e862003e767eebf181142f285e072271096dbd60f94929714d4b
MD5 ae5f6a768061d462c5504b4eab6d57d6
SHA1 5df4cfb7e8378d79d2a6a6aa155d1e6045ece906
SHA512 9053022c7354b09624ce24da71f983b7471a0809597be64a1056b3f5f22f901beb395ffa7eeb16e06a242df7cb1de30058d14b993e451f0e8617a2441a2a8ccf
TLSH
T1E111AB2819D12F26D3B6563641A63B2183B77C16F6E65B9A405912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a03de751c2bca8086cc38fbe5dfb3f2a1188342c23511d7ab08a2d52010becd5
MD5 a10ed57b107e998bb5c018975fdaf62d
SHA1 e9df7f80743288d26b343de3025088ed540a74ed
SHA512 5e1527244f72a1abfbedf9361b7713ebcdaa52385a8c33b4249c2ed629bd9a2e4494ed558f54c33561b492346e7b19596c253c5496212bf1054185a6b17e0c11
TLSH
T13111AB2819D12F26D3B6563741A63B2183B7BC16F6E64B9A405912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e92d5f795ebebb9218d42c6781da6f386bd39a09196b3ba6e232e39f5747498c
MD5 1016c92dc867e8505d461eb5581a1d31
SHA1 1631ae4b093d5d22db7c1b2f27dca83a6b5740fb
SHA512 7aba8fcf1e63e6a5b425d42263f630402fa34788d8465c59a2e12dd85c2b33efb5b3a3b9c31a87af38bf34c8f8d71e5f59b5f2eccfa53f4c3db4fade83cba149
TLSH
T16831A6198ED60F71F676957299F25792AB70B9A1B342FF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ca98a95b4b830fb34e30ab3baeb1dae3ba73621c0f38cc52961d7ec019fbcd5f
MD5 5661af56a71ad1bdb3de8b2e9ae96b04
SHA1 59131d11b0052aadd57d346ac3a44de415d7c74f
SHA512 c4d8f6c06ea9d8f8977caf2be4b0e2a53043fe6c8e4a23301b900f7ea58da9e0fbb6672b0d56e28d67fd12fc2665f6a40aa30d4dbdd0eea80a15cc8c5a32a285
TLSH
T1A111AB2819E52F26D3B2563641A63B2183B77C16F6E64B9A005912F18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 13eeaae6c20c95dd6c40fb2d7aa05621245034128b3cfe20ed4aeab4357fa7f7
MD5 fb85c7cbc3245f4bc3f32c0cc16bbcac
SHA1 1cf2c8fc92f35e275d9718cd8fbc5c02b392c615
SHA512 9ff339effa735c5e8e13ca91700e25293f4c5096cdf6c7b00bd71e857d017b7574f06ecbeaeed66c627a9ee32ccb15ff9e663076eb62f68cc9cf5066ea7630e4
TLSH
T13211AB2819D12F27D3B2563681A63B2183B77C16F6E65B9A405912E28C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f3bc122d3b043fd161f8afd92492b764bf80fb97b0fced085c6d8bfe81a9cb19
MD5 d3f00f106f54f5e3e7d8a8d1167a5d88
SHA1 b508c43c8ef698c7837b86964d371cb5aa5b645f
SHA512 c62de635ad58674ed1c26951e008555d8be1f3ad09ec6cd6f665161a2682989cbf3446409b7191a4a9bfc79211d693077f9c46a590485a93eee6e03f90b6d418
TLSH
T1A211CE2819D52F37D3B2563741B63B21C3B77C16F6F64B9A005912E58C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b03fd184c2044bf50e229e774ceb7ec8251ff62342cc6e51c138590146e88473
MD5 dc214233506d76f3b54851ee9f1ba549
SHA1 9e9cdd33a8ec8addaf15a990702b2687720412ba
SHA512 1d67ba42712469a61f6089915bbfae43f5495af89687681e82bfb56657372f57de746bd549214351b726eb2215b454ec67669d59a73075aa1ad1c4c2ee2e632a
TLSH
T15B31A6198ED60F71F676967299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f4b1fc7f31e40be0bf048e7a98afbbcf25b7c0685115a87a6ed8d202bdadec91
MD5 a3ddca3e48b96713f7a0fdde6eb1f8de
SHA1 3c2a7aeee768ca35d9d65ab66185ae5cff0b37c4
SHA512 25f804533ffde5b276fc5fbaaa7f00b4e36bb960ebad3bfb436328a706248116e924930f88db6dd72e57f3b5b4aaa54f95a33e8e93173d41c5f8dea6f366e816
TLSH
T1AF11CE2819D52F37D3B2563741B63B21C3B77C16F6F64B9A405A12E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d45743bbf0fa6c80b857468aa36eda0590ad6869641b190c72ffbfe72e35080d
MD5 ac4ef3576198a8ffa8ff6b160d1e1644
SHA1 852091de55fb384ded6072440c1eae752a4b7247
SHA512 683ebbc781545122534b5ea02b90654e5c2b09b64f93eb466b850f7a115a099f872f7e144a18f34080c210c6547664428f2fde4966849036fb626ad75203bd08
TLSH
T18A11CE2819D16F37D3B2563751B63B21C3B77C16F6F64B9A009912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e396bb480f53fbcd9070f0754f8f195a6e499077819d24f086c4cf3a2df9dae4
MD5 eaba1275ff558337bf8fe9d9f89eebe3
SHA1 d78139dd3a0b517396f721ae52ae8a4de169557a
SHA512 d9103fe899249e2bc0eff4296dcb1e49aea5ded77fa212cc777b7e3bed7942c057742e04df282c314bd8cc65226ae2b349326592b0759c61d7a53e7b7bf69c0a
TLSH
T1F931A6198FD60F71F676967299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 67c1d47ee01f0f227ac194556e465719ec3ec43b8259ed1bbe667b7a90e5b7f1
MD5 d14d0959a7b890b47e059b839bdc5ca2
SHA1 7d435adbe72823295e34b835c2f7a18e074da4dc
SHA512 cd18fb33b5c2f7dbb14efb7e8d48bec158bef6ce49644d83e2b53beb4626d3f5033699433979843fd1be9e08881da4dd7eda5105d01abbd28f6c129958396d5b
TLSH
T17511AB2819D12F36D3B2563641A63B21C3B77C16F6E64B9A005912E68C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1c5245a113c26805e7de283435b043a2b413683169dd4972d61514c27753b644
MD5 8f82a8c5d181be453fc38f6291b2f7d4
SHA1 27f1d437699b55c6b903742958ec5ff00b18b3bd
SHA512 2ae35b25cc7fdf24aaed467ad9fd4a32113f1648d2efc933ca61f9a960c83ebaede38028fef235ce0141d8cf9d9e2198d4f95ad150b069b33b0aedf798e96412
TLSH
T1E631A6198ED60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2f067a94c3fde796ba57212ba8d3040d921ccd9b0ba4767b56a1601d0f4e545c
MD5 f7113501a2d8cd0d83ea2672074bcc4c
SHA1 ee842ce7857f482f586971950c7c7678e39811cb
SHA512 18565c0c02b729d5525429145400726defe29a5852b6a8dd9dc594d42e1ee86dab17c42df9c3a7268b4d2d6b8be4df41d1d0555363186467a79e692eb880e630
TLSH
T17411AB2819D12F36D3B2563641A63B2183B77C16F6E65B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3e97af0578713a71ae4a9ae63eaac65d8bcd18ab1d1e31d71939e165828430b2
MD5 3520481cd1c25a4542249b83aeb9b1f5
SHA1 75ce5170d7362538b69fb71fd70de13e5ec51076
SHA512 92952629c3ea212aad53769bc3decdb3e6d40e820b82ee847e977600df2fb8a1478518b477eb0d331051563633746806ee8d05a31ff197c51445a068c855920e
TLSH
T1E811CE2919D12F37D3B2963741B63B21C3B77C16F6F64B9A005912E58C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 67e863364222e3a674bf10b2f980b556d4a3d920f48b6d571cc7438a4b49f34a
MD5 e7cf4a2da0db00961a729e678fbeb60e
SHA1 ef3d9ed6b48a064185ad6d4ecc684de86398bc0e
SHA512 50fb3ae74b7844451ba0ea59094a0f9cd5cc3a772a73b5585357ddb170048abfff11c8f593e7a41e6e58ef10eefa19c4b32151f680850be57192606c00c9b163
TLSH
T12E3197198ED60F71F676957299F25792A770B991B342AF1C0014874D0C72B829E46F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 6b2939c862edfd7dc44672e15c14ad69eb68d5b0a99bc7e9d33dc057051f4d8d
MD5 fbbad40bf776d2b611a194c94968c5b7
SHA1 370056ebefae1df21252ad157bb99b6dab81b176
SHA512 e21eef5e5b97b2a683e98d4039578ce21327ea75823034d1b4e58be612e3e497eef45041aad934fae160021db8d0ebba711295a2531b4a867ebfc91e9f69a4eb
TLSH
T14311CE2819D52F37D3B2563741B63B21C3B77C16F6F64B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fddca62f093f9f6a74ac166de8ba88da5de1fc13bb05480788243994818d4af9
MD5 687ae0cf946ad7cbb76dc1ae0ade6bd3
SHA1 ea5ef976207d186d0c4dacd914676efe571577da
SHA512 fce5a26201f75843b8b8b0dba4fa0be739185436185d024d3e7f2cba153299c1ee0c053b83a15c6825250c7b02eea161b3239f8fb68b3e8bec818bd1241c07bd
TLSH
T18B11AB2819D12F26D3B2563651A63B2283B77C16F6E64B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c48a489e5be5370f97aa17955ab24ce6e98945495b9baadc704ef8f80097dad6
MD5 28c5cb72b2bcaab4f2a6b962c82296df
SHA1 cf9359abe71fb357e26ade8f00d6decd7acf1d48
SHA512 db41216e6895e0719dcc0effea419496e5fd136dcd43edfbb1741f9a6f504892b4fb966041f75f43c141d9a8402e212936c7f3f1afade5c6eb4b726007a3bb8d
TLSH
T1BD31C6198ED60F71F276917299F24782AB70B9A1B342EF1C0014834E0C72B829E42F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fdbb5bee78e708735f2a2d51cc5d1cc69f0a8656550d634c6498a6e0b3fc2fbd
MD5 33a6acea48e5b291f6552259f7790797
SHA1 7292c6bf0940e946c8e3645a080ea3cec3b8dabf
SHA512 3358e745ece7384c67dc1da466490225b983f8c788b172a4f129005d984ee90ef1d4d7aaeb69161f79d4c39a90095d315cdef888bef4bfea47e5ec0d482ac109
TLSH
T1C711CE2919D52F37D3B2963741B63B21C3B77C16F6F64B9A005912E18C44311AD18FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2e72e507d6fc306730841971f2d07fad050230abe61b57aa5a8694ed36cf5320
MD5 93549f8c143a029462c3489f1da7abbf
SHA1 de3ff88464b5fd3d7e3eecf2b2ed20529d616fcc
SHA512 4d291a40dcef6e0266906a54089c167cbb822ec61ba7fcd49828d25d2ac842f0f463a3feb10b9547a9904f430c746a0c7301570b48366e346b50f57720188f8b
TLSH
T10931A9198ED60F71F676957299F25792A770B9A1B342EF1C0014974E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 aab3c76bf1d951dd1a0c5f1ff95cb89482b2c9c30110d0ef73a17d22ea80b03f
MD5 6565aa5f3fa51bbfb02d3176f3678814
SHA1 dc0d9419a19d0e893555b330120c3d1e215188a0
SHA512 56c4580e22aa0cbd223467b2c2fb7f2a359578219bcbaaefbbfa996ec6e91bf1fcb565aad92ca0ddd36d56f025deaf970df4b2a77ef57e60db780fee6b000a7b
TLSH
T16631A6198ED60F71F676957299F25792AB70B9A5B382EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3567116deff5466fc430c12679947150d22b5ab55f7a3a2328714920294bd2df
