quasar | 3cb1bff20b181abd2b8aeefe312b10d82d6cc955981065a1d8a04bd616ea442f

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
Size 3.1MB
Sample260707-daagtsdv8j
SHA256 3cb1bff20b181abd2b8aeefe312b10d82d6cc955981065a1d8a04bd616ea442f
MD5 c057be1064afef2813446bb2c83d618e
SHA1 f58657a63e4256e36b8e53bfabbca3af7c1ec20f
SHA512 4c2b7df5e4d9806f59f276a425b8b941a5266803b21ec86a31c1f28887658bd9abf6e989b325de711b862e6b3f961eb889a1022e8877222e26cbd4aa4918e359
SSDEEP 49152:3vNcc2BYawds+PblOhTRVV1G41cCwLtlJRom5PoRJ6mbR3LoGdVTHHB72eh2NT:3vGc2BYawds+PblOhT/V1G4e5PoRJ6g
TLSH
T124E56B143BF84E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cloudpeak storage discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

CloudPeak Storage

https://h9fh.buzz/vi-vn/:4782
https://notifyproxies.io/vi-vn/:4782
https://winterbandenmetvelg.nl/vi-vn/:4782
https://idoslotx1.top/vi-vn/:4782
https://bamboo.travel/vi-vn/:4782
https://soleado.com.tw/vi-vn/:4782

Mutex

464b610c-0e2b-4eb4-b570-92c3aa0557a3

Attributes

encryption_key
FAA6DCCCB5AA917EA4E50E1D9897AB35BE84AF27
install_name
cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
CloudPeak Storage
subdirectory
CloudPeak Storage

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1596-1-0x0000000000430000-0x0000000000754000-memory.dmp	family_quasar
behavioral2/files/0x000d00000001c633-15.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4820	cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4524	PING.EXE
4192	PING.EXE
5040	PING.EXE
6032	PING.EXE
5636	PING.EXE
4052	PING.EXE
5476	PING.EXE
3364	PING.EXE
1836	PING.EXE
3768	PING.EXE
5976	PING.EXE
6008	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
6032	PING.EXE
5636	PING.EXE
5476	PING.EXE
5976	PING.EXE
6008	PING.EXE
3364	PING.EXE
4192	PING.EXE
5040	PING.EXE
1836	PING.EXE
4052	PING.EXE
3768	PING.EXE
4524	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5380	schtasks.exe
3020	schtasks.exe
2384	schtasks.exe
2136	schtasks.exe
5564	schtasks.exe
1004	schtasks.exe
3412	schtasks.exe
4504	schtasks.exe
4712	schtasks.exe
2208	schtasks.exe
1600	schtasks.exe
3028	schtasks.exe
3268	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
Token: SeDebugPrivilege	4820	cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3268	1596	cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe	86
PID 1596 wrote to memory of 4820	1596	cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3268
- C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
  "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKg55PGLpfsI.bat" "
    3⤵
    PID:1096
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4604
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3364
  - - C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
      "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
      4⤵
      PID:4032
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o1ebm3uzOhzU.bat" "
        5⤵
        
        PID:256
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3048
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4192
      - C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        6⤵
        
        PID:1040
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZJiWgyQF5u0b.bat" "
        7⤵
        
        PID:1460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5040
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        8⤵
        
        PID:3880
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCT3Zj2hWI1P.bat" "
        9⤵
        
        PID:4460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:5136
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6032
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        10⤵
        
        PID:5852
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vUF6wn3A7Qwf.bat" "
        11⤵
        
        PID:2868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5636
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        12⤵
        
        PID:1808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5XGnWDrDhcct.bat" "
        13⤵
        
        PID:2976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1836
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        14⤵
        
        PID:4772
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CRpaHD29QD5w.bat" "
        15⤵
        
        PID:5232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:5416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4052
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        16⤵
        
        PID:5660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RRaAG5mgozmf.bat" "
        17⤵
        
        PID:3136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5476
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        18⤵
        
        PID:1388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SxfMZGtLjdtv.bat" "
        19⤵
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3768
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        20⤵
        
        PID:4552
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pHzX9ieWkZz4.bat" "
        21⤵
        
        PID:3008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5976
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        22⤵
        
        PID:1592
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fks7RFaFa33g.bat" "
        23⤵
        
        PID:1920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6008
        
        C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
        
        "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe"
        24⤵
        
        PID:948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CloudPeak Storage" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MPEJ3FaXsAZX.bat" "
        25⤵
        
        PID:1992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3684
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5XGnWDrDhcct.bat

Path C:\Users\Admin\AppData\Local\Temp\5XGnWDrDhcct.bat
Size 271B
SHA256 2bb1b886a437b3c4ce3de5b548655034c5380f7bcccd6ff5c7cd9146e1b46962
MD5 0baba443d3c44a43c09545f1c6ceec2f
SHA1 46a6d073ab3730b049f18d295c0e4d240d986b76
SHA512 4498e270880b64c24678d84ca492a8feac18aafcf14eb130a32ced5c9d086cad9e2a031364725c1de616f4b0c417829b1997b491a053107a01bbc98b2d69c6f6
TLSH
T1E6D02B521682C70D69060C5A5EB57248B0A6809B3A9DED559603889D1A8B4AC7547181
MD5 SHA1 SHA512 TLSH

Submit Download

CRpaHD29QD5w.bat

Path C:\Users\Admin\AppData\Local\Temp\CRpaHD29QD5w.bat
Size 271B
SHA256 906c1df5eac8398e6572e633c34c32c45ac59db3c1168cd9b629e78459ce7926
MD5 1d443a6f5064a085ed1916bfe3d0b2e2
SHA1 4accc3ee9d819c286e5c3e996d0f085808f7c138
SHA512 90858bdb404a62977f03d9207de13acfe35671aeccadb12143d82d1518d401c89a828fe3cd793cdc1f28b1844f10a657c6a698daa37bfa2324c883678502c049
TLSH
T14FD02B175682CB1D5B060C5A6A757248B0A6409A3A4DAD594703989D0ECB4AC7546181
MD5 SHA1 SHA512 TLSH

Submit Download

MPEJ3FaXsAZX.bat

Path C:\Users\Admin\AppData\Local\Temp\MPEJ3FaXsAZX.bat
Size 271B
SHA256 afa6716bb2de1f118c2d18ff04a3c522c0cce881f6970311b27d21885d2af6aa
MD5 561d27c9b9cb9340b217cbae5fff5e4b
SHA1 9dbb0fa7b8e2a777d831c22d3a3e06b624272745
SHA512 05b5d5953ad696a78a47f012f1f58dd09ffbe19353a25134fe96f61a5b73e9fcd41ca38d1cf588c5607217aed6b0f8adb3b9672fedc6623b87a5eb7338398cbd
TLSH
T1EBD02B531682C70D5D060C5B5A767248F0AA81DA2A4CED555603989E4ACB8ACB596181
MD5 SHA1 SHA512 TLSH

Submit Download

RRaAG5mgozmf.bat

Path C:\Users\Admin\AppData\Local\Temp\RRaAG5mgozmf.bat
Size 271B
SHA256 d11a7a823471874d3a4a56222d0f43926b57954ddd11f250f19b49f7bdcc9e39
MD5 4612f49cf5d876b28e66dfa7b9b1f6c9
SHA1 13b9814dc97409e8041477f75e72390540de03b4
SHA512 b88bd9192c348fdd86e7a8bad2c5245df72238df0d203446dc7a2f5b6ae8bb5233d6c69065363e54b5d7a8ae326ffc3a9fe6faef95a55e6678905261a7b937e7
TLSH
T10DD02B131682CB1D6E061C5A5A7A7348B0A781AA3A4CED564603889D0F8B4EC7547182
MD5 SHA1 SHA512 TLSH

Submit Download

SxfMZGtLjdtv.bat

Path C:\Users\Admin\AppData\Local\Temp\SxfMZGtLjdtv.bat
Size 271B
SHA256 78fcdbfb3734f8aa5f346d708f756304ed7e18478913f117d4c12e997c6f08c5
MD5 fd61253e2176dec7a92a711f3f665477
SHA1 d29f217ea1802c27d1a7d5a52f69cfce7961764a
SHA512 d11583787145640954afa05992f9eaede735780381b182fb4cc2971c6219fcfc4f163d92c7891b91c5c7900563872b31338b3d578516083b79baddbfafcea8b8
TLSH
T168D02B5616C2CF0D5D0A1C6A5A757248B0A7409A3B4CAD554607889D1A8B8ECBA461C1
MD5 SHA1 SHA512 TLSH

Submit Download

ZCT3Zj2hWI1P.bat

Path C:\Users\Admin\AppData\Local\Temp\ZCT3Zj2hWI1P.bat
Size 271B
SHA256 32f5eb33b8dde9dafe463769a2a0537e8ef207c585c1f50983360668e370536e
MD5 4510771a96f2c0998f9d716735c42e3f
SHA1 c6275923a4e094c6fd83f56e0fbeca8616285519
SHA512 1cd81598e9601115edde52f3ec25eeeec2c57f80a0221f6361743507bd3c490da32164dc11587cf7ece6560da155fc994750ba4456d925151c13fbaa94c76be6
TLSH
T1B3D02B1216C2C70D5A062C6A5AB57248B0A684DA2A4CAD555603989D1A8B4ACB646181
MD5 SHA1 SHA512 TLSH

Submit Download

ZJiWgyQF5u0b.bat

Path C:\Users\Admin\AppData\Local\Temp\ZJiWgyQF5u0b.bat
Size 271B
SHA256 bd4dd5f86e44cafa3c60b422f31af8b59968419ea4e6f1d2a6a52f4898d54657
MD5 f227444e9e7451eb6c895956b071c9ae
SHA1 23f64576a052daf17f9900e024ffa72f551c8397
SHA512 c08181b34251274401bd04da334e797022aab518878430c663b3c42c0e7deaeb555383798a2c16bec05e814686c0ac920c8cf8a3deb3f5c15eea01e91a1bd74d
TLSH
T1BED02B571682C70D5D060C5A5A767248B0AA419A3B5CAD555703889E1ACB4AC7547181
MD5 SHA1 SHA512 TLSH

Submit Download

fks7RFaFa33g.bat

Path C:\Users\Admin\AppData\Local\Temp\fks7RFaFa33g.bat
Size 271B
SHA256 903ec4d5bb46fc08652f84303834c6e7ae1da198521ca40ca5520498497ab4e4
MD5 32b5069bd1b4ddb67e1bafe6024ba334
SHA1 8cb1f1d3c376c0781c439381a8ccccf3d6804567
SHA512 d184f44c1f24ff2e6176165eb1ca6e194959a5618d150f23219ffeabc2d7c141ce24cd57ac3a81c258d12e075da1e7d591f02cb9413af7b1613d4902c1554ccf
TLSH
T1AFD02B131692C74D5A0A0C6A6A757248B0A7449A2A4DAD5556038C9D0F8B4EC75461C1
MD5 SHA1 SHA512 TLSH

Submit Download

o1ebm3uzOhzU.bat

Path C:\Users\Admin\AppData\Local\Temp\o1ebm3uzOhzU.bat
Size 271B
SHA256 20a132ca80aeb953067c9675b8aae4e0bc46f1666f5b20bfe7b469b8a8def2b6
MD5 110e49999c190be31d09e61324be6338
SHA1 81ec5a8de699182c8230c4fbf521e745cfa3258a
SHA512 49611fc4b222b66eae369246c057f3b03048b7a1836ad4adb416f1be70a0f577a9d96f790234a187c700e104ec70cd344b901e12460fe0c3271dc245ace5929b
TLSH
T178D0EB021282C70C59070C2A1A313288B0AA84CA3B0CEE650203888E0BCB8EC7502081
MD5 SHA1 SHA512 TLSH

Submit Download

pHzX9ieWkZz4.bat

Path C:\Users\Admin\AppData\Local\Temp\pHzX9ieWkZz4.bat
Size 271B
SHA256 dcb9d3ec86919df70ae86a224040a6e0189eb4263c2c4acebcbc2c333bad62bc
MD5 73fd462ab72658bccc65b096e3c5683a
SHA1 af30a121bc0f84bea31c57dad24823fcb16fddd3
SHA512 eef3958d0a4581427c1d0203279b1f46badd18815ad1956b5d2c07d4484a88bf81cef6cb1c63f1ab83fbe820ce27a5b68758f43ca4d9bdab8b0f5f74d22432c7
TLSH
T1F9D0EB020792C70D19060C2A1A363208B0A6409A2E0CED054203988D0ACB4AC7A42082
MD5 SHA1 SHA512 TLSH

Submit Download

uKg55PGLpfsI.bat

Path C:\Users\Admin\AppData\Local\Temp\uKg55PGLpfsI.bat
Size 271B
SHA256 d6b45ff0d5aab19a9ffdac16fb570bec14f2e6849e5aa1cfd934b424fc671640
MD5 2cc54adac121d792589e026d2636146a
SHA1 c6607b3a58cccb4ee931fddf6afba4055b9c21a4
SHA512 ca3b98573b5ee415020299f218b0dae1525b40f57c0255cc9a19d536d39b22fddf4353106599ea0ba0ffefcb9ade6725925fe36f4a2573dbb993b74234547e9d
TLSH
T157D02B5356C2CB0E5A064C5A9A75724CB0A6419A2A4CAD574713989D0ACB4AC75465C1
MD5 SHA1 SHA512 TLSH

Submit Download

vUF6wn3A7Qwf.bat

Path C:\Users\Admin\AppData\Local\Temp\vUF6wn3A7Qwf.bat
Size 271B
SHA256 b74859aa97cbe946c7352f517f6eb702318e596a349520d7d4f33623005fbe60
MD5 823282a1130881a5a43afec85355aebc
SHA1 8b04f63a47f96e9858e0c0361cc802b5e3a79027
SHA512 6cb409ff5adcae3657bac43839a8030c0aaa1d6309226680267f74e5dc124b4707f94e7d61b5c3ece82b7e82ea5ba2cb6ce2771c477fb7b610f7a52d0554e942
TLSH
T1CED02B135782CB0D5D0A0C9A5AB57249B0A7809A2B4DAD555603889D0B8B4AC76461C2
MD5 SHA1 SHA512 TLSH

Submit Download

cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe

Path C:\Users\Admin\AppData\Roaming\CloudPeak Storage\cloudpeak-storage-enterprise-2026.07-full-release-x64-setup.exe
Size 3.1MB
SHA256 3cb1bff20b181abd2b8aeefe312b10d82d6cc955981065a1d8a04bd616ea442f
MD5 c057be1064afef2813446bb2c83d618e
SHA1 f58657a63e4256e36b8e53bfabbca3af7c1ec20f
SHA512 4c2b7df5e4d9806f59f276a425b8b941a5266803b21ec86a31c1f28887658bd9abf6e989b325de711b862e6b3f961eb889a1022e8877222e26cbd4aa4918e359
SSDEEP 49152:3vNcc2BYawds+PblOhTRVV1G41cCwLtlJRom5PoRJ6mbR3LoGdVTHHB72eh2NT:3vGc2BYawds+PblOhT/V1G4e5PoRJ6g
TLSH
T124E56B143BF84E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-11-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-12-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-13-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-1-0x0000000000430000-0x0000000000754000-memory.dmp

Download

memory/1596-2-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-3-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-4-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-5-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-6-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-14-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-7-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-8-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-24-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-9-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-10-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/1596-0-0x00007FFFCA9CF000-0x00007FFFCA9D0000-memory.dmp

Download

memory/4820-22-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-25-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-31-0x000000001D770000-0x000000001D7C0000-memory.dmp

Download

memory/4820-32-0x000000001D880000-0x000000001D932000-memory.dmp

Download

memory/4820-29-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-40-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-28-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-27-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-26-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-30-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-23-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-21-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-20-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-19-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-18-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-17-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/4820-16-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads