valleyrat_s2 | b9f992a46caa3b898a960ceb13b8be215054e74d80b288de82b662c028faecb6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7A0F3EEBFB821131F22FF6EC2645B4FC.exe
Size 198KB
Sample260813-lrfdeaaa54
SHA256 b9f992a46caa3b898a960ceb13b8be215054e74d80b288de82b662c028faecb6
MD5 7a0f3eebfb821131f22ff6ec2645b4fc
SHA1 91763fd9896d4e7c17058d566e903a94ab801127
SHA512 85d90936597ef30e09d21b313eecb13b65aa0ef607e11dda60c0ddaa0c7d6926107920fe021e00f39552e083f88e8f2af72b6345526a371e4d035c9e47790b76
SSDEEP 3072:Ln7iRSW/iMxzLifVK+N/sZIGZEjUR2RcAIuO+9ggggggtnKZjeDlV34XNojF9ubI:z7s7z+Qc35FhO+bnkKDlpUNoxM/c
TLSH
T1C0148D54FDC48826F236097019A6E565112BFCE99BA1ADCF274463AE4E332C2D437CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

8.210.155.34:6868

Attributes

campaign_date
2026. 8. 5

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 18 IoCs

resource	yara_rule
behavioral1/memory/4776-36-0x0000000003810000-0x000000000384F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-38-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-37-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-39-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-40-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-41-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-42-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-53-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-54-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-55-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-68-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-67-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-56-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-96-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-72-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-110-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-111-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4776-167-0x0000000003850000-0x0000000003896000-memory.dmp	family_valleyrat_stage_2_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1152	powershell.exe
3064	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
60	812	7A0F3EEBFB821131F22FF6EC2645B4FC.exe
60	812	7A0F3EEBFB821131F22FF6EC2645B4FC.exe

Executes dropped EXE 2 IoCs

pid	Process
4776	ZhiMaSkin.exe
3880	ZhiMaSkin.exe

Loads dropped DLL 4 IoCs

pid	Process
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
3880	ZhiMaSkin.exe
3880	ZhiMaSkin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rentVer = "C:\\ProgramData\\NGT955888\\ZhiMaSkin.exe"	ZhiMaSkin.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	ZhiMaSkin.exe
File opened (read-only)	\??\Q:	ZhiMaSkin.exe
File opened (read-only)	\??\S:	ZhiMaSkin.exe
File opened (read-only)	\??\X:	ZhiMaSkin.exe
File opened (read-only)	\??\Y:	ZhiMaSkin.exe
File opened (read-only)	\??\Z:	ZhiMaSkin.exe
File opened (read-only)	\??\H:	ZhiMaSkin.exe
File opened (read-only)	\??\I:	ZhiMaSkin.exe
File opened (read-only)	\??\J:	ZhiMaSkin.exe
File opened (read-only)	\??\R:	ZhiMaSkin.exe
File opened (read-only)	\??\W:	ZhiMaSkin.exe
File opened (read-only)	\??\B:	ZhiMaSkin.exe
File opened (read-only)	\??\K:	ZhiMaSkin.exe
File opened (read-only)	\??\M:	ZhiMaSkin.exe
File opened (read-only)	\??\E:	ZhiMaSkin.exe
File opened (read-only)	\??\N:	ZhiMaSkin.exe
File opened (read-only)	\??\O:	ZhiMaSkin.exe
File opened (read-only)	\??\P:	ZhiMaSkin.exe
File opened (read-only)	\??\T:	ZhiMaSkin.exe
File opened (read-only)	\??\U:	ZhiMaSkin.exe
File opened (read-only)	\??\V:	ZhiMaSkin.exe
File opened (read-only)	\??\G:	ZhiMaSkin.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5104	tasklist.exe
5048	tasklist.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
4800	cmd.exe
1804	cmd.exe
4828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhiMaSkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A0F3EEBFB821131F22FF6EC2645B4FC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhiMaSkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4108	timeout.exe
4308	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe
4776	ZhiMaSkin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeIncreaseQuotaPrivilege	3064	powershell.exe
Token: SeSecurityPrivilege	3064	powershell.exe
Token: SeTakeOwnershipPrivilege	3064	powershell.exe
Token: SeLoadDriverPrivilege	3064	powershell.exe
Token: SeSystemProfilePrivilege	3064	powershell.exe
Token: SeSystemtimePrivilege	3064	powershell.exe
Token: SeProfSingleProcessPrivilege	3064	powershell.exe
Token: SeIncBasePriorityPrivilege	3064	powershell.exe
Token: SeCreatePagefilePrivilege	3064	powershell.exe
Token: SeBackupPrivilege	3064	powershell.exe
Token: SeRestorePrivilege	3064	powershell.exe
Token: SeShutdownPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeSystemEnvironmentPrivilege	3064	powershell.exe
Token: SeRemoteShutdownPrivilege	3064	powershell.exe
Token: SeUndockPrivilege	3064	powershell.exe
Token: SeManageVolumePrivilege	3064	powershell.exe
Token: 33	3064	powershell.exe
Token: 34	3064	powershell.exe
Token: 35	3064	powershell.exe
Token: 36	3064	powershell.exe
Token: SeIncreaseQuotaPrivilege	3064	powershell.exe
Token: SeSecurityPrivilege	3064	powershell.exe
Token: SeTakeOwnershipPrivilege	3064	powershell.exe
Token: SeLoadDriverPrivilege	3064	powershell.exe
Token: SeSystemProfilePrivilege	3064	powershell.exe
Token: SeSystemtimePrivilege	3064	powershell.exe
Token: SeProfSingleProcessPrivilege	3064	powershell.exe
Token: SeIncBasePriorityPrivilege	3064	powershell.exe
Token: SeCreatePagefilePrivilege	3064	powershell.exe
Token: SeBackupPrivilege	3064	powershell.exe
Token: SeRestorePrivilege	3064	powershell.exe
Token: SeShutdownPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeSystemEnvironmentPrivilege	3064	powershell.exe
Token: SeRemoteShutdownPrivilege	3064	powershell.exe
Token: SeUndockPrivilege	3064	powershell.exe
Token: SeManageVolumePrivilege	3064	powershell.exe
Token: 33	3064	powershell.exe
Token: 34	3064	powershell.exe
Token: 35	3064	powershell.exe
Token: 36	3064	powershell.exe
Token: SeIncreaseQuotaPrivilege	3064	powershell.exe
Token: SeSecurityPrivilege	3064	powershell.exe
Token: SeTakeOwnershipPrivilege	3064	powershell.exe
Token: SeLoadDriverPrivilege	3064	powershell.exe
Token: SeSystemProfilePrivilege	3064	powershell.exe
Token: SeSystemtimePrivilege	3064	powershell.exe
Token: SeProfSingleProcessPrivilege	3064	powershell.exe
Token: SeIncBasePriorityPrivilege	3064	powershell.exe
Token: SeCreatePagefilePrivilege	3064	powershell.exe
Token: SeBackupPrivilege	3064	powershell.exe
Token: SeRestorePrivilege	3064	powershell.exe
Token: SeShutdownPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeSystemEnvironmentPrivilege	3064	powershell.exe
Token: SeRemoteShutdownPrivilege	3064	powershell.exe
Token: SeUndockPrivilege	3064	powershell.exe
Token: SeManageVolumePrivilege	3064	powershell.exe
Token: 33	3064	powershell.exe
Token: 34	3064	powershell.exe
Token: 35	3064	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	ZhiMaSkin.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4776	812	7A0F3EEBFB821131F22FF6EC2645B4FC.exe	99
PID 4776 wrote to memory of 4392	4776	ZhiMaSkin.exe	103
PID 4392 wrote to memory of 5104	4392	cmd.exe	105
PID 4392 wrote to memory of 1196	4392	cmd.exe	106
PID 4392 wrote to memory of 4108	4392	cmd.exe	107
PID 4776 wrote to memory of 4800	4776	ZhiMaSkin.exe	109
PID 4800 wrote to memory of 464	4800	cmd.exe	111
PID 4776 wrote to memory of 1804	4776	ZhiMaSkin.exe	112
PID 1804 wrote to memory of 1152	1804	cmd.exe	114
PID 4776 wrote to memory of 4828	4776	ZhiMaSkin.exe	115
PID 4828 wrote to memory of 3064	4828	cmd.exe	117
PID 4392 wrote to memory of 5048	4392	cmd.exe	119
PID 4392 wrote to memory of 2000	4392	cmd.exe	120
PID 4392 wrote to memory of 4308	4392	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\7A0F3EEBFB821131F22FF6EC2645B4FC.exe
"C:\Users\Admin\AppData\Local\Temp\7A0F3EEBFB821131F22FF6EC2645B4FC.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812
- C:\ProgramData\NGT955888\ZhiMaSkin.exe
  C:\ProgramData\NGT955888\ZhiMaSkin.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\\svchost_tmp.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq ZhiMaSkin.exe"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      PID:5104
  - - C:\Windows\SysWOW64\find.exe
      find /I "ZhiMaSkin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1196
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 30 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4108
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq ZhiMaSkin.exe"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      PID:5048
  - - C:\Windows\SysWOW64\find.exe
      find /I "ZhiMaSkin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 30 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C schtasks /query /tn "MicrosoftWindowsUpdate" > "C:\Users\Admin\AppData\Local\Temp\\~tmp_out_4776.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "MicrosoftWindowsUpdate"
      4⤵
      System Location Discovery: System Language Discovery
      PID:464
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C powershell -Command Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\j5uf1kog.ps1" > "C:\Users\Admin\AppData\Local\j5uf1kog.tmp" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\j5uf1kog.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064

C:\ProgramData\NGT955888\ZhiMaSkin.exe
C:\ProgramData\NGT955888\ZhiMaSkin.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZhiMaSkin.exe

Path C:\ProgramData\NGT955888\ZhiMaSkin.exe
Size 4.3MB
SHA256 9556b7d5bb6e1db6ea73e2d20ef2c1edb46a645a5324570b717941aa2d0e40cd
MD5 5be09b108a180738af42f70bf8566f52
SHA1 42ee23f2345c19e0c53f285a9b041b8ba33f4404
SHA512 6a5769a3d903412415710a049a8508f3cfbd72a1eadc222dd41948e3325c06e5c9d501cea390be9c045c4302fe4413baa8e7bd9e48d2800bd250c6143ec9a049
SSDEEP 49152:ZIsYo7wb2OLGGtqCXNApIDBZL4tEfFEsH2aJ3Aoc/DN6GyVnoLn1v:BPCP3Ai94tYet4AoKDN66Z
TLSH
T19E26CF03F982DC21D94866B165FC66A3567B0FB04B6098CBEED898274D301E5DC7EAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZhiMaUpdate.dll

Path C:\ProgramData\NGT955888\ZhiMaUpdate.dll
Size 110KB
SHA256 2d566f10587833b70b7b042e1fedd3d0b04116a17eafcb6e36c78185d1f1b919
MD5 adc04564bc5fdf3cf7279770c19765d7
SHA1 e60431082e346c76d21d71b7bee3eb7376265a58
SHA512 ea47882f53ea946645ac4982504b23d59e61f410caec7618947d882b9479ec9740af925df94a58d89caf45504f6eb43acf6574f74d8873ce1953336580b3426b
SSDEEP 3072:JwdT/mVlsQPm57PFNjtoPgqKu3uwXZk9fN16:20Te7tNB0kRY
TLSH
T1D4B34A11B891D036D7AE0C788815DA619F7D7C91DFE0ACD777941EEA0E70AC0AF39A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\ProgramData\NGT955888\libcurl.dll
Size 978KB
SHA256 6bcde8c9d5c7198816b4dcfe39427e421d50a1e7dedb000901fced1cf6a66a6f
MD5 f892c56edc5d59dd12647b076bbbf39c
SHA1 af2e6cb62952d7170976be4f88969c00707b5cbd
SHA512 636b88da9f60a58ba7ec017f08681d521f94be500536686db228163bec06f58cf5c8a6c98481ccfb729700ee458b404b6d5391ff5c29e26dff4a3b3f4d5f0277
SSDEEP 12288:PBjeGFwylD+fbntOZ/xy7w7FluYNRVTGDvhOwAfEQ+bxtZITEdsLfvbIPUepO4Xw:JpItK/xX7Lj3T0vhOwAfUZIuMepFXrk
TLSH
T119257C22BC80C032E5E21476A2BD8FB65D6D55302739A0DBA7D818B59E700D3B73D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 80d19c23e407ccffe9f5b43087c752b2157294a1e42d887705b9924ceb9e6af9
MD5 74beabd4347b1ecc24fdc6cd9bb2ec64
SHA1 b793909bd2bf91d40eafb71194cc3eeb0c057110
SHA512 f36be6d71e6ae79ffa79e9bc8d57e79cc14ace932fcc2106ab4df8f4ba99506dac3c007d986dfe3bf8884977a411ba1faa713489dc27b25c23bec49d42abd802
TLSH
T1EB418F303221B8D84D435F0205286ED5A3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 3e2b5f610a192672e62f3358966d097914cd0c77ae8379031f6943241077379d
MD5 9bad6ef2a3e7f0a02711086aa8f5218a
SHA1 18b024942fc0e2ca264803120d5b6e38d3ba976a
SHA512 10b2d0e2beda9dd4cff145f5b46a40577d0bfab6da40fa29d7b0091f1068a5f247bafb751a5a51fd857ad4d8dff17f51f9c976a0c50a134da38ec05255881d0f
SSDEEP 384:0sf+US9i+HKJD/cVFukclwhfThK6seYLME/N03SoZufYSgcjEDkVQhuv:BfEKOTtUwhfThNgrWS5WCEDZc
TLSH
T11E72B56E610F26C3C4C223B8D10B055FE8F29ECD531A17D97A5A9F3B4EACA5E503C199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yxfh4bok.deu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxfh4bok.deu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\svchost_tmp.bat
Size 614B
SHA256 88b40fb80183d4ba737daa441ddb09b53c980a5976bc8d2fc104ff64507cc160
MD5 4399cea89220966efa9b68213b63352b
SHA1 e89a32d4b47def8af12ae4a4a142b8dd388d982a
SHA512 fc44387fa4a57b042a8c68d46527a9c95682d0fe992392766f54ef2ad131f59260743e04e654a4f0ac0dac691e99c6c7537fc31529c7a95accce83283ea461fd
TLSH
T196F028159299528504E91163A67DBD8BD36EC94567C8F3C9B020C8AE61CE80AF28D394
MD5 SHA1 SHA512 TLSH

Submit Download

j5uf1kog.ps1

Path C:\Users\Admin\AppData\Local\j5uf1kog.ps1
Size 521B
SHA256 a17d529dca2825e362c9ce87b92376bcd6a0822134480867c7146973da0e2f01
MD5 c970d80b563cbfc32c01c7d5b944ba6f
SHA1 14d358d42ab3e746a25b6c5207eca5ac44d23425
SHA512 1f60a326d8caecc78587f28112176c2af5eeeedc8b4535225c7170c7e65afc37f0c4fa82441d965a995e6d2ca75a98bfa7b11ee24aa37c9fbb1d19cc42a47097
TLSH
T1C6F05932F61070BF9D0A143CC883A6C064B151BF9736A868B42489287FD68BFD30189A
MD5 SHA1 SHA512 TLSH

Submit Download

j5uf1kog.tmp

Path C:\Users\Admin\AppData\Local\j5uf1kog.tmp
Size 9B
SHA256 421a244564c34296e185cdcf70d2269227ae102f2e7eeef94afddd495c4e06c2
MD5 e6a14ea593393eea75c2d790134766f3
SHA1 36b5cac6f1bbdddd0a98ff0fa64d9d093a7d41ac
SHA512 9d2882c5161a6e57583f0fd60d46d54441f41a24122bea26ca45dd95d05ef4363a2be85704d66898b07be1cfbdc87d58861c4265211da24dedb84ff07ed06773
MD5 SHA1 SHA512

Submit Download

memory/812-13-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/812-18-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/812-19-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/812-20-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/812-12-0x00000000007C0000-0x00000000007D8000-memory.dmp

Download

memory/812-21-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/1152-141-0x00000000079F0000-0x0000000007A86000-memory.dmp

Download

memory/1152-126-0x0000000006480000-0x00000000064CC000-memory.dmp

Download

memory/1152-140-0x00000000077E0000-0x00000000077EA000-memory.dmp

Download

memory/1152-138-0x0000000007DB0000-0x000000000842A000-memory.dmp

Download

memory/1152-139-0x0000000007770000-0x000000000778A000-memory.dmp

Download

memory/1152-137-0x0000000007450000-0x00000000074F3000-memory.dmp

Download

memory/1152-136-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Download

memory/1152-127-0x00000000069F0000-0x0000000006A22000-memory.dmp

Download

memory/1152-128-0x000000006F110000-0x000000006F15C000-memory.dmp

Download

memory/1152-115-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Download

memory/1152-125-0x0000000006450000-0x000000000646E000-memory.dmp

Download

memory/1152-124-0x0000000005E60000-0x00000000061B4000-memory.dmp

Download

memory/1152-142-0x0000000007970000-0x0000000007981000-memory.dmp

Download

memory/1152-114-0x00000000054A0000-0x00000000054C2000-memory.dmp

Download

memory/1152-116-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/1152-112-0x0000000004E70000-0x0000000004EA6000-memory.dmp

Download

memory/1152-113-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Download

memory/3064-155-0x000000006F110000-0x000000006F15C000-memory.dmp

Download

memory/4776-40-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-111-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-110-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-72-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-73-0x0000000005080000-0x00000000050C2000-memory.dmp

Download

memory/4776-96-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-56-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-67-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-68-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-57-0x0000000010000000-0x0000000010034000-memory.dmp

Download

memory/4776-55-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-54-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-53-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-42-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-43-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/4776-41-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-39-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-37-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-38-0x0000000003850000-0x0000000003896000-memory.dmp

Download

memory/4776-36-0x0000000003810000-0x000000000384F000-memory.dmp

Download

memory/4776-167-0x0000000003850000-0x0000000003896000-memory.dmp

Download