MD5 6f6f0f30051ea04dcdf1e518bca77582
SHA1 134b1d5ac1e89e584fcf5409ea5f6a477826420b
SHA512 30a27634a7e898f20bb14212b7ecec338abb42e8afe7f13d6f92a487aa50a2644a3d1d55a65944c6fbd3f016c219ff176e07fdf684ffc7c0dcb1e3e6ae75f6aa
TLSH
T10911AB2819E12F36D3B6563A81A63B2183B77C16F6E64B9A405912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 bb703d4d41accd248c30ba5d3776518237f292d89d55341a88cad7b7fb13c43e
MD5 fecf2274111a76ac8e4d93d687ad22bf
SHA1 deef43546336b3205adf41c15029a9fed741cbcf
SHA512 b249bb7206a64ce3f3ca013c061a22478d0a212a44dd56828eef0fe5ff073304d4d88dc6aa10180ff02a3167f841b271b328ab5bde63628a843fcd96b741cfac
TLSH
T15831A6198FD60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0ad9074d3c3176c9353381079f7bf5356bd2f2d8cdaa2c68297b127ddb955a99
MD5 727d45119c4785080566dedede1a7638
SHA1 de27bf8eab87581604a801f58968e7d3d43bb411
SHA512 48b8034093c4fd058b42d6bba34cbb89ee002d16abcce879d5785ef0b889bfd000eb553ad14242e252552ce4f087e4e83bb1e885bb02ec02f62cce78135092e9
TLSH
T16311AB2819D12F26D3B2563A81A63B2183B77C16F6E64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e9a490731b0f6d800224832fb694a055ce5e249b76ccc42106edadeee837e0ac
MD5 f16087edcc15151ffea373f3c63f09c2
SHA1 2a2e015dfcbca4321d134057dc995e0117aaceee
SHA512 5af0891c9c890569f196b14aa0ba5d4e8b44d9d7a73c53fc248c9a9aacbeb63926e077b5928184262aa95d2dd692a38ccbde4b04016a988b46fb59fcbbae49f5
TLSH
T15611CE2829E12F37D3B2563B51B63B21C3B77C16F6F65B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 66b05e8ee318377e5bf752550cf581f99e7e73bda7e071151a9815c3104f72ed
MD5 236a2760f122acafe55a43fc393c15e8
SHA1 d1273cfe1e4c2d08e45f5e595bd8008f36337ad2
SHA512 818f255f044fa8b5471d3d06a2bf3e82942bc79ef93a18975e0b7f5d1b9daf088986937a737fb8945cc5ae4ae0fdd78eab511ee5108fd49ad8e724224bfffbce
TLSH
T1F031A6198ED60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9d5616f99d789bebed109fc5ea32f424293db62d08180a057f91a2d818b1482a
MD5 3e367d7f65c339bdc470f57d13c7ad0c
SHA1 22754882580df663e1fc5f807c5bf56bff381e90
SHA512 ced702f3315f3e9dbbb80afb0e6e676da37fb67c124162baee4ffb8a1eb8c114caec80ac9caf07a1416d4d193a0883c11b2b91088fde5a8eea6e00d3e9937faf
TLSH
T1F911CE2819E12F37D3B2963B41B63B21C3B77C16F6F64B9A405912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ef3db341b0c72b494f7e26c9dc213cf70969da4305bb710c81c278205719661b
MD5 614a84fc61a58cda0c718514ef5452d4
SHA1 f251c661ca24fdd39a99e73956759ff38b34484e
SHA512 726fe9a8e5cb12da97ae3ad2fdf53353853f009d0d4aeb222790e0fc9e55f2adc1a5a495c88f25c749d477570e63007d7cbddbbac9c6fcff4c4784e192beda48
TLSH
T13511AB2C29D12F26D3B2563A81A63B22C3B77C16F6E64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d41ce4f3312bbd4b534707046cb99e505d45d4a2107b211c7dc061933a2bad58
MD5 f5627193a06c764529420aef387b40e6
SHA1 7b3f1a789d39f469e750e770389f9f7f8aaef1ec
SHA512 91bcaa1642c874a13ad75e70f2e8dfee3be28912440ef909e7c1677abd2fa194069a404c09a2db089fd0f9d783c1e1f6e9b86592551a23126308f3c1f9332a2a
TLSH
T1C931A6198ED60F71F676957299F25792AB70B9A1B342EF1C0014974E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 01b4ff5e0924b0214e088287f77ff7f60a42b146e7781719187725ee6e94d0ef
MD5 525558280d7b5fa89e10b115a3f8f1ae
SHA1 5338a007baaef7433f0f0388e66142d22a9090e0
SHA512 21e0d806d6c606990e5d30d964665ccd70c025bbef9816c2d7ec7b4dd053f280f331da396a8c9acdd7a02f656aeca26c11cd9aa2c5df782d2fb8bb19a828e3de
TLSH
T11711AB2819D12F26D3B2563A91A63B21C3B77C16F6E64B9A005912E19C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3eeab47940665262556ba9067c65cb454d3757f96fd8d200fdd2214f0e82b973
MD5 00038b815efbc3bbeede1f0593ea175b
SHA1 64960317fe6723817f055d5cc5b34062fa1bfade
SHA512 4a3a9a87a7905be84b05e16375e6e99511335a9fc2c34cdc859a795957528d3dfbb3afcbb9f5227427f8c5fdb13e230798d1dd6835b50a601ca81f46a45b5add
TLSH
T1D511AB2819E12F26D3B2563A41A63B2183B77C16F6E64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 846fc5b3f600880923b4a98f0600b44c9b25552a3670f1236546cbf4d6d2532f
MD5 bdc2fd392377ca4c7a7dae0c10c6d099
SHA1 db025e92403ad886f982f4250bde913bda2fca43
SHA512 328ec55072a3990508639cc8b2877a5afcabc502b40ac7678b771a408238b32909d5b4d640c52c3be9b1b96d0d77528fbfc367b4d354ceeec916c6480b2e40b9
TLSH
T14E31A6198ED60F71F676957299F25792AB70B9A1B342EF1C0014874E0C72B829E42F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a0701764972b745b66cac67bf5a4aa2d8843c7a064f22d8a3c342f9f1ef82fb1
MD5 79ddfed3b6a20713f74bc3c2b3c46756
SHA1 bf0eb65ec01db503ed30c46f8eba49123dc92b91
SHA512 e02780841ac2e1a07e7bfddb5cf669116be1b8970b74850f176f95a02dcba21cc8575466a5334aded46b78ed311ccdba5c12cbb130f2d04b5fda828f23360118
TLSH
T19111AB2919D52F36D3B2563B41A63B2283B77C16F6E64B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c471c7e83213fe5d95d9953709a86d6abaf40fed6d67006e196d4492c2f47bab
MD5 ebbbc53fb5d9c173c06dfd38214be567
SHA1 466c617f5083706a1daacdf3313a43e5da439dd6
SHA512 8114ccf265bd576778b66d7715a22f56c4b747de1eff146e0ac5f0b6742aa747776fd8d343b3367deea21a07231b1abf2459fd99aeff64f0189f1f8fdc5d70df
TLSH
T15D11AB2819D12F26D3B2563A91B63B2183B77C16F6E65B9A005912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a9aaaca9b4cb5f6a251b01ca1dbe2ac63948dc665e365b8b5e3cc7d62c2b0e0f
MD5 6fca6ac530347fe6c9a8cd17244a02d1
SHA1 1bac62fbb2f9dc1d539ad48108c607b6a55d056a
SHA512 8b2f789d6429120ef3522287ae79c3acb33a3c6a21055990a4c4e287b1919a7345e1da652d2b3a17e5946e2a6cc0fa695e0e49c81905a360bbc5036f5931137e
TLSH
T12311CE2819D12F37D3B2563B81B63B21C3B77C16F6F64B9A405912E18C44311AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 50c0dc77c9aad47346ee5615b3036fcae44e3a57e2dfe0345d3cb1a746bbea97
