bf3c03ff11e6610bbf806084ec2d58cd5aacb87e52cbf965a789fa74584de3a5

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/08/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NoEscape8.0.exe
Size 15.0MB
Sample260816-vdl4gaef39
SHA256 bf3c03ff11e6610bbf806084ec2d58cd5aacb87e52cbf965a789fa74584de3a5
MD5 1c18f75dafd667fb5559cf9b7cb5868e
SHA1 deab3392cf25ebc52f15ecdcf7e4187dcaec81f7
SHA512 c68c8ee27265c81e7bb6ead434436398d198b9c2ce83092a8deb8539045b10b47ed660e2451297edd7eeebedc5254000fd5ad481f4642f64f4d74d6a964d3015
SSDEEP 393216:ph/RLjBJPkh/6StJ+4qnWSz0hgSovW+PABRMW:phVcm9z06WEORX
TLSH
T16BF63323FA0A20B5C6B1887196B22F12E537F4214F6896CF8796C56A3D704C0F7576EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 11 IoCs

pid	Process
2904	boot.exe
1060	boot.exe
236	INV.exe
4548	tunnel.exe
4524	melter.exe
1540	10.exe
3776	Magix.exe
4888	RGB.exe
3548	gl.exe
3340	test.exe
2216	Circle2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\yourpc\\boot.exe"	boot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\yourpc\\boot.exe"	boot.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	boot.exe
File opened for modification	\??\PhysicalDrive0	boot.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2652	WScript.exe
2204	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2556	cmd.exe
2500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	melter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tunnel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape8.0.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
2608	timeout.exe
2836	timeout.exe
3304	timeout.exe
3600	timeout.exe
4300	timeout.exe
3988	timeout.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
4628	taskkill.exe
3968	taskkill.exe
4584	taskkill.exe
1980	taskkill.exe
3808	taskkill.exe
1888	taskkill.exe
2552	taskkill.exe
2412	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	10.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5020	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
792	schtasks.exe
1380	schtasks.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	3808	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 2556	3164	NoEscape8.0.exe	81
PID 2556 wrote to memory of 2652	2556	cmd.exe	83
PID 2652 wrote to memory of 2500	2652	WScript.exe	84
PID 2500 wrote to memory of 2904	2500	cmd.exe	86
PID 2904 wrote to memory of 792	2904	boot.exe	87
PID 2500 wrote to memory of 2204	2500	cmd.exe	89
PID 2500 wrote to memory of 5020	2500	cmd.exe	90
PID 2500 wrote to memory of 3988	2500	cmd.exe	91
PID 1060 wrote to memory of 1380	1060	boot.exe	94
PID 2500 wrote to memory of 236	2500	cmd.exe	96
PID 2500 wrote to memory of 4548	2500	cmd.exe	98
PID 2500 wrote to memory of 4524	2500	cmd.exe	99
PID 2500 wrote to memory of 1540	2500	cmd.exe	101
PID 2500 wrote to memory of 3776	2500	cmd.exe	102
PID 2500 wrote to memory of 2608	2500	cmd.exe	103
PID 1540 wrote to memory of 3672	1540	10.exe	104
PID 2500 wrote to memory of 1888	2500	cmd.exe	105
PID 2500 wrote to memory of 2552	2500	cmd.exe	107
PID 2500 wrote to memory of 2412	2500	cmd.exe	108
PID 2500 wrote to memory of 4628	2500	cmd.exe	109
PID 2500 wrote to memory of 2836	2500	cmd.exe	110
PID 2500 wrote to memory of 4888	2500	cmd.exe	111
PID 2500 wrote to memory of 3548	2500	cmd.exe	112
PID 2500 wrote to memory of 3340	2500	cmd.exe	114
PID 2500 wrote to memory of 3304	2500	cmd.exe	116
PID 2500 wrote to memory of 3968	2500	cmd.exe	117
PID 2500 wrote to memory of 4584	2500	cmd.exe	118
PID 2500 wrote to memory of 2216	2500	cmd.exe	119
PID 2500 wrote to memory of 3600	2500	cmd.exe	121
PID 2500 wrote to memory of 1980	2500	cmd.exe	122
PID 2500 wrote to memory of 3808	2500	cmd.exe	123
PID 2500 wrote to memory of 4300	2500	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\NoEscape8.0.exe
"C:\Users\Admin\AppData\Local\Temp\NoEscape8.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\yourpc\skid.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\yourpc\run.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\yourpc\main.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\yourpc\boot.exe
        
        boot.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\yourpc\boot.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:792
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\yourpc\es.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:2204
    - - C:\Windows\SysWOW64\reg.exe
        
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5020
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3988
    - - C:\yourpc\INV.exe
        
        INV.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:236
    - - C:\yourpc\tunnel.exe
        
        tunnel.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - C:\yourpc\melter.exe
        
        melter.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4524
    - - C:\yourpc\10.exe
        
        10.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
      - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Documents and Settings\Administrator\Desktop\18769.txt
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
    - - C:\yourpc\Magix.exe
        
        Magix.exe
        5⤵
        Executes dropped EXE
        
        PID:3776
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 30
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2608
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im tunnel.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im INV.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im melter.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Magix.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 20
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2836
    - - C:\yourpc\RGB.exe
        
        RGB.exe
        5⤵
        Executes dropped EXE
        
        PID:4888
    - - C:\yourpc\gl.exe
        
        gl.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3548
    - - C:\yourpc\test.exe
        
        test.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3340
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 30
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3304
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im RGB.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im gl.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\yourpc\Circle2.exe
        
        Circle2.exe
        5⤵
        Executes dropped EXE
        
        PID:2216
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 30
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3600
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im Circle2.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im test.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 20
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4300

C:\yourpc\boot.exe
C:\yourpc\boot.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\yourpc\boot.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10.exe

Path C:\yourpc\10.exe
Size 291KB
SHA256 fa758441587efb6f25391ceda3bf7c9293555dbd7d36472a2c76c3036f6d9c33
MD5 e2001b6e75f84968a254b49faa45b7be
SHA1 c70f93d5833543bb96c06a2e5a6642da0b283f12
SHA512 ebcd62730268b7f6f8b880a7c6d321bfb444e4a6ae0ea9e1a1c02a00db5737abd09b4db5e4515a9060de6d95cba49c5bd0e69a9903bdfd1c54f18eeb031220e3
SSDEEP 6144:g8JsLcpjzTDDmHayakLkrb4NSarQWkT1XhR:tzxzTDWikLSb4NS7lT1XhR
TLSH
T146547E12FAC1A972F1716B315526EB606A796A300F24CA4B53E08D69D9368D0FF30F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Circle2.exe

Path C:\yourpc\Circle2.exe
Size 132KB
SHA256 9ebda86d4ed28999d69c1e0f50fcab9b191bf15acc1d9cc0a597263ee36b6610
MD5 89c39815003090838eb6b7bd87f5525d
SHA1 c5f2821319488dc541c91e8500328f09eeef4ac0
SHA512 0c5c6bfe296a581f5d4ff77bb37e906382f00bf8ec2274f2c95dc334ae3e8d0806a54403434e32735b0e57cc715d184f62f99c713783a8f9d6c79ead007c383b
SSDEEP 1536:gr4GssQysmaeXRjc0DeWkSDL7CRlAUvMFMQiNoR+QUfAmmpkrc1:grlKWobSDL7CRlopRJiABp1
TLSH
T123D31AC7BB94DD97D915433845E68319133EF7D087824B132D20A9361E23BE1BED668A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INV.exe

Path C:\yourpc\INV.exe
Size 103KB
SHA256 8e217ce5670ac1021fdb6101372f9322f7ff82481ecd9badc104ff542e46128c
MD5 e079c468c9caed494623dbf95e9ce5e8
SHA1 4d8d1d17e9d7ff455a5c69e048d7575b5a3ea0f7
SHA512 d9c1a6f28c0c76b6856dec8723eb79d1b620a70b8ab3b5f028848e890a684beeb3460e310959c69f21cffb0a14751ea6cb719aacdbc2043121f057dd56f868a8
SSDEEP 1536:8F75iTC5c/Ygy/EOfu3yUyJCbpVUi7uXSopGl:bm5c7y/f93xa
TLSH
T169A307D7FE8AADA3F925133989F58319033DE7C00B828B171D35993A1B176A1BFC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Magix.exe

Path C:\yourpc\Magix.exe
Size 59KB
SHA256 68cb1fe2ee7c3f69fe2d508d117b502ed19337bd332e722605e491a823f89645
MD5 026992ed7c38fae57e8839a6c0d883c8
SHA1 9b389aa3dd774f3cfff3dcbe8ea8779ef005b31f
SHA512 d20fe47538b9e1fa0ccf198f5a4a31506cc59622b2492e9f64435fb06b66ccf93cde056693656da626ebf56ab434425fbf3291db979fe6c67b2a7a14649d9dc7
SSDEEP 768:tnrwQzTcgq2Nlft1UfEqTIYv4gKNwFPFJX+FbhfuKQRee:hcr2N4EqTIm4gKN2PFJXi1GBR
TLSH
T1D25372E43AD89C9AEA10423C41EAD332667DB6D0CB534B1726307B321F12BE57DD725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGB.exe

Path C:\yourpc\RGB.exe
Size 130KB
SHA256 29297a0ff5b8b80cf5c96185ad6bd7a323dac9749185c516363e84b6710627ce
MD5 b326cda81e5711aed4c4dca71e111c3e
SHA1 9e64c68663135bbb1e55a839f46b00a634f3bee1
SHA512 2dfee83e49d83867f1a28c904d31920a393ad56e94c31bcab13a881f2caae35ac387de2e1b8b33b8b09655a6af8d619da63710c03f54d57ee76abf760a292e6b
SSDEEP 1536:AgbkE+JTsxyXmarXRKtP/eWxXqMYmARUNAUvMFMQiNlRiQgX81jrp6:nQFJ7RKZXDYmARUNoMR1gXQ6
TLSH
T1ACD32AC7BB94DDA7DD15433845E68319133EF7D04B824B132D20BA351A23BE1BED668A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.exe

Path C:\yourpc\boot.exe
Size 150KB
SHA256 986192549387d257436b94d956234dce12f151ce6904de660e5d39cfce21b775
MD5 0b71c2b0a5cb052457abd1e09f6302cb
SHA1 e17040a434a818b98d6c217bb73ccdcdc603c56a
SHA512 fd3e41b1fc8e9aa5f1a5da6161be6f4aa277e3e1377f20ffd217004bc015ddbf3e4c80a7316d99fdfda6e32d497a0996eecb4ddc55b0b011e7c9a74944fbe1d5
SSDEEP 3072:1JVD1zx0HrJvtuKm8wVKQ3+nBgBDUQID3RjfpbYbiTWNLkkk9:jWFvSH5UQ+hjf5YbuW
TLSH
T112E36C07B3D14CB7F0F30B789D56B225A43A7D101E35934E2FA48A0D2E2EAD45A1D79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.vbs

Path C:\yourpc\es.vbs
Size 39B
SHA256 095f01222915f9f8d71edb1593d70b7336c89aed4b42b14dc8e5cff482ab8d3b
MD5 9c2d6662913494f5f7ecc95564f87132
SHA1 e62502b0da2c9714b4cc1bae0f39c7014a9b2d00
SHA512 366b4739de8aaddf5133a9f50589e870b187ee0a366c4c3166adcb071c8d3aa180d978c3f85916690763dcd0d99449782ecd18df5144447695490b112f9d4cbc
MD5 SHA1 SHA512

Submit Download

gl.exe

Path C:\yourpc\gl.exe
Size 105KB
SHA256 595f476a34f1b6a481a89aec8bab0e323e7ccc7fbc53586982d26f681ddcc4a3
MD5 754be91171c29e0b2b35c209553c6e45
SHA1 73da71d831ba2c13aaf28a9e2d581ee52d95d639
SHA512 1ea4b1c01548275f701ccd09cc4018f60efcaacbcc8676fd989d05e9322e5f5bbd967e5206bfda18f6ce6d989dfa45cd4dd9155fc08c1fbdbb2ba025c2927fc6
SSDEEP 1536:7FvDf5iTq3crYTy51O/u3yUyJCb0thM7Fj:VMu3cIy5ezWj
TLSH
T1BBB3F7D7BE8AADA3F925073989F58319033DF7C01B828B171D31993A1B176A17FC9246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bat

Path C:\yourpc\main.bat
Size 1KB
SHA256 9eca23b0358e5507734ef7a2247c310c7be23c85776913c49947afb41c885273
MD5 d381fdbe8f6a130e25247fa1e029805b
SHA1 618a09cf851eb5bea77595df2e66412d2d954cba
SHA512 f1f7ca8d93c9764a6223121943fb2b31bd896df975a1c17f745a66cdd5777fe8e0197721da0b9e1610b2a5bdbd8b4ecb4d676df09baef7f35a038a7e5a97a444
TLSH
T12A212906CC4BA0C18DD199C2A3DA37C1E6C7C16B0DA4659936477079381B80CEB7ABDE
MD5 SHA1 SHA512 TLSH

Submit Download

melter.exe

Path C:\yourpc\melter.exe
Size 3KB
SHA256 a1d883577bcb6c4f9de47b06fe97c370c09bddffb6569b6cf93576371bdbc412
MD5 d9baac374cc96e41c9f86c669e53f61c
SHA1 b0ba67bfac3d23e718b3bfdfe120e5446d0229e8
SHA512 4ecdf8757e75b02da06a9d42a8ca62b9f2ef292dc04fa37d96603af78433f8aa9dd82fcf1e128a8f463b9691dcc1645b4a64e34f3c5d631f3a0e0670da0d0457
TLSH
T13C51E75B7BDADCBFC67C0270365E750297A247109E299F058EC039C233D268BA9F1103
MD5 SHA1 SHA512 TLSH

Submit Download

run.vbs

Path C:\yourpc\run.vbs
Size 54B
SHA256 ac59324226f082c21f5364d027f364086e86c9488dce674d7e93bf5c7c0cbcea
MD5 95cd248d3e5740a059a01eeef728ab48
SHA1 ae3e55904ade22ab4672f1f85db865e8e66fcff6
SHA512 aa149aa3b524002defd4f92579f672e6e5f3f2deb5124f5adf8980e8386e0faf8f81a5b9667751ac6e19dd3b50f1688a7dfd147e18c9de229ce6f955184ad4b3
TLSH
T1A5900214794CD351152581CD2631482C86C4ADD55011E5050740915D05A9F510A1D10A
MD5 SHA1 SHA512 TLSH

Submit Download

skid.bat

Path C:\yourpc\skid.bat
Size 310B
SHA256 23efa2c8b42c0c599a2bd60cadfab2eac3a439e891509dc70c1ee2a9f5e86f2c
MD5 427d18145e233d828cdbad04596134c9
SHA1 84cb6fae8ee844be1fd9eda8a6a74a5cce97ded8
SHA512 fd5e0a70a4bd082311ab5559b832ba8ae8fce91a62faeec827e3a14a302ceda3697b2cc4d9f1c082170fe22ffff52b022791ebc8c6ec35a3946a9c3712e99444
TLSH
T15CE07D01F444409D45A90DC95FF2F105DAAC70E284E13F46F45740314AB7345E33A437
MD5 SHA1 SHA512 TLSH

Submit Download

test.exe

Path C:\yourpc\test.exe
Size 74KB
SHA256 199e4e84b644b264d170b04945880f095790206c65fdfb5a88c8ab73bd29357d
MD5 64a69d3a6620009ebe49595a5d8d119e
SHA1 4d478712f6503dc7f32e600d7b5aa0118c83214d
SHA512 b2e6ace579201f74abea5d4aecf416980ab028d1876ffc57e474b2b2142489ec4589a4c151eafa4a9067b446396829a370c882b0d40ab8073ad7ff266bd6653f
SSDEEP 1536:xPh9aglugezT6Q0LxPwy8h4U5Y/00vXuqJVS6e2sWfcdXTFucdjI:xxl0Hf0VP1e4U5u0hCs6epXTF5djI
TLSH
T1EA733B03B4D29871E5B61E315870CAA46A3FBD111E658F6B279412BE0F340D1AE39F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tunnel.exe

Path C:\yourpc\tunnel.exe
Size 103KB
SHA256 732adadb4c7167e61f0f5763c2c01e43fb01369683d23c9652aea99f6c42c810
MD5 7dae1fb2e3a65e8dd594b021a6923e24
SHA1 acd069dc223cc4802402944e5afec57d2ae31c08
SHA512 121f7f7c30361aa141192586133a670d989b2615d7e451b0e5a2e5375c46a67c9c404df4575778b7474ddf48b1be2d29d61df7d534473725d66295b3d4ef2919
SSDEEP 1536:78l5iTCgcrYisyu7OZu3yUyJCbcVkR7GZVU:7v+gcDsyuaGcg
TLSH
T137A307D7BE8AADA3F925173989F58325133DF7C00B828B171D35993A0B136A17FC5286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-113-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1060-97-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2216-141-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2904-94-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3548-133-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3776-118-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3776-121-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3776-122-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3776-115-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4548-114-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4888-132-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads