nanocore | abd9e0b14bebbe2a41b964a2817b329d9f06f8dd4742e60720c59bf4e3c36149

Analysis

max time kernel
4s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/06/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stage0.exe
Size 844KB
Sample260612-vm3gtabv9l
SHA256 abd9e0b14bebbe2a41b964a2817b329d9f06f8dd4742e60720c59bf4e3c36149
MD5 ba4ec40c84c493b53da2e0f01e49764d
SHA1 be170dcca557b39f7d2d168551601388480ef369
SHA512 42ad57e31c0e7d5964a086ddb0a975c0ba04de8a54739d9e355711388e223e4e315d3a5e08a16bb3bdf3fc77ac5917cc0d9046af46952afabd82270f2c8c366f
SSDEEP 24576:pmYWrwY11BsXZBGcm+qT3jE2CTQfV3u8febHnL:IlrwsBiLGc8TMTQfVvfoHnL
TLSH
T1C7052322C1C615BAEF29C3726B2101A7C5B1EAFFDE22DE7927E4100B76AF7500975523
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery nanocore r77 installer keylogger persistence privilege_escalation rootkit spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

skynet3.ydns.eu:10134
skynet2.ydns.eu:10134

Mutex

744e7b6d-d4dd-411b-a584-485cec7bc407

Attributes

activate_away_mode
false
backup_connection_host
skynet2.ydns.eu
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2026-03-24T15:32:36.450100836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
10134
default_group
Xploit
enable_debug_mode
true
gc_threshold
1.0485754e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2497
max_packet_size
1.0485757e+07
mutex
744e7b6d-d4dd-411b-a584-485cec7bc407
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
skynet3.ydns.eu
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
4997
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Family: r77
r77 is an open-source, userland rootkit.
rootkit r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

resource	yara_rule
behavioral2/files/0x001800000002b7ab-23.dat	r77_payload

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 3 IoCs

pid	Process
6028	xploit.exe
908	HIDE-SHOCK.exe
6060	HIDE-NanoC.scr

Loads dropped DLL 3 IoCs

pid	Process
5144	taskkill.exe
5620	explorer.exe
1464	timeout.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HIDE-NanoC.scr

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HIDE-SHOCK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HIDE-NanoC.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xploit.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x001700000002b7c9-76.dat	nsis_installer_1
behavioral2/files/0x001700000002b7c9-76.dat	nsis_installer_2

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1464	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5144	taskkill.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{E60C9C40-6BAE-40F4-9461-4009BD7C2DDB}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
5144	taskkill.exe
5144	taskkill.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
6060	HIDE-NanoC.scr
6060	HIDE-NanoC.scr
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
6060	HIDE-NanoC.scr
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
5620	explorer.exe
5620	explorer.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
1464	timeout.exe
1464	timeout.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
6060	HIDE-NanoC.scr
6060	HIDE-NanoC.scr
6060	HIDE-NanoC.scr
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
908	HIDE-SHOCK.exe
6060	HIDE-NanoC.scr
6060	HIDE-NanoC.scr
6060	HIDE-NanoC.scr

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	6060	HIDE-NanoC.scr
Token: SeDebugPrivilege	908	HIDE-SHOCK.exe
Token: SeShutdownPrivilege	5620	explorer.exe
Token: SeCreatePagefilePrivilege	5620	explorer.exe
Token: SeShutdownPrivilege	5620	explorer.exe
Token: SeCreatePagefilePrivilege	5620	explorer.exe
Token: SeShutdownPrivilege	5620	explorer.exe
Token: SeCreatePagefilePrivilege	5620	explorer.exe
Token: SeShutdownPrivilege	5620	explorer.exe
Token: SeCreatePagefilePrivilege	5620	explorer.exe
Token: SeShutdownPrivilege	5620	explorer.exe
Token: SeCreatePagefilePrivilege	5620	explorer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5620	explorer.exe
5620	explorer.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe
5620	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 1480	6044	Stage0.exe	80
PID 1480 wrote to memory of 4360	1480	cmd.exe	82
PID 4360 wrote to memory of 4416	4360	mshta.exe	83
PID 4416 wrote to memory of 6028	4416	cmd.exe	85
PID 4416 wrote to memory of 908	4416	cmd.exe	86
PID 4416 wrote to memory of 6060	4416	cmd.exe	87
PID 4416 wrote to memory of 644	4416	cmd.exe	88
PID 4416 wrote to memory of 3164	4416	cmd.exe	89
PID 4416 wrote to memory of 548	4416	cmd.exe	90
PID 4416 wrote to memory of 5144	4416	cmd.exe	91
PID 4416 wrote to memory of 5620	4416	cmd.exe	93
PID 4416 wrote to memory of 1464	4416	cmd.exe	94
PID 908 wrote to memory of 6060	908	HIDE-SHOCK.exe	87
PID 908 wrote to memory of 6060	908	HIDE-SHOCK.exe	87
PID 908 wrote to memory of 6060	908	HIDE-SHOCK.exe	87
PID 908 wrote to memory of 6060	908	HIDE-SHOCK.exe	87

C:\Users\Admin\AppData\Local\Temp\Stage0.exe
"C:\Users\Admin\AppData\Local\Temp\Stage0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\mshta.exe
    mshta vbscript:createobject("wscript.shell").run("""C:\Users\Admin\AppData\Local\Temp\install.bat"" nme",0)(window.close)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" nme"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\xploit.exe
        
        xploit.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6028
      - C:\ProgramData\281832\HIDE-LUMI.exe
        
        "C:\ProgramData\281832\HIDE-LUMI.exe"
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\HIDE-SHOCK.exe
        
        HIDE-SHOCK.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\67133.exe
        
        "C:\Users\Admin\AppData\Local\Temp\67133.exe"
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\HIDE-NanoC.scr
        
        HIDE-NanoC.scr
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6060
    - - C:\Windows\system32\reg.exe
        
        Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /V AppInit_DLLs /T REG_SZ /D "C:\Users\Admin\AppData\Local\Temp\r77-x86.dll,C:\Users\Admin\AppData\Local\Temp\r77-x64.dll" /F
        5⤵
        
        PID:644
    - - C:\Windows\system32\reg.exe
        
        Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /V LoadAppInit_DLLs /T REG_DWORD /D 1 /F
        5⤵
        
        PID:3164
    - - C:\Windows\system32\reg.exe
        
        Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /V RequireSignedAppInit_DLLs /T REG_DWORD /D 0 /F
        5⤵
        
        PID:548
    - - C:\Windows\system32\taskkill.exe
        
        Taskkill /f /im explorer.exe
        5⤵
        Loads dropped DLL
        Kills process with taskkill
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5144
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Loads dropped DLL
        Enumerates connected drives
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5620
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5
        5⤵
        Loads dropped DLL
        Delays execution with timeout.exe
        Suspicious behavior: EnumeratesProcesses
        
        PID:1464

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2104

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

67133.exe

Path C:\Users\Admin\AppData\Local\Temp\67133.exe
Size 957KB
SHA256 26b0ea30b6c2bcaebaaec599b5379d2cb2b88c7d03c849c076f8e957ef086827
MD5 d9ce9982d2165cf0e2737d149c0c285b
SHA1 f839456bfd4681680a057cf1bc5ca7cbe5179ad9
SHA512 bf44fa6aa1dbd599d12f8fa6c4723ea27602368bacdb516e7cd1b28200bc9899e347c84f6ae6431d3fef2b2289572e925b0a0f49db3df390ef9eb54e56cb266c
SSDEEP 24576:91wgvff4oryaVnFatBwcJrZ+e3XqCLkHUbBLA+3p:fHf7nhFg6cJrZVndVp7p
TLSH
T1702523A1B3C4F8BDC79512B02A7D68DEFF769A0C026097933B54CBDB1956DC2111A2E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HIDE-NanoC.scr

Path C:\Users\Admin\AppData\Local\Temp\HIDE-NanoC.scr
Size 202KB
SHA256 1cc38705a83580e6894697b50c46cba0687f94231463abcb96e91854d5b26824
MD5 1dd3bfcb2f350a0ad6dd2dd9cbe07659
SHA1 955a0826d869276b5418c70e80c516c279141b8d
SHA512 6f5e8dfaf395fcb89572d2c1025e8f952478c0af13498666b0483ab8b9f1ff200ef8c4bc483b71266d8058b9dfc1391fa2f0fb265ba55040f3a29eb0f87d4232
SSDEEP 6144:QLV6Bta6dtJmakIM514Q4cpvMPFGDqMiQz5R7/36:QLV6Btpmk64QRFBqMv9R7v6
TLSH
T1C514CF1537A88A2FE2DE8679712212138379C2E3E8D3F3DE68D455B75B667E00A071D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HIDE-SHOCK.exe

Path C:\Users\Admin\AppData\Local\Temp\HIDE-SHOCK.exe
Size 643KB
SHA256 a10004c59524aa1b7095add83f2788e4f54270502a92e53e66f175e499df42c6
MD5 e0ae7915856b4f4c1f1fafa580b43f85
SHA1 765480bfb4b08655bfacacdd364b9dba790fb482
SHA512 3c256d6b37173108e7152780c6c83cf6cf92e1bfd789db5c8de121c42988e9235dddc5613f6618530ed0c21fb9b01f96b9f4da9ee0504135744a263e697e671c
SSDEEP 12288:IWvWgQs09qZBRy4iV7ZH7U6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMz:pv70q3iVd4iHE
TLSH
T102E4839C36A0B2DFC95BD432CFA85C68A6647477871B8203A45316EDDD4CA97CF142F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 908B
SHA256 b4a3a5a8fae3078ab8d6c126080bdd182fa8a383f50d7d0003cdd2b83632bf22
MD5 8b0da1f5fb46244cc6a23434d7a1b570
SHA1 e9ae2f2bcbd58a0a1e0b3b6efaa145a0ad681541
SHA512 dcbcf389694fe641a5a22fd902551ab9fa9b5a15a6da402929e8a4411b34782082f22ca8c9b7b38c8b9a16acbdcd0829149e397bdac60384248c1934ae931e25
TLSH
T1A9111C119A7F002BE2A2FB0A4B0F1A8D3B9A83B77956833350A1A50020F3265C4673CE
MD5 SHA1 SHA512 TLSH

Submit Download

lib.dll

Path C:\Users\Admin\AppData\Local\Temp\lib.dll
Size 951KB
SHA256 b60e987696a1d43d00fa5aab0d80a6755993af47b2d53a126af670ffeaa2bb7b
MD5 6d7c349c25f63b3a12a245a8c8907fbf
SHA1 082307ebcfc532a31f5c8a2e9168c3cbb3d8a52e
SHA512 39a010d603bebdb94679dd1485f70d126c4100afc3f7b602b65ea7283f6664b669aed235778a246a54ff36fdb2d2a89bc5c780796c9a861d1bd797ee63d76fd2
SSDEEP 24576:mek0LBXfWoriafnFgt7GcJlZ+e33qcLgBI1BzoQ3V:vNLZft3vF+ycJlZVHlzdbV
TLSH
T1402523A1B3C0E434C7BE11382628D5EA6F3D7D14CE90AD9737284B6F4E756C09E259E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm4AA1.tmp\System.dll
Size 12KB
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
TLSH
T1C5425C1583618EF3F5961E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r77-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\r77-x64.dll
Size 244KB
SHA256 be19546c094d96447752b768d1582900d64a4bc009dcd018a8e3f695da02f729
MD5 01b9464eb5371b61a2cd1c963ebc5894
SHA1 3bf4da138e21735a5ddb2ab174f47135ed5e943d
SHA512 e84942802b1757678ef92378844748aa67fc649404b44045d717d5fb02dd1bec1aef6881e36cdb674772615e052b81f668770e01ca39ac6e139d9ff358786fcb
SSDEEP 3072:POzdajaEKEXleo0ptwXDigwZZgdkVcg3uQ4B07wVdXSSwEsKoY46kQNGC1BGx3K7:PMYekr8wXDQgOcg3uvFjohsBY
TLSH
T1B8346B1973A50CB9EC778178C9534A09E7B2B8160371D6FF13A0826ADF2F7D1653AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r77-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\r77-x86.dll
Size 191KB
SHA256 d7d13884ac4ff5fb2ab2b3e347098b34b1dee29e9d747ff9d1adefafa243927a
MD5 eacfa1741ce0ba2c91ef59eacfbfcd13
SHA1 e010ea72232efedecab5f3e35b64904d0458fff6
SHA512 b7e8ffdb18d13e0a58ab6342a60c3a202bb241934bb030666fed9b272d664684b111b6435e1d3adc135bd73c94e793f708e041ced28a35c0685f721397cc061c
SSDEEP 3072:8fMxCV6Ir053A58XZx2w0O3tGIMOXOQ+VLwtH4kunMOUnVAtxAg0Fuj0Uy74MHvP:8fMxCoIAtA56Zx2c3AIXV+VfkunMO/Aj
TLSH
T150147C00B0D2C136D67E12340975DBA54A3CBE110BA4D9EBB7D84D7E4F342C1AA75BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xploit.exe

Path C:\Users\Admin\AppData\Local\Temp\xploit.exe
Size 221KB
SHA256 3285668dad0199c52afd1f1509220405421d347e9c179d1b552a879a573858b6
MD5 c8174140a04f34c8abafe55b45104348
SHA1 e1245fec49391b4ce27baf094c25649b59415d19
SHA512 c48a1541a126c898cca4a2b92fcbc39b414417d2c0fd2ae557824c6a1c5e4b70b6a6b14217eed2d55ee706fb937a0d17aba3f70093010f4e1ea9605bfe2343f6
SSDEEP 3072:FAu+f32EK1xoyWgodop630gaajfC58RRxwLRMcR9aBeWvfxLWDwFeWJ2NJc8CVH9:FyEx0x0gaaTCMmLbR9JWJWwJYJdy
TLSH
T1AA248C1837D4CE82D5AE4B7560F311128371E85B8E23E76E49C1B49E1D337818BA5BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path.dat

Path C:\Users\Admin\AppData\Roaming\Imminent\Path.dat
Size 56B
SHA256 46ccfe76495e969de33b60ebc75bc96fe10e3e0b44879818f466e83eb3e6feea
MD5 b5767a495eea6f771aaedfedb413635f
SHA1 5675d2241a3788d45fae1d600a58bcfd5991cf9a
SHA512 ab5daa543c714f17e2c1649cff1cf9dcad897dde4beb19c47869a2e1013694e0fbf9f9d4fc798bcb0d31166bba2a1c323eb19a96735bda9462666e93a06be935
TLSH
T1DC900250956DB5FC1242A09106303155474CA62D743018774570C9424E575217C4EE97
MD5 SHA1 SHA512 TLSH

Submit Download

rootkit_debug.txt

Path C:\rootkit_debug.txt
Size 105B
SHA256 44fa6825d3dbc85f2f9550aa0ed37cf5fe4f63ce98843295dc33e7a140d38737
MD5 86f7d3ec4e8d126ff8a673aabed83ebf
SHA1 6201318f9bc9001cc7e06df9e13ea19e872ecdd3
SHA512 37999aaf10f6ea34689890de49abb3b29f4f4fe049801663c02bdf58634a29338f925a5dc3266e73bc586328cfad4baa4c744f53bd669f11840617ce25e6b614
MD5 SHA1 SHA512

Submit Download

rootkit_debug.txt

Path C:\rootkit_debug.txt
Size 30B
SHA256 cd6997b532056070997f6ec08aeca2fe43c9455736efbdcb6aad28e6bf536a80
MD5 e187a3a3f13eadfb19548a0f9eb5390f
SHA1 27febc8dac972b22cd40b5308429da1176d81b90
SHA512 64f7e316c4d7cd4136c27de935deaf099649e843facddf8e8dbf1459dd7f141b5f8cadc76534b1817671240639756b6d487ca7cf685213c24e035eff88a4f14a
MD5 SHA1 SHA512

Submit Download

rootkit_debug.txt

Path C:\rootkit_debug.txt
Size 45B
SHA256 1bdac41f11da4572138a95110cdaffa659839df021355d3ec32e455db59585d2
MD5 4e89c1947c4b21a4c4cccd9cde0d6978
SHA1 6fbba2dd6323e559a98c6fe7c37bc6e873a0386a
SHA512 4f7cb52ab62892ebdbdbb3ec94292326f3365e374d4674acb20ef09fe531cffa7bdd188edaa10b0f4cae0214cd4dde2dacdbb4dbd62b13d5dc754443a3b3c3f2
MD5 SHA1 SHA512

Submit Download

memory/908-34-0x00000000055B0000-0x0000000005642000-memory.dmp

Download

memory/908-28-0x0000000002DD0000-0x0000000002DF8000-memory.dmp

Download

memory/908-38-0x0000000005F10000-0x0000000005F18000-memory.dmp

Download

memory/908-35-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Download

memory/908-113-0x0000000006950000-0x0000000006967000-memory.dmp

Download

memory/908-109-0x0000000006950000-0x0000000006967000-memory.dmp

Download

memory/908-111-0x0000000006950000-0x0000000006967000-memory.dmp

Download

memory/908-110-0x0000000006950000-0x0000000006967000-memory.dmp

Download

memory/908-112-0x0000000006970000-0x0000000006971000-memory.dmp

Download

memory/908-52-0x00000000059C0000-0x00000000059D8000-memory.dmp

Download

memory/908-57-0x0000000005A10000-0x0000000005A26000-memory.dmp

Download

memory/908-58-0x00000000061F0000-0x00000000061FA000-memory.dmp

Download

memory/908-32-0x000000000A000000-0x000000000A5A6000-memory.dmp

Download

memory/908-80-0x0000000007DE0000-0x0000000007DEE000-memory.dmp

Download

memory/908-79-0x0000000007DD0000-0x0000000007DDC000-memory.dmp

Download

memory/908-27-0x0000000000890000-0x0000000000938000-memory.dmp

Download

memory/908-31-0x00000000099B0000-0x0000000009A4C000-memory.dmp

Download

memory/908-37-0x0000000005EF0000-0x0000000005F00000-memory.dmp

Download

memory/3732-90-0x000000006D790000-0x000000006DAAB000-memory.dmp

Download

memory/6028-116-0x0000000007080000-0x0000000007097000-memory.dmp

Download

memory/6028-122-0x0000000007080000-0x0000000007097000-memory.dmp

Download

memory/6028-117-0x0000000007080000-0x0000000007097000-memory.dmp

Download

memory/6028-118-0x00000000070A0000-0x00000000070A1000-memory.dmp

Download

memory/6028-115-0x0000000007080000-0x0000000007097000-memory.dmp

Download

memory/6044-1-0x000000001CCB0000-0x000000001CCC0000-memory.dmp

Download

memory/6044-0-0x0000000000890000-0x000000000096A000-memory.dmp

Download

memory/6060-102-0x00000000077F0000-0x0000000007807000-memory.dmp

Download

memory/6060-48-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

Download

memory/6060-47-0x0000000006DB0000-0x0000000006DB5000-memory.dmp

Download

memory/6060-46-0x0000000006DB0000-0x0000000006DB5000-memory.dmp

Download

memory/6060-45-0x0000000006DB0000-0x0000000006DB5000-memory.dmp

Download

memory/6060-101-0x00000000077C0000-0x00000000077C1000-memory.dmp

Download

memory/6060-99-0x00000000077F0000-0x0000000007807000-memory.dmp

Download

memory/6060-98-0x00000000077F0000-0x0000000007807000-memory.dmp

Download

memory/6060-100-0x00000000077F0000-0x0000000007807000-memory.dmp

Download