MD5 0c9785603903e40b989ee86411d25032
SHA1 46e5d7d2a9bc15888c574cc2b4f5e44acafe5e39
SHA512 732d27cc586c29ff858904b2faf9783912b3e655b059444c25709f10287884ae34bbd43f29fd8cf21b302e34ac3a82614eaebc0ee0f2c976d8a3901146f17438
TLSH
T1D111AB2819D12F36D3B2563B41A63B2183B77C16F6E64B9A005912E18C44321AD08FAF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 4.7MB
SHA256 e561eda4bb1b13f36abe7fb8b03d73e975aa396535847e13808c59012834fa32
MD5 41f72388da3ccddd91d503054b4ad199
SHA1 db218059227dddb87d3e433c53810670adf85420
SHA512 4b9818a3b7304f226640292c13d1d7714019f0e6303fe04188c67c44b91adc90918bb1186aa6e42549ec099f588284ca7d69b138d95b5d3539e1600c483d64c8
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM66:+nqiTEB
TLSH
T14E36BF42B3E4A4B5E0B702348927D739DBB6BC111A249B4F32947A4E2F33791B939717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini.exe
Size 4.7MB
SHA256 426002cd98259664bb63dd5bdace71a84760074db03f33abaf37d10e072d57d4
MD5 45f76a2ff35d1deda491ec05bd1f9998
SHA1 f17548c23b919484f1db554e3c577c61e1ab8446
SHA512 519548152c6e2409e79df2b5114c2b7cb0270a618363429bc3168edd233109a5da216daa358300d7d8b7bceb9d4a5a2c8f82d1ab4d9af53f945ae82e24c95170
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6L:+nqiTE0
TLSH
T11436BF42B3E4A4B5E0B702348927D739DBB6BC111A249B4F32947A4E2F33791B939717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 4.7MB
SHA256 cf8ac436c123618c052f4f3e84a6e3d321019ddfe7d4a4ced2146dc0fe628928
MD5 08edc69cfe0e9e9b275dc6a5b97e0e98
SHA1 d5e255367dc82a876bbfb0957b659b4eff660eb9
SHA512 09c229c572087926b7b385f789acc118bf09b96292dc3d3901231eb82bf4aff8cec311ec5e5ff960685410e0678b1f6b3258615844a8d0e1d57c70662355b0a5
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6I:+nqiTEh
TLSH
T18836BF42B3E4A4B5E0B702348927D739DBB6BC111A249B4F32947A4E2F33791B939717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1432-1-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/1432-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/1432-57-0x00000000009E0000-0x0000000000A5B000-memory.dmp

Download

memory/1432-52-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/1432-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2244-68-0x00000000027B0000-0x000000000285F000-memory.dmp

Download

memory/2412-58-0x00000000008C0000-0x000000000093B000-memory.dmp

Download

memory/2412-8-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2412-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2412-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3008-51-0x00000000030D0000-0x000000000317F000-memory.dmp

Download

memory/3420-50-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3420-67-0x0000000000930000-0x00000000009AB000-memory.dmp

Download

memory/3420-69-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads