stormser | a71663f8f96653a8ea85fcd0d709e3b1b594be68e539406e292625e081c702fc

General

Target
2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
Size 60KB
Sample260809-en9phstva1
SHA256 a71663f8f96653a8ea85fcd0d709e3b1b594be68e539406e292625e081c702fc
MD5 86ebc44f693894472e171a03b338378a
SHA1 d1b51e3352fa3224324e9f32d81af2708ae55bdc
SHA512 27d6b6b2be1a34ab669f03ac982368a830f76338915778f3e5fa4f88831607f057dcfc924d8e867b7348db9ccd3898237d3fe4bda123210e8e89c67a94cfe371
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroZ4/CFsrdHWMZo:vvw9816vhKQLroZ4/wQpWMZo
TLSH
T11C533B830F997CF2F7810175047A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 7 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024362-2.dat	family_stormser
behavioral1/files/0x0007000000024369-7.dat	family_stormser
behavioral1/files/0x000300000001e91e-10.dat	family_stormser
behavioral1/files/0x000700000002436f-14.dat	family_stormser
behavioral1/files/0x0007000000024373-18.dat	family_stormser
behavioral1/files/0x0002000000021f4c-22.dat	family_stormser
behavioral1/files/0x00050000000006cf-27.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 7 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024362-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024369-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001e91e-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000700000002436f-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024373-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0002000000021f4c-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000006cf-27.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE71831A-8851-44fe-A739-85466F2CC03D}	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE71831A-8851-44fe-A739-85466F2CC03D}\stubpath = "C:\\Windows\\{BE71831A-8851-44fe-A739-85466F2CC03D}.exe"	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5663D0C-0CAE-4219-A10B-72AED80785E3}\stubpath = "C:\\Windows\\{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe"	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF42153-DC63-4008-A878-8A74AEB81312}	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF42153-DC63-4008-A878-8A74AEB81312}\stubpath = "C:\\Windows\\{6BF42153-DC63-4008-A878-8A74AEB81312}.exe"	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}\stubpath = "C:\\Windows\\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe"	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5663D0C-0CAE-4219-A10B-72AED80785E3}	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28198274-0626-4fce-80A1-E393B86EEA9D}	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28198274-0626-4fce-80A1-E393B86EEA9D}\stubpath = "C:\\Windows\\{28198274-0626-4fce-80A1-E393B86EEA9D}.exe"	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}\stubpath = "C:\\Windows\\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe"	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}\stubpath = "C:\\Windows\\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe"	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe

Executes dropped EXE 7 IoCs

pid	Process
3688	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
956	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
4832	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
4232	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
3356	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
1668	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
4636	{6BF42153-DC63-4008-A878-8A74AEB81312}.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\{BE71831A-8851-44fe-A739-85466F2CC03D}.exe	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
File created	C:\Windows\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
File created	C:\Windows\{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
File created	C:\Windows\{28198274-0626-4fce-80A1-E393B86EEA9D}.exe	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
File created	C:\Windows\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
File created	C:\Windows\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
File created	C:\Windows\{6BF42153-DC63-4008-A878-8A74AEB81312}.exe	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1236	cmd.exe
1716	cmd.exe
4208	cmd.exe
1376	cmd.exe
4048	cmd.exe
3504	cmd.exe
2556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6BF42153-DC63-4008-A878-8A74AEB81312}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4112	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	3688	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
Token: SeIncBasePriorityPrivilege	956	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
Token: SeIncBasePriorityPrivilege	4832	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
Token: SeIncBasePriorityPrivilege	4232	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
Token: SeIncBasePriorityPrivilege	3356	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
Token: SeIncBasePriorityPrivilege	1668	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3688	4112	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe	90
PID 4112 wrote to memory of 1236	4112	2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe	91
PID 3688 wrote to memory of 956	3688	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe	100
PID 3688 wrote to memory of 1716	3688	{BE71831A-8851-44fe-A739-85466F2CC03D}.exe	101
PID 956 wrote to memory of 4832	956	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe	104
PID 956 wrote to memory of 4208	956	{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe	105
PID 4832 wrote to memory of 4232	4832	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe	106
PID 4832 wrote to memory of 1376	4832	{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe	107
PID 4232 wrote to memory of 3356	4232	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe	108
PID 4232 wrote to memory of 4048	4232	{28198274-0626-4fce-80A1-E393B86EEA9D}.exe	109
PID 3356 wrote to memory of 1668	3356	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe	110
PID 3356 wrote to memory of 3504	3356	{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe	111
PID 1668 wrote to memory of 4636	1668	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe	112
PID 1668 wrote to memory of 2556	1668	{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_86ebc44f693894472e171a03b338378a_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
  C:\Windows\{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
    C:\Windows\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
      C:\Windows\{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Windows\{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
        
        C:\Windows\{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4232
      - C:\Windows\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
        
        C:\Windows\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
        
        C:\Windows\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\{6BF42153-DC63-4008-A878-8A74AEB81312}.exe
        
        C:\Windows\{6BF42153-DC63-4008-A878-8A74AEB81312}.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4F114~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FC7D3~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3504
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28198~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5663~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{02E68~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BE718~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe

Path C:\Windows\{02E689DB-2268-46ec-BD74-63BD8A2C0BA7}.exe
Size 60KB
SHA256 7fb59f36b62f73a11fe22c339849ba4955bf34eea7cd07715055f56f1a146290
MD5 b58cc9f7e490c8d7aa69b9e3e0eb5fae
SHA1 460c027cf3bf7075b0eafe75a5d02991ffe6c751
SHA512 58b35fb425892bcd18ebddbe6104eb0a786072159763d5167b165969d7432ff4efa3da9eba79f595106a5e809a2881ae49004ee115165d65bc9182a57d4e17e0
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroP4/CFsrdHWMZo:vvw9816vhKQLroP4/wQpWMZo
TLSH
T14D533B830F997CF2F7810175043A8BB992AB59D4D14FFE9BBF90CC194436691E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{28198274-0626-4fce-80A1-E393B86EEA9D}.exe

Path C:\Windows\{28198274-0626-4fce-80A1-E393B86EEA9D}.exe
Size 60KB
SHA256 962b03a38888d48c4e7ac04b2872804bf97522c830d598aabc3a5f51950f45b7
MD5 245d2d8b39d99b8ef916808b16df0570
SHA1 8a07fea918926ac8f2db5efc09ea38780d8cec7d
SHA512 ee6ee0bff1d39a8f7bc7daa3b15d5d804ab2f385c12a2e13391fb22629ace1f70e4160df72683e4b1fdc00dba53ea7a4e99fc1fa286740fb79e2d98530c750c0
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroy4/CFsrdHWMZo:vvw9816vhKQLroy4/wQpWMZo
TLSH
T111534B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe

Path C:\Windows\{4F114BB8-8E37-41f3-843A-EB1847FD7D63}.exe
Size 60KB
SHA256 869056474e8b4e2ec0eb04a3d64396cd6f6261dbc430570619326c0029b385e2
MD5 2e7ca6e40a31c2d6d542074cddefdf6e
SHA1 e59dc459e71cb9602e0542d684764727e37d1807
SHA512 141ff6c644bead527f6d5753fe2faf26bb782a5014a44fdc430016ed27f8e1ab76aca28bb1c2a442287f90d5512f860ab7c35c8874f6991890ea15640030324f
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroJ4/CFsrdHWMZo:vvw9816vhKQLroJ4/wQpWMZo
TLSH
T1EE534B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6BF42153-DC63-4008-A878-8A74AEB81312}.exe

Path C:\Windows\{6BF42153-DC63-4008-A878-8A74AEB81312}.exe
Size 60KB
SHA256 9a2ced13b842242e527375facd97867780a9c8c6b004dcae768fa0f1f217c991
MD5 5973fc30d2ea238dd6863365db1ee97a
SHA1 ce36046ff543ce10dc3e728a3404aaeb84e1a1e1
SHA512 fa583249ecd5efff3810d9113f01af862aadbf72107c0787bc7d8f9383fbb878e0e2ebc19ee5d233f210c9598b6361875c20d256a28ad2729679cf86b7c9a890
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroL4/CFsrdHWMZo:vvw9816vhKQLroL4/wQpWMZo
TLSH
T159533B830F997CF2F7810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe

Path C:\Windows\{A5663D0C-0CAE-4219-A10B-72AED80785E3}.exe
Size 60KB
SHA256 de29a8d7e08acad5d4d8fdd01f8c8571c9db730d0a608b5ae094adbf019c275c
MD5 51d58f4f80fc63d3e26d1efe66e4986e
SHA1 9d9c7eca2132aace09cb25bc71042caa777f3f18
SHA512 d8cd183231683b56d60c720cde28397a28a7ca9572a6cfcee043a6a026b30985b4e6ca6335ea2b794a00d3a24f834eb45f670954dfe86a8edefa41df0bef3842
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro34/CFsrdHWMZo:vvw9816vhKQLro34/wQpWMZo
TLSH
T126534B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BE71831A-8851-44fe-A739-85466F2CC03D}.exe

Path C:\Windows\{BE71831A-8851-44fe-A739-85466F2CC03D}.exe
Size 60KB
SHA256 4b6f9c9c66da8a73745cb9dcf3641c694c08e0fb7497fc57164b59730c283311
MD5 c7869cac0560d12fe22ba630d4b7c22f
SHA1 496f471c6cfb2b51fe17fa20b90661b63eb3b6ed
SHA512 0f5a036c202ca2716f66f3947779a3af35f3c99ecb307c3dd4b3dd7723e2843620893d34ae9b94cdc6c4ed277875984cb3a69f31479cbeebcfddb8da583d9f74
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroW4/CFsrdHWMZo:vvw9816vhKQLroW4/wQpWMZo
TLSH
T1F2534B834F997CF2F7810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe

Path C:\Windows\{FC7D388D-D934-4ca4-8ADA-A0B056184B3A}.exe
Size 60KB
SHA256 93672a91368290581101f5a6050f44eca8eaad1ada57b83b78ac2abd3e36b2bc
MD5 d8005f37048018217faace4afe82655b
SHA1 77f7bb48e157ac43ec54ba7c1b5b516e88581d45
SHA512 1161ce55e28e66759dd0c88a74f1515b7d2e3c26d1ab538929ef0cd667f997e8772926d34193629ac09dcdd99df23099601fb5cae65083c9f4b9f7c577309280
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro34/CFsrdHWMZo:vvw9816vhKQLro34/wQpWMZo
TLSH
T125534B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads