4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537

Analysis

max time kernel
136s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 365KB
Sample260808-dxsxpasthy
SHA256 4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537
MD5 6fe3306248c933240d34f9e0b7e4c012
SHA1 bece26b9cf43cd4a0d3863c48dba7072155de7ba
SHA512 b221714ab268ed39e5cfb66abed30385f78abafdacb3bdbc1488d6e2d88a0252db783b8a5a1a18e573b3fbf8085e4b6bd110fa5a31341755149f4ff1aa37963b
SSDEEP 6144:6xEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXQZbdsanl6N:6TECjOZQbhd6C8acRgJ6anlo
TLSH
T1D5847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : DLAWBTBF IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\en-US\cdrom.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sdstor.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidparse.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\portcfg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\xinputhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\acpi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pcmcia.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mskssrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdpdr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tunnel.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\msseccore.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndisuio.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\wdf01000.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bthenum.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\afd.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ipt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mausbip.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mshidkmdf.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\smclib.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vdrvroot.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vhdmp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\smbdirect.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ntfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wtd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\bfs.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\winnat.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\scfilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\volume.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bindflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpsd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\monitor.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\en-US\wfplwfs.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pcmcia.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspptp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbccgp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WinAccelCx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\srv2.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ksecpkg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ndproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\scsiport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netbios.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usb8023.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\agilevpn.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndis.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\modem.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ndis.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdyboost.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmstorfl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\fvevol.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\USBCAMD2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\cmimcext.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelide.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pcw.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Dumpstorport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\modem.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scsiport.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\srv2.sys	cmd.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C4N0F.exe	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com

Drops desktop.ini file(s) 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\My Videos\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Documents\My Music\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
1	api.ipify.org

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\de-DE\EhStorPwdMgr.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\ufxsynopsys.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\services.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\tr-TR\comctl32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\directmanipulation.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\CPU~1.INF\intelppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\tprtdll.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\rasgcw.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\wsepno.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\CredProv2faHelper.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\MsNetImPlatform.mfl	cmd.exe
File opened for modification	C:\Windows\System32\taskschd.msc	cmd.exe
File opened for modification	C:\Windows\System32\C_864.NLS	cmd.exe
File opened for modification	C:\Windows\System32\en-US\ActionCenter.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\mr-IN\comctl32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\perfmon.msc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\browcli.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\MSFT_UserResource.strings.psd1	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wmiclnt.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\WsmRes.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\samlib.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\SecurityHealthSystray.exe	cmd.exe
File opened for modification	C:\Windows\System32\ur-PK\SyncRes.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\downlevel\API-MS-Win-EventLog-Legacy-L1-1-0.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\HIDI2C~1.INF\hidi2c.sys	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\AppHostRegistrationVerifier.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\wlrmdr.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\onnxruntime.dll	cmd.exe
File opened for modification	C:\Windows\System32\cs-CZ\windows.ui.xaml.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\wshelper.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\stornvme.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\softkbd.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Dism\uk-UA\VhdProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\downlevel\api-ms-win-crt-math-l1-1-0.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrinterDriver.format.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ACPIPA~1.INF\acpipagr.sys	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\TabSvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\mk-MK\fms.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\PhoneCallHistoryApis.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\kdcpw.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\downlevel\api-ms-win-crt-string-l1-1-0.dll	cmd.exe
File opened for modification	C:\Windows\System32\pl-PL\windows.ui.xaml.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\profsvcext.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\acpipmi.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\replace.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\Windows.Internal.OpenWithHost.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Dism\fr-FR\CbsProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\setupapi.mof	cmd.exe
File opened for modification	C:\Windows\System32\apphelp.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\PortableDeviceSyncProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\shutdownux.dll	cmd.exe
File opened for modification	C:\Windows\System32\wbem\en-US\netnccim_uninstall.mfl	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\applessd.inf_amd64_5bfb8a70c16859cf\applessd.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_2814b0012fc3a833\netrtwlanu.inf	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\msftedit.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\SCardDlg.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\migration\sppmig.dll	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\mstsc.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\wevtapi.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\iscsiprf.mfl	cmd.exe
File opened for modification	C:\Windows\System32\en-US\wmerror.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-CA\mlang.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\rasdial.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\Windows.WARP.JITService.dll	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ransom_note.bmp"	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKACC.CFG	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\F46D40~1.XML	cmd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLR.SAM	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\tmcachemgr_xl.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\VisualElements\LogoCanary.png.DATA	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\MICROS~1.WIN	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\de\WindowsFormsIntegration.resources.dll	cmd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\es\Microsoft.Build.Engine.resources.dll	cmd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ReachFramework.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\gu.pak.DATA	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLPH.DLL	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CENTURY.TTF	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMEEXT.DLL	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info2x.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\sendforcomments.svg	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\gl-ES	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PROFILE.INF	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	cmd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ro.pak	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Data.Services.Design.resources.dll	cmd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Xaml.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUR.TTF	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemResources\mycomput.dll.mun	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Security.resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI4FB5~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-Core-ApiSetSchema-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI777B~3.CAT	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\GetStartedAppList.targetsize-24_altform-lightunplated.png	cmd.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\SIMLockToast.scale-200.png	cmd.exe
File opened for modification	C:\Windows\SystemResources\Winlangdb.dll.mun	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA567~1.0_N\DATASV~1.EXE	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMDDAB~1.1_N\EEDAE7~1.BIN	cmd.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\DCOM.adml	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI7232~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\msvcp140_2_app.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIF937~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI7926~1.CAT	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Assets\StoreLogo.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM03D8~1.1_I\C_FSAN~1.INF	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF0CF~1.115\r\cdrom.sys	cmd.exe
File opened for modification	C:\Windows\INF\c_volsnap.inf	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~1.0\0409\_ServiceModelEndpointPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\clretwrc.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\GlobalSansSerif.CompositeFont	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\XsdBuildTask.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HY49C9~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIA959~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI85BB~1.MUM	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Apps\ja-JP\CL_LocalizationData.psd1	cmd.exe
File opened for modification	C:\Windows\Fonts\smaf1256.fon	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI1E7B~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\guidedsetup\network\area-content\pa-IN\area-content.local.json	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackup\Assets\AppList.targetsize-36_altform-unplated.png	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SpeechRecognizer.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3E88~1.1_I\APPLES~1.INF	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Web.DataVisualization.resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\FODMET~1\metadata\DesktopTargetCompDB_FOD_nl-nl.xml	cmd.exe
File opened for modification	C:\Windows\Boot\Fonts_EX\segoe_slboot_EX.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\c8514sys.fon	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Design.Resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIA3EC~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI300B~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI499D~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HYCDE7~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HY883C~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI75D2~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIC83F~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\RUF58C~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\LKG\MICROS~1.SEA\Cortana.UI\cache\WV2Local\DESKTO~1\16.js	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\GetStartedBadgeLogo.scale-100.png	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\System.Messaging.Resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\PRFF58~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\USE035~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClipping\Assets\Square44x44Logo.scale-200.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7F6B~1.1_N\C_FSCO~1.INF	cmd.exe
File opened for modification	C:\Windows\Installer\$PATCH~1\Managed\68AB67~1\157~1.200\EScript.api	cmd.exe
File opened for modification	C:\Windows\Boot\EFI_EX\ru-RU\bootmgfw_EX.efi.mui	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI3492~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI2B85~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\LKG\MICROS~1.SEA\Cortana.UI\Assets\Icons\CONTRA~2\AppListIcon.targetsize-16.png	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\windows.eject.svg	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\windows.rotate270.svg	cmd.exe
File opened for modification	C:\Windows\WaaS\services\20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml	cmd.exe
File opened for modification	C:\Windows\PolicyDefinitions\WindowsFileProtection.admx	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3684	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3684	2592	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Creates a file in the Startup directory
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rd C:\ /s /q
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 2KB
SHA256 8474d2669d266fa69a81066c0b4a38f951697eb0f0594e562e38e840abfcdb52
MD5 ddacb2a7301cea2bbc7802e00a8a0997
SHA1 60cfee458794fb2f4ba601b8bfb268c030a1cb15
SHA512 c897fdc99c5fb116552c695e07e3fcefac3df852e0f9d5402fffa39b525e967eba5f80224ee88daed68905ea7caddcf2a3b28c15648b699e9bf1ed294bc0f6cb
TLSH
T17D51DA411E8A947C7E92097021AD3AF9466D02484FE1C2F142F1022DB666FECE37F7A5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 1KB
SHA256 24b1e08acb6b82cb92438126523f94bea0076e560f6a28ded46532ac2b7316d9
MD5 c4c0cbc958f442eb0250729297e4e1cd
SHA1 39619952823537d075242a6dfebc6d7d6cb2aca0
SHA512 df3e0fc833a3542080e3a5c5887b19c16a9d4af5b3e752537655742fce773dc62bbb9b67b4f7580876f9ea51ddf90d9441ac453c9aa71d3f195b7af9cf005de7
TLSH
T14C21AC411E8A906C7E92497025AD7EF9426D01088FE1C2F542F1023EA556FECE7BF7A5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 1KB
SHA256 ebfd33ed1dd9bf73b00ae1e6aadd053003a01add054e0abd8ff8ee3eafd15326
MD5 8f858b7a198f59663600930013653525
SHA1 137e154056e6ef8796e8b4cb2b1e4436603b5c9c
SHA512 7fb3e0a03e1cf58a0e9cb3bfa2316efba6b13cc219a4fa84e5eff7db613af1168f5f20ade762baca4c87e25f337f40dab611454bd44f03c71f176d02e25c0241
TLSH
T13941DB411E8A907C6E92097021AD3AF9426D01484FE1C2F142F1023DB656FECE37F7A5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_~1.LOG

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_~1.LOG
Size 2KB
SHA256 9a248ecb1e4dd259c1f3950169f93cb6044ebcfd1be0dfb749b4395d759b96bc
MD5 547429686dcc0007aff74f1a6b0c6a25
SHA1 d29413287e0b2f46bbedcb641027da67e4f908d9
SHA512 f91874fca161174b28e6d1fbf5ccaed583ed9527718a8335ce300a19e5b14b2b2ede0dd0138047ccbe7b38d2aefd43ec3b9d41a5aa5c1aeb45b4817273f32392
TLSH
T19E51F0411ECA946C7EE2097022AD3AF9466D02494EE1C2F142F1132DA556BECE3BF7A5
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOM~1.BMP

Path C:\Users\Admin\AppData\Local\Temp\RANSOM~1.BMP
Size 5.9MB
SHA256 1cab03d220a0eb77308d8bf486454b1c89ee93542c37deb6a7e1c69e61bd0fbf
MD5 72017001276af9b001dd03561dac2abe
SHA1 13b70eba95ae9a0b83a8421a0b9ea368e2c5e18e
SHA512 82f5ddbad244a2988d254e3f5a088d21607177ca3066fc3ea5ebd611b7430c2269f33b3cc36f34e0f3ece68ad679a4664b814d435ac0f2fc46b78710d8d5042b
SSDEEP 192:lxXJlUs9qonn1uRYfFlicOV31Z3XGgch6YQR9wMZ+/InHUBSzbyOSbZ3a92BZRPO:a61HGWrsH7GVm30hJKJeNuR12pjDy
TLSH
T1AE56D7783B5D2DF5FB8CD03060E25551CBB146FBA8A021D0AB6E83F9D6C21885F689F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveAdd.locked

Path C:\Users\Admin\Desktop\ApproveAdd.locked
Size 348KB
SHA256 1a36f36357341cf3a780c70606ef75849a2bfdc51f23dac683d6f35dd82bdbc9
MD5 89532fca65c4dc276da68f24b2d0bb48
SHA1 74ce6b66bc892bfc5e82a3270433e260cddb2656
SHA512 943ce2418a57694f918e6c0ae786638fbe8fc525a3305598b6902f3b5026e48d585550f221b9e349c45364d91da3f9a7d290ec1aefa5af8a33d07a9fd549da81
SSDEEP 6144:9Xg7fwAWs9knjhvc6fXz4SqBF1Ycs9YAS/qT5zqvh4T/E/bGt934f+UUgJ2g:KwAWsynhjXsdBUc/qT5z2+E/bWKUgJl
TLSH
T1387423F43F9B93C2B19B5C2C7C654EA5E384E68574B9D1E923C8DBC9FBCC6205099902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToRepair.locked

Path C:\Users\Admin\Desktop\ConvertToRepair.locked
Size 11KB
SHA256 b96cca6dcac123b700390547b4c1158823169f156ab2c09121c070cb24b87a4a
MD5 29fafa41b3b5a479ade4f22962b4c2f1
SHA1 38f26b3dc10c41669efabefb3c23f56480e95bcd
SHA512 7a98901c87951c90cecdae756418548870d28c04e7e3f925d0af37f028979a48338821a2ca13355d1592aa1632fc379a1d070b866a013703ac5ad15b2f72ffc3
SSDEEP 192:UlI3AFlLpRmdIu6S5meM/9phzoxfx177+x+K8O1W7L3n9XdnImRgx8slCVvSUFOz:UWQFlDM4eM1zsJ177XO1uL31JOU0HT
TLSH
T11432D075455C0D803C42929738FB788546EDBF02A2E7B475872E26390DEBCF8B2D9857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DECRYPT_INSTRUCTIONS.txt

Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
Size 605B
SHA256 d1c82527db60bf295320fd06d0f5d6db9ca0f41d6ae86a856c66d11ae9ead210
MD5 bf07cdcfec70726172415860688f9ba1
SHA1 c8d8476a99e083650a87b7a49ceeae25de48d646
SHA512 eeac66d1574d82e6829c4edee3424b35ed43db2e8feabab92bfeb39927a547c6ee49b31b5cbc0c2b169d73f14db306b7390857405afa191bf5bacaa841ef6bc2
TLSH
T120F07D7FA44B900116E328827B19BA62F350524A152E2656381DD86C217D68AA6D359D
MD5 SHA1 SHA512 TLSH

Submit Download

DisconnectRead.locked

Path C:\Users\Admin\Desktop\DisconnectRead.locked
Size 15KB
SHA256 6da198a0b0644c1f2cb44bccef463d9d93792f683c2c589e4827bbb0c213f931
MD5 33db1deededfedefe1fd549a0ab2d082
SHA1 a4cd6839e97c56ecba4bb918d9d55a5be0489c29
SHA512 82f38847430522b26c374fde47eda90986dcc3964ac196f3f43e984d0ddbc5f3815cfa01b34e71706b4ee8209cbd8d8a8a3c629eec6063dba2e465c14a2d44ab
SSDEEP 384:qWQPe62UV9stqfll5ecYEyV80cDB9w4tqzXuA3PXUa/bhi:qdW6D/TflDBTyV8jB9SzXuAfXU+i
TLSH
T19A72CFC5E7F9AE42C289C160143158DFF226C760DE337AD9B5CD64AE53D090DB5463C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectStep.locked

Path C:\Users\Admin\Desktop\ProtectStep.locked
Size 271KB
SHA256 6cbb8f0f83c97311baa87b8c1752ee324d9aba7326c580f3c3619da48e2480ac
MD5 4340b4280950d385ae0484954712fb6a
SHA1 76ecf1170e3ba205299b82330281ed39ef28948e
SHA512 683558cfa7ae44702fa63ff1e09c3afa6b11549c4ac3369b88ed5f71230e4c64fe39f5527202bc46485dc4ce854c79e6c28a6928d25515f1f4c0380e9a27dfc0
SSDEEP 3072:fuSYr9wHA1ViL/tSDEZqWf0DZiuV1kK8+0s0NdVCo0598Ha921sBL8omt57B4eYJ:4yg1cFS3WW1jWN+xuaMWV38B4kn+eB0
TLSH
T16B442387D96C2F3C7EB401611611D0B8AD8973B248E9D477C1AE0B6E5B72DF1680A4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadTrace.locked

Path C:\Users\Admin\Desktop\ReadTrace.locked
Size 286KB
SHA256 9dbef4fc272b8cd8824840abacc4a34f9c2816c921e7befa5dbd3a7c0ca76b38
MD5 8e448f2d0ef99ed61e72418a5c6979ed
SHA1 a4ad62e7a46253a7e4fc1febab3445340dd772cf
SHA512 edd37ee7bc2995f1017e17cc045bcf0ecea3ac6dcd63570c44c96e8c838621ea09ffc3191d7c596dc5c4134725fa6b24db9cf99b73963c0189186b610e9c0ac8
SSDEEP 6144:PEDBS51s5p4bURbLvrkh2z5NTfrOyU08TNNI625NCcTRY/bEMuIn+YB+0:PGBk1sH0UdriMjTfrOyU0yotdYDEM8Y1
TLSH
T12E5423ADF3891A60E0AC5128D853729DE7927734891DC5B5CEC67BFFC1AFCA446A4302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveSend.locked

Path C:\Users\Admin\Desktop\SaveSend.locked
Size 9KB
SHA256 04af7439d6443c3736510471a1bce5b30bdc51123b957645722397cb999e5a87
MD5 ab80669483390f60fab2a4939dd7c6af
SHA1 ea232e8e9da79ef74d0428bd124584c22f9a85b7
SHA512 ac8bcfa6781985b3c38283438e18cf770123ac3a9639d2657a59ac25903b8ffa32fe8864a868846dc64b4a8a91b6033c38adedbc0736459c553312e213ce980e
SSDEEP 192:UlI3AFlLp+OALu4dxLLZ/kuI3BHyXpreSU/pAbjLi8JTx:UWQFlMhL1dxnpqheX5JTx
TLSH
T1C012BF48CC9968DD1A029AB6CD44D4B2335A7A205336AB19C69B6F9877C50CC2993486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchRestart.locked

Path C:\Users\Admin\Desktop\SearchRestart.locked
Size 14KB
SHA256 ad7603907b5ef82c987311393b05898d46d76d703c7725db6337e8ea2f6510b9
MD5 abb03e28715c4ee6eeccfa000312a60a
SHA1 211184ca112d0ab3c579ba5ebc5fa192bdbc9e4f
SHA512 945ea26c5a4a7d29db68bd1cf0701737bc1e6e5b138eb7940f480d3b081dc88d5880df0a21246e6af12f3f66a27ec8dab10572ff14aacba84f27f9361c89a94f
SSDEEP 384:UWQFlQFqkMSRA5OTAcNbXBh78Avn6JRux:UdLQsKRA5JGbxHvn6JRux
TLSH
T15262E1C72ED80CA6111A86FAB83E2053432C28D3961CBA3B2EAD537E9FFE411545F157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipSwitch.locked

Path C:\Users\Admin\Desktop\SkipSwitch.locked
Size 317KB
SHA256 142e9618c622eacb3f843fd978419cffbd1f3f096bcfe35b4769f74b33341c7d
MD5 f21da61a0753ce51dfa033dd0f9d44fe
SHA1 aba3cc4431ec8686bdaac72fa3f7e8e2b423123f
SHA512 a18c83c3ade40d13646f4b3399de47f7b9a5b12fb4cf6f343d6440a32fb7a78c39a6a881be1a527af45feb71e014339c029a2ba9cf41198d19776ba94328db72
SSDEEP 6144:OTkGvkBj+UJ0qOZ8XjDywe44+VppRxQ2sN3RgWkdL1:OTkRCvH+P7X5ppRaxkr
TLSH
T1E1642360854636B3F83B6AFCE1541001FDA841374B836BECF62EB76807EE9447E66674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitReceive.locked

Path C:\Users\Admin\Desktop\SubmitReceive.locked
Size 20KB
SHA256 e53e6cab8cc4546ab1478ac66448b85328b76fef5fce2664dd10136e3646cf38
MD5 f0f4cdf3ede81d6dc5acbcb9789b3459
SHA1 02b86c4d5b73a8f55c1fa10f4455219f3afe3d3d
SHA512 dc1c061e1431e8bfe54145d7500f4748439f31e1b9970aabbd4714d36342b30c9bbd0841c6746855007717b3c18be1268ae996676c6e0c806b68fbf2ce4afb8f
SSDEEP 384:qWQPe628H1WJSVLMtiBaidNOKW5Lb1hEC/Oa6JpbQ0VqzeAgjoekZw0M3QwoMaJl:qdW6JV2SVLMoBakOKW5LJyC8JBQ0Vqz9
TLSH
T10792D0D27ACEA8761F285B618E10D604465DCC1247BC2A8FAF2C584F0A40D84E7F682F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Desktop\desktop.locked
Size 346B
SHA256 a499aac43fbfb28cd7a08c9387d89b7dbb151095522943f412539f86a05a69c2
MD5 779ba0d4bdb574b83e454441788cc254
SHA1 61c086a5e90151b3bfa8ef0ac3b8bd32f256c987
SHA512 f4c88d5c816b0b38209abe99aea634ca04701ed7651ecb120e5416d006dc529b55a22241210a54bb692d431e93e1ed39193286597293aa759a5f4050fa6845fe
TLSH
T137E0C075CFC44288DE0D0106FCB4AB6C00F60B5842084DB290B6B8B9C9A7D5D0640201
MD5 SHA1 SHA512 TLSH

Submit Download

DebugReset.locked

Path C:\Users\Admin\Documents\DebugReset.locked
Size 827KB
SHA256 e7af735aa0c37c3a1998c6419aace5490fd82ec8116dcb2c9bc8535b177b0711
MD5 d67c867dc52be73ac33ff13f9c38c7d5
SHA1 383a592284388b73614f41abe0223e5371eb702e
SHA512 3fcb9c35a17136897ce5542a915f785947e0e6ef18e9f1f48ca35de56f79e650e637da19a5790b77d992ede061ee7fce87d5c7b56a56e878d35368b9d9eb47b3
SSDEEP 24576:TukUhiJf5BIKMWlgwGY0J5paG20ZOAzHuyVHVfdbMa36:ThyiJNtgwC5cG+AzOyTdbC
TLSH
T16A05335C28E5A7C90E915687DFD37A6E7C4685BF299520300D763204A93E30F36EE63B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectTest.locked

Path C:\Users\Admin\Documents\DisconnectTest.locked
Size 551KB
SHA256 a1557979ebbbe04dfd50c15e90d971a24839ed9bd73cd3a24c08a0c866500d04
MD5 99af8ea36c6375bae362a14f8f93ffa7
SHA1 be0533b9a3e3a472677e4958953f09e789c4faa1
SHA512 7f1bc86d518c29cd4d41bea6af0619875f57282fd8dd801bb40c6a8e17502dba364c7a68d31c1ed8b030d791a88f2498fae58a1023ea37cc85bda47354df9bbd
SSDEEP 12288:bo3tjUk3ehLCL7k8F9ZjD925PKOcx3UKqpXwJ+R:bujB3ehLew8UK6QC
TLSH
T195C42367072C811C51004CF4E396309F3525F554E877EFA88BE66AF8ACE0BEE4D1D66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatStart.locked

Path C:\Users\Admin\Documents\FormatStart.locked
Size 1.2MB
SHA256 3e1b36d3a72f2850e7b1a134befd3d551c45fcfddaaaba6cb15ebd0cf2133cb2
MD5 0fa99ca901ca0cd24d4351a9c344da69
SHA1 eaf13de56446317f9db79f001d6352929cf94923
SHA512 0507dea33bb9284f38b20f94e5e5f7cf0b70e879c615e6ec8d285a5923a7c708bceeeab7c7ae860492d77933b48f631f61821b057744012ee2a7d399b581693e
SSDEEP 24576:O59zXBLa2OiLQQzGUSzJw7FP6tRzvurSV/rt99YHVOyz3H5h73Ec/nS6f/wSfMOj:0XBYiLQ4GTtw71gRzvuWrtWO63z73E7Y
TLSH
T1D45533F16DCCA739E6C5074C9A4654AB66310EDAEA118FC34E31722F7F8359E09B44C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallBlock.locked

Path C:\Users\Admin\Documents\InstallBlock.locked
Size 708KB
SHA256 1770f1cf0c5d2703c4c6e362c259520f9dc6d87263efab1cd73d517e6e45caa3
MD5 4111328b09ed797df128a84f51dc6f67
SHA1 deb860be7ae76c3e969f929c9fc882cbcf695fe6
SHA512 4ccbb35e051087f3816c555e61d430ef649853fb4f02caddc2d2f719e72ab0a34c5f00e7725f2e03b88a68437f22980656c3d9a6e3b55f5118e3762f3c875053
SSDEEP 12288:lnGERUjhgcBnAIjvwVSCqdI6S/MGjVZjuZlQ3UiuGbDPnpQPOaz2beKD:lGmChbAITwgpRS5jLuZS3Uiu0zmPOazc
TLSH
T13AF423245A2D646D29BD70C90EEA28011FE4C73DF63C2BCB298ED416AE5F75368D94C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - jwlmkizfdc.locked

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - jwlmkizfdc.locked
Size 265KB
SHA256 bf815072a625cda24e239c03f678931a7ccd5a48831aefd15378754f26618a7f
MD5 434d0c0c790243670d9fb23d920cd508
SHA1 a16bf7943b1d1903edace0d7fa53257179a3df8d
SHA512 df640f33ac76a9b46707275cfe5508a7f3c8ba48a97b6d5e25ec96cf79972d4abd29c28605fad6150b48784f08b799eca71273c94034e22e528246dd7e92dc6a
SSDEEP 6144:9yYGBeU4S1IVxubbSBPgkJ56RoqcJl9XrKMHLp:9yTBSSSVxuegXRoq8llKMHV
TLSH
T1D644222ADD127675B3429EC0062F9B831EED13BC09C4EA55A76CCFACA9C1207197FD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowConvertTo.locked

Path C:\Users\Admin\Documents\ShowConvertTo.locked
Size 866KB
SHA256 eff13d85a12885ab4ef5fb86835a720659fad976773ffda1270f4557749acbb4
MD5 7667a8a465fa0b02166e83c0d93ac410
SHA1 8376cd640c01c3c46313c1ef8ee673b50d8f218c
SHA512 fb4fdb9c632e88476433c3a3ff21dc7000265c5de3ed081c86dcc6b4ef37a438a66aca08c20c51b5a077080abcad10142cc4a43edc4d7681c2020a5390b0d95f
SSDEEP 12288:TUrOf2WUZrrY+dRyCZDw9lOiyHdXI/qU/je4MxaLSBFlaJ5gqrnqcVr2LBKZ7Vsj:4rWeoyR3UDyH2/vTKsdrnqHBKZ72j
TLSH
T1261523DCA60C6672F0F49EDEFA556AEE1190D6F1F530DB1258D8902532B17FE2E03A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipConvert.locked

Path C:\Users\Admin\Documents\SkipConvert.locked
Size 18KB
SHA256 92f25bed0a9cebd56b50331c67eebaf3f61a8f6a715b19f259c98a3fde1c82a0
MD5 7c0809b393889351596d538850ea97bd
SHA1 524dfddd56cd5ff24acf9c170259abb1a1a9562b
SHA512 d003b44429f57fbde4dec837df4288efec40c7829148c83719d528a68a1af3a8b3a66ad801ac1719de997c8ec0c0d15e40d2894201750e422f35cecd2117ab7c
SSDEEP 384:qWQPe62GkVvOtSlvPOVNSuM+eyxjXkqXUCWAka6dd6kZgYt2Wxna0yB:qdW6RkZSy8lvFjX1XJL6uRGFa0yB
TLSH
T1FB82F15741E541380B76D5FAF76C6618F32CEDE06BC0E692C845198FBA15348F25AC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StepReceive.locked

Path C:\Users\Admin\Documents\StepReceive.locked
Size 748KB
SHA256 96a79b0c42a4d46bce6100198be33afcdc45432e8f15eff1ae7481bfdd8415ee
MD5 328d63861f4cb8e478c9d9159048f8b3
SHA1 588568082b651820cd7440acaf676d979d1e5a74
SHA512 175e8078c414d8925432ebf893f82642fd571569cb7c263fb6a983afabfea326e4d117808e7ad08be7968af1ba1e80fa84d58948af094aa64e09ec229bf1d6cf
SSDEEP 12288:O6+K/ni47dwLEP9/jBWcbq9+0Eg37+iSEl06mDQ1SYRYb0ypqSgZrZF5Jc4ZWMhO:Ojo9i9+0EgyWCQMYRYb0MqSIP5Jb9hRs
TLSH
T1B6F433371FB271BA0C975097518B27D34D06896BE0C9ABF9C5CE5620F3D9BD38231A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitDisable.locked

Path C:\Users\Admin\Documents\SubmitDisable.locked
Size 1.3MB
SHA256 8dd51ffb0b115bbc3c3f587cb34760e59147fea20be4484903c88a1b446c4a9a
MD5 ad8efc8b84ffee7097653e27ff9c475d
SHA1 625eb20cf406d489eceabdb1669d51377ad4e5ea
SHA512 92aaa142ce82170d3f85142a52a9d7aa7de32327ebf8f67280b9328cd5050b30a1f876db62523d628813f32b7ddd4dbb1080a85d60cd3674cd39821239d3282b
SSDEEP 24576:OWs7UITjXf8I23UMcBUr6n2vfMaUUU84YVGbjeoYZ5B+vNbPObsdWXYME0Ve:zs7UITjXEqNBU714pbj/Iv+1i5Z0
TLSH
T15B65332DA65D76613FF074C2CAB127D60988F62A8125CAE755F68E3C83763147F2DC88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchWrite.locked

Path C:\Users\Admin\Documents\SwitchWrite.locked
Size 1.2MB
SHA256 5c6c8a20246b859cd803bf8312b27457b01e5c6effb76132cc19c1d5434cda97
MD5 6aab4896cae7e3f557bcb48ae61381d2
SHA1 b80e3993ed325e1880d5fe8847bcc84f8acc8d4c
SHA512 64f181baa795caf4c247aa49be6ddae7973d283106d84b0b6eea8c486754f2238023db871e8c34f4fc68751fef19bd51c1205480e595a32842d02af8a31478c6
SSDEEP 24576:xUORDVicIfCtonS4Q/hCUSn1CS632QoBwbqdBj2uk/yei9RWx24:x1f+CptEn1S21BwbqH4/yeyRWx24
TLSH
T12F453377152B0549C03C76F559CBCFA2009ECB074F2C28A9AAD33DA9C16D5A4C1CEAF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockRestore.locked

Path C:\Users\Admin\Documents\UnblockRestore.locked
Size 12KB
SHA256 0fec704332cf2dce0eaaa1169f39db4cb0d0120d02d06b261fbd4ebe61a20a69
MD5 193681fb4ff9dfe660d71a8674a7867a
SHA1 49bf80e582701fd1cbdee4f8f5d508ac2e863089
SHA512 7117c9be3cd0eec1a48f82fc004de500fc571e86cea8f39a83fd44d0497b15a5c6cf9d29bd4cc9cb114827ac0edfdd3d989fe96ae54640af13bd12b1390efeac
SSDEEP 384:qWQPe62Y56+SA72MnxGCPTShmwqj5/tOe:qdW6J5Tf72o0sShmFj5/9
TLSH
T1F142C08815C63E5E1D73B7104F1A8CD8463EE034047BA3B6FA2859AB3AA31BC354FD48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSubmit.locked

Path C:\Users\Admin\Documents\UpdateSubmit.locked
Size 1.4MB
SHA256 34b1793fea660e3dee0d03b5811088bf00763b67fe1d6966ebdebfde32dbb354
MD5 9b357a08461019b4b3286326d2a08988
SHA1 157be89bae7f524c2c5f84f4f32434053a8b7856
SHA512 e7fc362bf0c214b442ee241574714497d30e6ee8f5756006c0558f66021874e48881ad224274e97681309c0fa4105095d0219ecb3cd3302c9605cbbe3c06a776
SSDEEP 24576:9rrW4nMHgTQKFGKN3HA6CENKE+pAS7jVejyZMyXvtz4PcQvSJnJOZsuerRQe4HZl:lpnMAdFbN3DCEME+pPBjMyXvabInJOi0
TLSH
T1266533E85FAF077ED7EEFD01E4EF2D157031A0A9918BD08C8261462DDE4B5A849460FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Documents\desktop.locked
Size 466B
SHA256 39fed699e16b273f913293da352810d0218e32515aedf51d04acb0892352c66b
MD5 02fe65f7e1c15be18bd84372512ab090
SHA1 8e3a8c078ed595b8b49b6f10c0426ab83704908d
SHA512 641a3d9005bd14b2a3a4bf080afc3a6d151a4447e604dad9d1a0cf8fb8b321c195acbf115174cd58502c6c464b827c32e9a2f494201be7d114172ab76e51b526
TLSH
T11CF0547CCF80428C9D2D3403FD74BAAC00A64B0C41544DF1067678AB655B92E0200343
MD5 SHA1 SHA512 TLSH

Submit Download

ClearConvert.locked

Path C:\Users\Admin\Pictures\ClearConvert.locked
Size 504KB
SHA256 434e753a945fab6342ec6fd358c575e16889e4f83e3e74af832b156898f8ceff
MD5 676ad4ac3881361f15d8a2300a9f532e
SHA1 0b8944a83e17b68dd1e81cf3a3fcc028af27d538
SHA512 fbc7fa39050050c96f9062fb1c6708014a7d75663e374caa9bcd8772a03b638d7a6f6824b54e7ccb1627c95c4e261a886c11f90a32a9c5382acda9e92f66b776
SSDEEP 12288:YtLwngquByjP3tS3hPZMyBsdNVBLxEZqrewuej0eUMP:YtLz0IRVqdNVBLxprewtZPP
TLSH
T16AB423DB2066739843FC0C4B10DBA5E9D791CEEC5000669253DC7EA7A9E560F3AA72F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSxPbdqLdH.locked

Path C:\Users\Admin\Pictures\MSxPbdqLdH.locked
Size 24KB
SHA256 06ab9be9e48822a20ad389e770a7ae07c9adb5b3bb334577d6472f53153fcfa1
MD5 808599a83db1f1d949433dc278b315c0
SHA1 6171f872621f1a731e0e77cfce7f2b1988f09d1a
SHA512 550903d543b2eab13ab2c0106aceb9ca2a9d5b6dd03e4cfe69a5a306ea8a4c5acf6640e2c5612fb27a12e8e78a0cf6642fb2544cbbdde1751a0b5cb4070b6bb2
SSDEEP 384:5b5g3XNcBPJYnfQI43ntrnDntb8BfqJdOWZ+kEY2XbOJbQjHwQfbIPWATL6SmEmK:0H6PmfKtrnDvGWDEY2LO5iQtPl/+Q
TLSH
T1C8B2E11B10B61A07E5F12BCBC0CC40DAB9E6863BEFD35F6626DA75033E436941259D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountConvertFrom.locked

Path C:\Users\Admin\Pictures\MountConvertFrom.locked
Size 323KB
SHA256 ecece0d07142104fff47ac1d5fd62274e1e34b0e8401e21c268d2c6302183aff
MD5 f1450b0c43cc4d4bd7305f9e3ef4d084
SHA1 68a9b679fe14f21257fe9a448c646184d36c69f8
SHA512 09ab704609a2641865584f3bee93582677ad2f4300c1be907b78e53ead72230b9920ed9376d3fb299ddec3d731b3230b6bfd4f64ba597f27f9225badacdadb65
SSDEEP 6144:ihQ+NK49GCp3/WG5y5KD0n2l4ou60AAzqRJMXESvwMUzaLologsjnNHt/:iex49G6vN5gKDG2l4j64skE35kn//
TLSH
T16E642329D7EF80E1EC4742720454318D343219DFAD6AE6DC9CB5A9B5B2AD9033601ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveUnprotect.locked

Path C:\Users\Admin\Pictures\MoveUnprotect.locked
Size 398KB
SHA256 69d8f14f93691546663d1b30c087e028c9eb4a2445f6289b1513f392141ae579
MD5 d3fe2fb7eceaf5c1aafabbb388331c8f
SHA1 82b0740b99415ee42c1a488c3165079bdaf5961b
SHA512 a149904bd42afc33c5030ca4cf61bf85c69a629724387473b173a80ad62afeaf4e53e46172d07e9cc908497e62fc2d65ce8ba95b507cce7107f91b26e55e8c8d
SSDEEP 12288:xT+ehMkcUHxXQ1972ryL4wCuolOAfctMbNrL2d4T:xTV+UHxXQv1L1PowSEghT
TLSH
T1F894231B99C28362D27B3E3AC7442D3EDAA9037725BDA4AC6449430EDF025B957E50F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingShow.locked

Path C:\Users\Admin\Pictures\PingShow.locked
Size 338KB
SHA256 9b67f550c41baef51399e8c66a528c47544e56b32ded63fe4930ffbcf04295f8
MD5 2110427710d9a0cc9568e55b11ec1010
SHA1 d6ec29405af92809c826aa327192482380d29783
SHA512 585ba8aa5127fddb18e1803bcab2f29eb2c811ce5fd2eb1a507f542aa39a2bdb0a3c2bace7da2f21378daf413925953b41b6abc0cfd4050c1a74c5517d6f33ba
SSDEEP 6144:278BMbV9jNpP5PoZOdCsBqjJOmdVjmFTpeHUoqxVqx16/yiGYDUw0NBS:M4MbzjNpPpW1sY4EAFNuu0CMbw0jS
TLSH
T1D87423832357321FECE3996CE909F272391A3388458FFA44311179EF467B15EA9897B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeJoin.locked

Path C:\Users\Admin\Pictures\ResumeJoin.locked
Size 714KB
SHA256 121ef45da8239c0012a5717b54e1795444c76b6b1511c36eadf7442873e6ab7e
MD5 55fde8026d9395f5bdc6f726a39eec4a
SHA1 0cd461d76ab469a7d8bda7dd7db982067962ffda
SHA512 aaf87590dfa4ea2110f873181752bcd371268bdd5a6f26025f22061d664c752e1dca419a549e1437c2aef024216e609b954d2a6076f6ac12d0dc75bb28631367
SSDEEP 12288:lPtxAXzyGqGUABt6o7d2vUKGqccKu4gjxpBwRIT9c9SLP7v6eLVrhdnQG:dkyPGUYt6oIvUdqccKuZnBWIT9fPT6et
TLSH
T13BF4336308DD6478C787EC9BA9DA8157B2F6DD28CA7B1A0677451D03C8F295C0D08FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectGroup.locked

Path C:\Users\Admin\Pictures\SelectGroup.locked
Size 443KB
SHA256 605f205e391b8acbe985410b474b89ea19e813ac0f3fac001efc9c5b82bf568a
MD5 1688f1bb7f35f9ebbe335d7f476758e6
SHA1 1eb51f6ba9e9276a75da8ebb091bbe26d8cbd2cc
SHA512 1c31a0dd7cb3f71a0de1ffdc11a142e09f7659ef228040c3f180df8653a2e537f70bee0486561ff89626aede063599f3defb24d08ebfe2b4a2cca4a566556d59
SSDEEP 12288:4JJ7QO1oWqC/TIYctO74Aa95X8QFQ++Ymvncj3v5Msi:4b2uTIU74Z5XBhjC
TLSH
T130A4232A2234F53E67C876781EDDB0EBC826F0E558752E7A83C4809B17D49716452B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowUnprotect.locked

Path C:\Users\Admin\Pictures\ShowUnprotect.locked
Size 669KB
SHA256 c620c973956b14eadefffee5217a8dfa5e6878a029a6752c9bc616b40aaa0578
MD5 319416fb4213ea34c66fe9b7f91b9896
SHA1 a2ea085bcf3b6553494de3ecd1c8552a863cfe23
SHA512 599c829c3bfba9216aca87ff35763d2de830190315155b9b32fbcaa88b9c27b5fd11d0a4771cbe3c0107aaa1936e89c8903804e22f8eca399cbf3fa1a2f440a3
SSDEEP 12288:2ws5qpjxQrzSJLdnjOzLh9VgE5vHjFCv2u+F5LnC0Uy/Wv8UgGGFlxO/won+V4lZ:3dQvSJLdIbVB5vH5CxW7C03Og7O/HbpR
TLSH
T1A4E423241CD3B6E2A4E5B3DFE65A83DCE379752C93B243D3740889189F13BC85A88675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitSync.locked

Path C:\Users\Admin\Pictures\SplitSync.locked
Size 549KB
SHA256 e73bfef7c786d6c00cae962c3684f929564c0041d54a8265827840a01f4e199c
MD5 4b3ab40e6957cb1cfe58bdbfb299da4e
SHA1 25a9720f2a70fdb9673b2b0434a51be5f117f5c6
SHA512 49930d2aa67ed80a5323aeda32199dafac1a8488d562c374671a6cae9e02700706982a7e1b0eba3175111161a875c83ac4fd1ec089528c37445d8a6f3f6c19dc
SSDEEP 12288:K3DjW+pK7CxJOEt8A417AgOvVEDv+EbZDFVmA0W8LJewJJW3HE1L:KY768Et8PegOvKD2EFxWLJekW3kB
TLSH
T154C4236E507379DBEF4BF0F24770B4D3768D633E20AA8F1960D415B215A3B04A3A9934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitSwitch.locked

Path C:\Users\Admin\Pictures\SubmitSwitch.locked
Size 609KB
SHA256 45caadd5493037aa28dd83d975a96fd5f9a14d1f589968d7edfde3496b2a34cc
MD5 1c906bf25c8b51c1d071e3fb95d1bc6c
SHA1 977ffb8f33642a2082906a948e6af3336c3480e3
SHA512 8661737edf48629bfbf8b47f71bdaab65454c8f3d8e9e00c6b6cf7cc97a39080ffbe4096f33d7e9cdd5c877760cb787a30df040299ac278ad3057f4e1993e4ab
SSDEEP 12288:sHUwds5I6mWFPjz4D2mVEbtlAYEgOefwuvWaRSXR6icd3aldOua+5p2a+:sHUGsHPjED0bIA+ufRcRWUOC2r
TLSH
T197D423A16714FE0BE18DB3A4DA911FD5C31C2E7F328529EF290151E5B78718DBA8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSet.locked

Path C:\Users\Admin\Pictures\UpdateSet.locked
Size 624KB
SHA256 3bcd151f92b4bb56ea585b517853954a9b81ab53217622bd4b093420577d7716
MD5 b43f5c92c13057be99aeb1bbb3ad87af
SHA1 e6f89bac482ff5abfe61c1354641890b154d03ad
SHA512 b5f9f8bce72e5fcdbdf162f6d0d60fc08bb3053c5b96b6845c6798cdb5a37ac15084e9d8ad0f8d72ec3829dca37d2d62eb7aea161d6fdf9d91bee8895864f898
SSDEEP 12288:6QFENekz/kvF6wR4PJl8TqUb7OZEI7+MDX2j6y:tFiZ/Q8w6PImUAEIbD4
TLSH
T1B3D4236B9635CC1F8AC3F8EAED454A82FD4991E7835AF00D1904341B24EDEE9C84D7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseTrace.locked

Path C:\Users\Admin\Pictures\UseTrace.locked
Size 594KB
SHA256 9e283b2e66fe47ec7cd0f3d29901a4e256e369976a90cf3b1a3d98ec024a7d6a
MD5 3d19562e8807c2e6a8ce8ebe52eabead
SHA1 a76b7f53572b12f4987964e55be3c9607fcb9ec8
SHA512 9442f37459e3af1b0cfb078796adc8f966a98657e9951338eb06a4915ca3770b3c1cd60f77c04f68c7dab55439a890604f618d26cca9d8fbdf9a3708e61ac579
SSDEEP 12288:8qGuR3jUo4shwJCH+Yh6w6pweSI1BTvboPb6WB59dgncB5v2k:3GuN6Eebw6HvtbybNB59mUuk
TLSH
T10CD423FB0B79154E8988567D653B8149AC383AC6AF6A6CDEF55CF14E023009B770ECC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Pictures\desktop.locked
Size 568B
SHA256 3d0e92f1fabd5eeb0283d5c79ac09ade32bae553d3826752dd2459ce0e92c393
MD5 98292d8267b9fbb36fea67357a8d6b0a
SHA1 8edb06825cc501438caa00743727fd753be680c8
SHA512 f60555d46d978302557ba6a1dd95052c8bc99fac3b1952d1f8ae2e5c2621c9cc839fc94515d534e0b3ccad149dafe1dc24670c4d7c2cd332c3ef284b7860b176
TLSH
T1D6F0EBA84908920D5AAC4426FCB8EFA705EFDB0002698E7021B335BEC98AD2801C6D0D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads