bdaejec | 216a605b30dff23c70167ae8057ea43b970fe9baf05534368309a299a6bee04f

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
Size 6.9MB
Sample260803-fbtyza11fw
SHA256 216a605b30dff23c70167ae8057ea43b970fe9baf05534368309a299a6bee04f
MD5 e2100c924ffd64209826cbcaed0697b6
SHA1 2b0d19cee95be4df91198f04e4e412ca5c63db7b
SHA512 14ab2294b2814cd3661b131aac6643ec4d27da6f7411efcf0c31f1894cc838e95ad10342a40115d3dd95392c2bf41ab49592b121ab2c10d5ead1685acfeb1f3c
SSDEEP 196608:XYtWCwNirWI3tndaX1ssweX03s7FWCo2aEjdhOoVK/HpfAoxwEyUlysTNnOo3eoO:XYmOMK/HpfAoJyUlyinLeo2
TLSH
T1BB764A216205D425E99102F1390CE2BA511C7E36CBA648CBF7E45F5E69312E2973AF3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware aspackv2 backdoor discovery execution bdaejec persistence spyware

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/5128-63-0x00000000008D0000-0x00000000008D9000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/memory/5128-5-0x00000000008D0000-0x00000000008D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001b85f-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5128-63-0x00000000008D0000-0x00000000008D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001b85f-6.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
5128	MDCKwR.exe
4912	UClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\UClient = "C:\\Users\\Admin\\Desktop\\UClient.exe /s"	UClient.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	MDCKwR.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	MDCKwR.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	MDCKwR.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	MDCKwR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MDCKwR.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\UBrowserIE.exe = "11000"	UClient.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\shell\open\command	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\shell	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\ = "uclient"	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\DefaultIcon	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\shell\open\command	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\shell	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\ = "URL:uclient protocol handler"	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\UClient.exe"	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\DefaultIcon	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\DefaultIcon\ = "C:/Users/Admin/Desktop/UClient.exe"	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\shell\open\command\ = "C:/Users/Admin/Desktop/UClient.exe \"%1\""	UClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\ = "uclient"	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\DefaultIcon\ = "C:/Users/Admin/Desktop/UClient.exe"	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\DefaultIcon	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\shell\open\command	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\shell	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\shell\open	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\shell\open\command\ = "C:\\Users\\Admin\\Desktop\\UClient.exe \"%1\""	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\uclient\URL Protocol	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\shell\open	UClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.esc\shell\open\command\ = "C:/Users/Admin/Desktop/UClient.exe \"%1\""	UClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.escr\shell\open	UClient.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5628	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
5628	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
5628	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
5628	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
4912	UClient.exe
4912	UClient.exe
4912	UClient.exe
4912	UClient.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4912	UClient.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4912	UClient.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5628 wrote to memory of 5128	5628	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe	89
PID 5628 wrote to memory of 4912	5628	2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe	90
PID 5128 wrote to memory of 5312	5128	MDCKwR.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2100c924ffd64209826cbcaed0697b6_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader_wapomi.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Users\Admin\AppData\Local\Temp\MDCKwR.exe
  C:\Users\Admin\AppData\Local\Temp\MDCKwR.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\57bc08df.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5312
- C:\Users\Admin\Desktop\UClient.exe
  "C:\Users\Admin\Desktop\UClient.exe" /t 5628
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7IWVBK5J\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

57bc08df.bat

Path C:\Users\Admin\AppData\Local\Temp\57bc08df.bat
Size 187B
SHA256 85975564e0440632f90bd310ef2946ac39d9bd4285d21f1d63d6774e2151f6c0
MD5 056d2e625bcfb9a9506d3ec095b0ddaf
SHA1 c7660f6f70b7dc2feb4d4bdbdf5e4baac1124f8a
SHA512 b8f3df64e7ae7efb48e4a854be84553218f9d1595d7806fdfcaecd858224c8dd89bd2969403236670b18bf78f067f6b718f6ea2cff90d5b1651394233fcb6ea7
TLSH
T1F2C012118186C76D145A545706F1614CC4A5186C3B993F154B20847CA59681DF5D7741
MD5 SHA1 SHA512 TLSH

Submit Download

741E1420.exe

Path C:\Users\Admin\AppData\Local\Temp\741E1420.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

MDCKwR.exe

Path C:\Users\Admin\AppData\Local\Temp\MDCKwR.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UClient.db

Path C:\Users\Admin\AppData\Local\UClient\UClient.db
Size 28KB
SHA256 dda9ef7105ff40509b9558d4be90fc73a6f892a2e30ac585b54480bd23c3816e
MD5 8ae98b8e870cf44006373ce943c18571
SHA1 553153810bc46edb92e6c79d9af369e22bbebcd8
SHA512 5926afba56b344a78026fa267ed95c3ad9bd3bf583e472413ddd8638b7c46604391c25a89c96922a3b42f3c4ed6688096d0d5c9ef128959428e89fdb482a07a7
SSDEEP 24:TLtZCCFLyf87Ldq+11z0ekKusFW+vGaoeWl722r:T6C5I8t1VgKusFf+l7tr
TLSH
T15FD25B873E28AE1AEC930070AED13951C8A4931D4697B9F2B7F404315FDC102D47D75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appgroup.xml

Path C:\Users\Admin\AppData\Local\UClient\appgroup.xml
Size 79B
SHA256 27b2f8bab527c849aaa7b7742614e64bfe7bc72efe34bc020df20019f19258d3
MD5 8258c3fb494764b7e4d1dfa6f98b5249
SHA1 7aec9fe45652ff692e8f4d83e0b5141e5d8bf6ef
SHA512 05570f3ea08aabade658bb85e9d1236f8615aba4604edb19893298b1e3cdd25f4cda0057e9152ac3daa38f9716bab038005ccbae61cb414efdfa748f4c211f95
TLSH
T101A011802200A8300AA0AB2083E8C008A328A30302800280A8E20CB20A20A2CAA0A3BB
MD5 SHA1 SHA512 TLSH

Submit Download

apporder.xml

Path C:\Users\Admin\AppData\Local\UClient\apporder.xml
Size 79B
SHA256 b3126694d4041c8d808d33aa9ae6e8199798ceb40b527e27dc5846bed21a5d5b
MD5 bac02ebf3111d51121a9d094e148a690
SHA1 04f08111791d2057c858c88bfc7ebbe1e2bd2328
SHA512 eaa3a03134106717d81d86940ecca68fa1f01f7173b4f7656a0af16b03e0fdc5668bae874071559ac8e38f882af8243e11581fb576cec20fe42492881b0903a0
TLSH
T122A011803202A8300AA08F2003A8C808AB28A30302800280A8E20CA22A08A280A0A3B8
MD5 SHA1 SHA512 TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Local\UClient\log\main.log
Size 1KB
SHA256 eb47fa8adeb5767e1328821265df502fd0a53b316e6c10c35be35ae6f748bda8
MD5 0b4501eac2bd016990ade038fdc5d2a8
SHA1 3759fc31aef02b9d9279d01bb3cc9c8860d94cbd
SHA512 93683a5c2a72f7066a24bc7cfa4eb92770f2ae547476cee50d74184de4affb84cb6b55ee0f7152a1d960cde6a2134fb5b04528166aabc5e55dc79324f1e421c9
TLSH
T1B641673912F919391FE2250FB7939C2CC11AB9733167F85EB39B061A60A0093DC95F78
MD5 SHA1 SHA512 TLSH

Submit Download

setting.cfg

Path C:\Users\Admin\AppData\Local\UClient\setting.cfg
Size 15B
SHA256 81ad6a1a0fb68aac9c5066dbc3e9f8e8fcac4cb8b634935043cdc58f914dd133
MD5 16ee1f8ca34fc082903e32fce6025244
SHA1 9552628f52690d025b6f49011971eecc4b1b58a7
SHA512 bb15cba4c1b4b2339fb1fe94a9d805c0bd02d413e2d0a9da5522295610da21bbb7c3ccbc6044b84e5ddb465434c1cde24c9a8cdcbc1fb09c787e32d3c2e6a902
MD5 SHA1 SHA512

Submit Download

UClient.exe

Path C:\Users\Admin\Desktop\UClient.exe
Size 6.9MB
SHA256 216a605b30dff23c70167ae8057ea43b970fe9baf05534368309a299a6bee04f
MD5 e2100c924ffd64209826cbcaed0697b6
SHA1 2b0d19cee95be4df91198f04e4e412ca5c63db7b
SHA512 14ab2294b2814cd3661b131aac6643ec4d27da6f7411efcf0c31f1894cc838e95ad10342a40115d3dd95392c2bf41ab49592b121ab2c10d5ead1685acfeb1f3c
SSDEEP 196608:XYtWCwNirWI3tndaX1ssweX03s7FWCo2aEjdhOoVK/HpfAoxwEyUlysTNnOo3eoO:XYmOMK/HpfAoJyUlyinLeo2
TLSH
T1BB764A216205D425E99102F1390CE2BA511C7E36CBA648CBF7E45F5E69312E2973AF3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4912-64-0x0000000000B90000-0x0000000001280000-memory.dmp

Download

memory/4912-20-0x0000000000B90000-0x0000000001280000-memory.dmp

Download

memory/5128-63-0x00000000008D0000-0x00000000008D9000-memory.dmp

Download

memory/5128-5-0x00000000008D0000-0x00000000008D9000-memory.dmp

Download

memory/5628-21-0x0000000000A60000-0x0000000001150000-memory.dmp

Download

memory/5628-0-0x0000000000A60000-0x0000000001150000-memory.dmp

Download