darksiderat | be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
22s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
account gen.exe
Size 368KB
Sample260818-2dpmxsal3v
SHA256 be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0
MD5 93b152ddba79f433c3a17fa907c01a06
SHA1 8cce14920662a7c2ffc3595bb625ef5e7603735a
SHA512 e85dbb45c4b40bd67b0594ddc6cb96f717ce98dab7c4a2147e42225e89fef1076b56a1303653c80209c42c03535df817e05735a7706096da0ce65c362aab6126
SSDEEP 6144:QwR3cLrvZBKCGfiRm/6nEVAQFXOhEwYRfZuy6MTI1Ng1NdiSKRa58z8SsD:QW3mkSRSFAQ4q14Jr7sdi1Ram
TLSH
T12984231453DF95A3D87578339E6642B44B3FBA9E4D86AB2363CC1DB8AB16784FD90003
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001c557-15.dat	family_darksiderat

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4100 created 3772	4100	account gen.exe	81
PID 4100 created 3772	4100	account gen.exe	81

Executes dropped EXE 1 IoCs

pid	Process
2000	Loader.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4100 set thread context of 5652	4100	account gen.exe	89
PID 4100 set thread context of 4684	4100	account gen.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 5652	4100	account gen.exe	89
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 4684	4100	account gen.exe	90
PID 4100 wrote to memory of 2000	4100	account gen.exe	91

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3772
- C:\Users\Admin\AppData\Local\Temp\account gen.exe
  "C:\Users\Admin\AppData\Local\Temp\account gen.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    3⤵
    - Executes dropped EXE
    PID:2000
- C:\Users\Admin\AppData\Local\Temp\account gen.exe
  "C:\Users\Admin\AppData\Local\Temp\account gen.exe"
  2⤵
  PID:5652
- C:\Users\Admin\AppData\Local\Temp\account gen.exe
  "C:\Users\Admin\AppData\Local\Temp\account gen.exe"
  2⤵
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Loader.exe
Size 87KB
SHA256 7a2f38df13d43bc270d4a4d7fa532313a2a8353d1e785c8ad686868b11b4265f
MD5 4d14d43605dbe974dea0a0d8afc81d60
SHA1 903b3f0a8b72de3176ff7bcaaa06ca3499df5f0a
SHA512 b78e22ded4d91fd25bf2197f003b0967c38be78dcb628ff4631c9622989a2abf80f57b97aeb920f6025b7324a01912e402fd33bec2b9614e3a1354e088647d36
SSDEEP 768:nv4Dh3rZbHU5OjOar7uL/AGof1J7DtZl++J6dhz8agz88W9CcCyegMxJMcgkzq7v:Uh34z9Y+97kehomTkfrJrjolYu1l/
TLSH
T19C93F535DA9AB16FC2498478ED024C06DF53B89E8661BF672BD24DC54FCAF602F2C590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddEnable.otf

Path C:\Users\Admin\Desktop\AddEnable.otf
Size 492KB
SHA256 6e69b1fe0a5196f3e45231c15f9e7c98f3ed908263abcece0dc366f3d396101f
MD5 d1abb000e92dafe2171980b5d53205c8
SHA1 2da62d6e84ebda748d967669735d990eb8ed309f
SHA512 cbfc7df50aec83404dfd53053e124a251bcfc527d3868a1209ac58d3c80e5538a868cfd9edca93c2dd90734cd92ed841c42f5305a60f4e25f176335696d823e8
SSDEEP 12288:nwlDGJyUpkzBjTV/++91Hp0xKZydV0WqK25t/T528:naKgTV/591HpqKgUJT5t7k8
TLSH
T1A6B423695B6422B91B9590DC57671F30AA9C52F427173FA379CD000C6CE1BE3A6C88FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockUnpublish.tif

Path C:\Users\Admin\Desktop\BlockUnpublish.tif
Size 611KB
SHA256 834556b783916fa7c41d359cb166ecbb76ba921932fbabda3e0b3748f53f540b
MD5 f36232b5b3bb352c01f7874d68ed2916
SHA1 09fe7ff8186df45bc4cccce0b64620d60376be62
SHA512 f46949ba468ffdeec267bbc14ebd108068589ce87a7f09d6a30f147b07c71261819e9e06eed03ec1bc61a80f16e4cf53f8a774056d17dfd0a67d7b86cdff1926
SSDEEP 12288:ousVDPKl6V5PfjX4VeAwfYmn73kcYQ7ZJv60blih/RhM4:aVDiILu70vb1Yw7gRG4
TLSH
T142D4235987333ACE3A02CB5968F6D85FBB39F5AF413C037AD104A41AB42D8C1B7C6596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearFind.mid

Path C:\Users\Admin\Desktop\ClearFind.mid
Size 254KB
SHA256 f872abbee6fbf8233eabeb0ebe6aee9622a13906954fbd9fd8cbb19d09c5ee24
MD5 0f0a337aa46d3c2a5e4623c6929657e2
SHA1 9d671e6a66f461d5edfd1457540b293097e2a669
SHA512 6decf6e16470eb90b58c18144a387cede1fb8dccc4ec5665058a1801d5b9b8a6222e4401aac6d313ad3d2a676556fb4d2a171a5f7bcaf955ff1a68f3605398ec
SSDEEP 6144:iu4ER0MsnIcIyZB073asqGD4eEBZpdP2GZkCjt:i3m0Ms/IC07KsSOGZDjt
TLSH
T16144233B8E7DE7050750D136741406F7F7E9CA4FE6A491F9AAF980B36219E1C4039B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmMeasure.vstm

Path C:\Users\Admin\Desktop\ConfirmMeasure.vstm
Size 305KB
SHA256 6a13f76ab7b0dcfa8fa385af9e008338b1058c0bf4642256a5f5641fd51b1846
MD5 9f3bd4ae0a7c6250ab7fd1e2c28e6918
SHA1 30ea7890acabc6df178f1cad25658a65ec01e7f1
SHA512 f38817cd0218ca986768c1377b547f5f98a98075b40aa97778ad5161aebc6055769cb0b9d672eae209c85f3bfe7a909a067ba9ca277105f196aa4897e2619061
SSDEEP 6144:XdLU7TkWmrXXCiUjDvzrRrzALnt/wnucT8CndXIlbLDg:XJKTErXXCRjDvnRWt/wn1T8c4bLc
TLSH
T1216423C10F04FABA694A495A903FACC936FB9FC85A059B15B3FCFD04EA76719A40407D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmMerge.ps1xml

Path C:\Users\Admin\Desktop\ConfirmMerge.ps1xml
Size 356KB
SHA256 0ce942c5c108d078da15a56b72410c0f7f259feb07e547424a25d6d6874e89e8
MD5 b8f09b86620c6917115860a48d3ca4e1
SHA1 f9e2d91e5dfd0e873dc38c883f0bf63bf1e74be2
SHA512 8a840f261cd6573901e6fb3693466c59a2a73572d1032c1907bdfa2a15418f2fc533ba29af94ac8ea60f78fdc0ecd270ec2594874eb8201e577f9a5fa756199b
SSDEEP 6144:UhI5hYxBdWbeBz0r8wGa1UqoxVemEiYQOE/+cGrmfi93xRGzHtmkmIrhzQwYcCq2:TEBdweBz0r8wGXqox7LOWormfi/RGs1L
TLSH
T11C7423EF17615FD8822CFC7288FACC4BFB67540E9D032550C8B9294948D907B35A7AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToDeny.midi

Path C:\Users\Admin\Desktop\ConvertToDeny.midi
Size 509KB
SHA256 10a60193189c26964fdb70359248ee89216c7329a04a2dfb0768dcdc9d6202a5
MD5 ac5e378fd2cdd7839b641a96e14496ce
SHA1 20c39db183bb4b16a3a1a64c279d72c57cdb7cb3
SHA512 b4911d590ad4a86cade7c4b13aa0ada8da26d8851399d2d027a17aa4838f8e4267960a4acf5db743cb1231c8fda89687f7469d95bfcf2216da3067dff09d5a0c
SSDEEP 12288:oh9TMi4UvrHL6Zi8CLtUvZ4sfVmhTBlnjSraR4d:+NHrHL6YXsfVmtBwHd
TLSH
T1AAB42329D822929987BDFC5EE2C39500796373343EEEA65EEEB13C4A14058B717F3524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToNew.mpeg3

Path C:\Users\Admin\Desktop\ConvertToNew.mpeg3
Size 441KB
SHA256 65d7b0bfc503b05c9c647543e44e0ecdf6f79755a556284826cfdfb39584e7f9
MD5 3988e39d84d8218e7033e0dbd337f806
SHA1 e1e12c7017f976d889bd6c8907bb007b2872b970
SHA512 ad13ab0b6632ec8ee76d164f9fe66b731209afd8f1d2cc43160ba25453c6dbbe5c54c383969c719d491d43c156564d00d64421d475afaedc60ca732f53714ca5
SSDEEP 12288:4TzUNWZw0ZUixGYd3qrWLecHmbVH/vlr/l:4XUw9UiV3qwHHmbZvP
TLSH
T144A42326EDE5CD8B3AABA7CAC1BBE6106D3D5C804BE439529360F144C3225A2C51CFF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugSave.mp2v

Path C:\Users\Admin\Desktop\DebugSave.mp2v
Size 390KB
SHA256 f18868e90d4a01623e7cab8aa8b4d4f6ac8156799eed30061354ba904cc91f76
MD5 2d1745125ec991af9b9b6361017b8763
SHA1 65f5e25f4226ce22cf5512ca74d949dae9d7dc91
SHA512 472ca6940b01e1f13159a12a2a49160dd2cb3b58b4d56bb1bac89c1b038039b66a3bb5c5f40540cd05f7b35c3886d51332d17b3ac22cb572aab2ff098096d62b
SSDEEP 6144:WiuiTQ8cV9M8sLguYtIyBB/5M2htInF2zLZ1sJ77U4KHiSuh1Pz0QmvRhOTpTyhd:WDQcV9p7BBB/5Pe2XUJPainbolhFhd
TLSH
T1C684234A797401421DEF95D3A6CC82ABEA0B8F947191481D9C66E8EB375FA708FCD390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditUninstall.ods

Path C:\Users\Admin\Desktop\EditUninstall.ods
Size 645KB
SHA256 1ae6a8b079a20ba3e39c38bd8f9b97898ecd9074dfce7c59a94051fd2dc118a3
MD5 ea4920212cc147a23a795fca0c5a5085
SHA1 f0468810bae3d7090449a1756a38f9279ffda887
SHA512 bd279400f572cda7b85d6e3315274891122a288c8d8b54326a743e9baf66ed60fdd0338d83c822470d6195f00ff7cc3327821108358c1f0508dfc6a636b9dd7d
SSDEEP 12288:FhYd1APn/aHBpEtjJ4G8v5l0tpP7x0kUxexHJVb7+CUcQr7Jg:8wCpi0vP/edDf
TLSH
T160E423F5514EE02F07036E4B9EE1CBA5E1022B1981CA0D9AA24169CBFF1176534F9FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableRedo.dot

Path C:\Users\Admin\Desktop\EnableRedo.dot
Size 458KB
SHA256 c79b8ce893a190f5b167e9e980fd588314b6e5b181938b8a8348ac98cd69c42a
MD5 d14ea6d24f9ed311d425893bbbdc9244
SHA1 3f885d1f153c354f2be3df78ffb5246eb02fe697
SHA512 e647037ec01305c9165936c798826707864a4fcf26a66af4c4b7f49d6f18a8e1e91a2139436cc8693ca516f266a4a0fbad042b6db24e24f929ccadfbaef9cf85
SSDEEP 6144:HBhKC5ie83S6VQfg9Ysu7BGowvOxy0Qn9rQPGSAj/yhOIHNCWCiIlLvkPVC2eysB:qCYe83Vfu7BiL0VGHMHNCWCvGVC7No8n
TLSH
T166A423EB60E5CF0F9CD82A191CF877D7D80C1D6117686FB7A74681B9892DA324D8C2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitRestore.reg

Path C:\Users\Admin\Desktop\ExitRestore.reg
Size 407KB
SHA256 d610e57f6a387e5061f156d715ff65178d59785919bae6cb102e70892d4094d6
MD5 5f76d09259fe93b9c183c6308ca76bde
SHA1 8cadf7011611e4ebf9f7fc381b56cc0c29d07304
SHA512 5808fd212cb64ffaccea43c79dcad0a3140d761e82e13c0eff32e54978d4c1f18bac08962e1d6e7a989c2c0fc5b5dc7d052a2a74b7b6a3e36514f93128af907a
SSDEEP 6144:eqmX1UpQPyi8JSwmqrG2Sy3fu0PBJvLehVPA3Hem+NDbWjou/B1FJafyGd6NUAI2:C1UpoXXUfuevr3wNDbYTHdUArd
TLSH
T1B29423D85CB0ED9F3D4D078DDDE67CA2B1AADF6119A2CE58502346713048BB7884AC7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportClear.gif

Path C:\Users\Admin\Desktop\ExportClear.gif
Size 339KB
SHA256 0d65b0024f992fc11243c5224c5edb6a02f8602825fdac3105dd688c79281b67
MD5 4b636c9315300f8b7271ee64205ea570
SHA1 530d1b08827c4bcaf7f52444e393a198ed7a24ef
SHA512 2dd288cc277d24566ee9a5d39c241612fff2d2f880e459e073b5a3ea81eb1e5850dcd2abf2711bde38e2f48e54912a41af063d11f906d749946e77193aa0280c
SSDEEP 6144:nzdFbhPYsNbE4V6/qUhEpJwEiHrVhmksTgn8hSMRxkDc92Jn7EFVsdxR2aGmz03n:nRFbhPzNTViqPpAHr77s7Rxk6GngIdxI
TLSH
T1AD74231F07CD18C62EF4DAC217C735E5D86CF205A2E60E1516049E5E89E434789EBFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportComplete.dotm

Path C:\Users\Admin\Desktop\ExportComplete.dotm
Size 322KB
SHA256 9c0c884d7b8b3cc37d77ced8607326723a552697ffbd06e381f5c2fdabbd2eb8
MD5 643688b2987f5a425da197aede8b4e94
SHA1 fc1793e8a57ce00ddd801b4bea362c8ff582c475
SHA512 0a7f2cc534640ce76d181488bee54fe644af9de4932c47faa7633a8cd53df62b459898a7e1d3e915d6eb86b5f686f18dbcc0e8ce60d7e811992989c31997e190
SSDEEP 6144:ri4LThPuszWIUXUApmjgaZbMmQh5TNSwBpIKykY6eSJqmiKWwm:rJQqdUXSDZAZoKFYmhHm
TLSH
T107642360CBBBE0F81AE9514847074B565E94478B94D4DF123EDE4D1F18EFB8C728A391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetOpen.xltm

Path C:\Users\Admin\Desktop\GetOpen.xltm
Size 424KB
SHA256 4149b6ae9ee35479025bc40bf546a175ebd0966613ce53bcfd595d22f1fd79c7
MD5 a971dd0e0e8c7d59c254429ef05fdd66
SHA1 d47f3636e52dbea156e7403e9b68f7f4d5bce47f
SHA512 3a2828b5abd65592885c6a5c265ab609f3171d49240155273c3aa0ad9a1b1c74b2e0b62535f3d6c678f1fcd17231fed78392af3e4b8af7fb27e5893f01f9686a
SSDEEP 12288:AwrwcCVoB7prbtqyb27FlpXfuekir6f2/AK2:A3VqYyb2FzkiOflK2
TLSH
T1549423D65057ED35A0B8917FF2BA6FCB2C732ECF748E4131278C28154AAC7696736281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantUninstall.vbe

Path C:\Users\Admin\Desktop\GrantUninstall.vbe
Size 933KB
SHA256 4ea6df8a1287d9fff438ef54891649e7d2b22ede09c60abe29f0d7daabe3bd46
MD5 e1409ae32ab315f2867e7270717d62d1
SHA1 c868ce11bf4ed13d10cd95db8c0c6faa8c581918
SHA512 aaf173c942b8e1ded2dd1bd90571d6895b3c1a1fe3bf24ff2029f38a6a116953453f41f78709eb3a53a0905f70ffa018c75bfbff71d7ef3ea8630cb8e9cfc703
SSDEEP 24576:62pzvUTSISUGBpvNjPqRy8DdbBUGDYjxoqXIFF:62lVIZYpljPqRXhBUjjxAF
TLSH
T10D153383D28A027626B21D50F2CF621544F5F08B54577FF0124AEB929BBD9EF603F692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideFind.mpa

Path C:\Users\Admin\Desktop\HideFind.mpa
Size 526KB
SHA256 f9fcd68fa5e7afe5903fd8a818bd9b96943e83ca5c452c3c07fe6cd3a29fab6c
MD5 089b53d46f8315b9289ee2a7edf2caa3
SHA1 d708a237b9007d512c7192d48c45d7e601943d6c
SHA512 fed15471864e500714b3c82b6b5c2ac70a09b420ce67ac5acb61694e264eda337070aaae43783e50af682441371c3bf6398bb768614da2d154283fe0f1f666ec
SSDEEP 12288:9Cdq6zJq7h5k9mDmldmHW6Q4xjGH2tC/Z5eZ8itB6VrMymRgfTmY8w/TasDL48Qe:wk6zJ2h5svldZ6QKtCxXitBurhagflLH
TLSH
T16CB423DF06CF00E41629A60BD123B5C6CAB060737C69B776CD5476943BABB863463DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockNew.xlsx

Path C:\Users\Admin\Desktop\LockNew.xlsx
Size 12KB
SHA256 3115e8a8ad6ea76d3c18331a09460f55a5ccaa239ac67b363dcbda8c9e727a77
MD5 b7d0473283ed99175b190c3f047baf35
SHA1 a1625da33682e1d0ee69b1d236436e8697adaf92
SHA512 519155ba3b0bc174205aa82d1753800f6d97a60123008580d58b05c9675d0286bafbf6336c196c2ff959a73ce968d8a1af7a83c0d2f4cbddd3c152cd6ad7e964
SSDEEP 192:wc8mVWK8Eb3UahxpX16oElaFUlbVvevUqzrXjJ+GGE8J97vZZRpUaoo:wc3AKN3teWUlM9zrMbP7hveaoo
TLSH
T103428EC5F001B725CE37447AE26E50F3F68960564E4BBA6A7C20F36A13811D329969EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewRemove.odt

Path C:\Users\Admin\Desktop\NewRemove.odt
Size 237KB
SHA256 8a1e73d553479e773488e371a66b25e8cea7742d434d6d88a1df080bfc60a542
MD5 bc275ca988d6b46572f7a2d2d0f951d0
SHA1 ab18cf3afa4421b0faada2b6ce8f23eb1c0cb29c
SHA512 bae5da589eeb636a064eab27ef8646145aba91818e061325352737e4d2c356815090d25676bb2f4e6c25f9bc9ac88e81a0874e3e74e1b09ed917e71f599e2e57
SSDEEP 6144:xxGXwzknu17g5jD8VOym3SFm5vxTeb4RM:x+wguUjwVONVXu
TLSH
T1DC3423F68D7280D690B656E3F69F810B4B122257874B50F06EF06C2CD36D76ABF69046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeTrace.docx

Path C:\Users\Admin\Desktop\OptimizeTrace.docx
Size 19KB
SHA256 1fa95694005df619f8bab522bfbb21951261915b80db6782bc48011fa78fc70e
MD5 d9890996d7afba765af77ecc650c8528
SHA1 dd2bff93d03ae3cc6c6233f9363cdf5d3dec158b
SHA512 2c015f92c7f999f90d8231e5ab6552bb2dff9779e9b2300c41db1428b5ac2c90ba534b12e27c232f785f9627335fe262725b57f3763e745deade674531975c62
SSDEEP 384:aLo555CC+PTG8keEvFsu0nKvdNxt/ZtNN8bIFHDx/IKBX:USNRSu00xllNoItNbx
TLSH
T16992E0B4D94274A1EE5A8A7CA46A20F5E61D420AB241FCC72168EFCF4772F17073A885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectSync.dotx

Path C:\Users\Admin\Desktop\ProtectSync.dotx
Size 679KB
SHA256 b6faa322f13aadc772d7a33e2c25d06564a1943da6be0ec7ab4079b4ea7aebf0
MD5 157309a31786bcd09c8b47cedfa28cc5
SHA1 a417e8024ee85cabd857c37586dd2e020becedd4
SHA512 12015487d54bf4e9e3a436741d7d91f977c5c04963f8ecb7a6764cf56e5aa21c931f5d498e9e1db54904f8aa3722be967787c7b7dcb7764fa3c307c3a0268142
SSDEEP 12288:7Aiqc+8fAdOOWLTU1t4DwjijL1tz7zQq0Adw8Cd1Ios/FMKCLES:7gdqXwwD7zlbdw4os/FMcS
TLSH
T155E42380DF16A07A4E7A85D4DAA6E133437D5D1B030C7E0263AD247799326E32FE1EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetRename.raw

Path C:\Users\Admin\Desktop\ResetRename.raw
Size 271KB
SHA256 284128a03d993286786bba2a9b68afed6cb556a10b81169ab9a46fb2b86c022f
MD5 1c1c9654733ad15c08e729aac044577f
SHA1 ace7778ff05539d476b5aec8b95efd96fd0fe6a8
SHA512 1d747e63e497199290efccd34c65f5d008472a562915400a54650af74273a7f01dda0a5cfab0086d11b9d0586d99a1fc0d9add57b0453c9cac9c5fb44bd2189b
SSDEEP 6144:1g8bV8KFiI1I4yyFgBE2MY6zsvAdCxJoslvhRUWU/EJar:1BSFIiUeBE2MoKCnoWhRUtx
TLSH
T1E64423B189D2E5CADF9CB9B2C14CD0AD3D180A1B9F18329D0F9E2460D158FF2D6B6D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetSet.html

Path C:\Users\Admin\Desktop\ResetSet.html
Size 577KB
SHA256 75312ae6bb700b1aed9183ecbaf041ffbf438e5f6c08ebb9d0ad5b6530c7a08c
MD5 8dc27799b2ea9589430e097e02aa2dfd
SHA1 7bd61257537736f72e0c70cee867c4664c07ffdb
SHA512 0447971773a9900960835e0754902dfcf1ac6eabf1da9aa49553442a1a9b2f4368aa4d8ff02c636cef4dfee0d817d0d7ce8b3298314f5f4eeab800d7c98af0c6
SSDEEP 12288:GhFlGmFCyQ/ID4x5YhY9b7Oz5eL5CXati3LsfE7jTH0ntYoVIdxfLooZ:GhFlGmLJ+ZOzta0S4EwooZ
TLSH
T196C42363A45A88B6CF5D210670E5FACC1A6A0F9D78477AEF5B0130F8D51B9E2E634CD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeMerge.emf

Path C:\Users\Admin\Desktop\ResizeMerge.emf
Size 475KB
SHA256 c7eca1ec4c88d7ad1cb9e926304c7aab313c9d365a1c7105fd521eee2dd1bdd2
MD5 ae7a5ee433bc95dcda59665394711195
SHA1 81c56aa5952d6e0a733382e5d0207dc6aeb076b9
SHA512 14a0579b0f055d529a578db6cb43140f0e37c07aa7038afd93cc9d22419a27a881a610364ba1a689d9aaf527622a070a75cf4d1a836d634a29197c79cf128498
SSDEEP 12288:DhlyrcmGxPzDTjC6GTNxysKeCFpFCr3Z3XhJqJeLPiM:9YrcmGx7/j4Dy3eCFC3ZnhJue2M
TLSH
T12EA423C0177FAB0816EE6D966301E442133BBCA8435E18DC03A9337F36993575F56AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchLimit.pptm

Path C:\Users\Admin\Desktop\SearchLimit.pptm
Size 594KB
SHA256 9fc43d0a6cac4f50134c17519549bae5d80df5a9a08d8df6776c53bb01f38cec
MD5 940a8ecbe457808b3616ec1ddaa9b52c
SHA1 ad4e8c4e658255015bcea42342426243f9740d43
SHA512 73dadc1cabe629dece42d3aecb25b9aa43da2a4f2a7308f53beed316a8228e824e177441fd2faca124b476276bd6a97975d2db369f8aaeeac79817c46b4cff68
SSDEEP 12288:5YiAFEtHFcXg64ZYn3FetqFqAwoVSCUrfa+xaieUwdb1U49:dJFcXV4an3FPHixd49
TLSH
T1C2D43340341FEF71653669FF2D39F2C13307DAC8ADEB543A85197A18AB450E4CE5B28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopUpdate.xlsx

Path C:\Users\Admin\Desktop\StopUpdate.xlsx
Size 662KB
SHA256 bfe6c1b0b9f0b15e57592b6521d823fb1c84fde5470a5c8585d990d2bfaf0488
MD5 1cf45fc842d97556ec840916f78c9d8f
SHA1 8ef047d55214a87d7b89156379a113abd2461da9
SHA512 5cd1354c7f02192ef6ffbc3811aa1e4a636516103ad52989d72e7ac372caa3799f4465855d731c2948a45a1e79983ff3a73607e60342f8b430bb90a481d313eb
SSDEEP 12288:C6a9qmrJIkHFdrLljGr6hagWGwCkBCRaSYsP25Znil0EEPfd4:LLLwdflir6hazYk//5Zs0EEPq
TLSH
T18CE423A0FE4BA5C61023448990D2F37754B45232CE6CD676C39EE76E7462B92039B4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitSkip.tmp

Path C:\Users\Admin\Desktop\SubmitSkip.tmp
Size 628KB
SHA256 82a93cc364fc641887486838b5d1de3f70a87b0250cb10ac358b5178ba0b3e1f
MD5 8dbc68c21bf8912044034ffe33a412e6
SHA1 94348829b2de708711ac0d97daf73b555109db9e
SHA512 59b4841e1099c4ed447469a5000a2bf0c2ff2e9e76f5609218775660464d675aa22e0572ec100f7a16439173f265dea05214044504d01ffdd62b974652b0845d
SSDEEP 12288:KWRhLf9WU91nWvfZPML6cUq+dDRIxMAZ5hW8cyar6ijMal1eXFP:lSU9AvfhMQduMGU83f8eVP
TLSH
T137D42365DBD099E6892327E00D67ABE1B077874CA314F02975498327F02BF895CDAC7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitUnprotect.htm

Path C:\Users\Admin\Desktop\SubmitUnprotect.htm
Size 543KB
SHA256 8fc503a1c1eb062d080eb5258e3974b4888d48ffde2412e87b62ce0279961553
MD5 48c6824032012aee496cbb84ad2e53a2
SHA1 474c93768dd807a8d54fde66d7cff69c92fd8612
SHA512 6fe24bfb8542f4dd32c369ab7e65ee74dbe27e562c09dcc820efd4206e240246fdf7874eec72d4ed5a03b07ff1d4872b0548f8c9ff9cb07ad3414826f25208d5
SSDEEP 12288:lzL/qmuCeKPtU8vMU/ul5lFjR1QPmEBEAQPbLYELCt:B/RuCeKVpD/ul5jfQeQErbsEGt
TLSH
T119C4236AEEF9360C4A2952FE184232A36E913F7F37D1B0D9C07D5B88C69185D49B3493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceCompare.jpeg

Path C:\Users\Admin\Desktop\TraceCompare.jpeg
Size 373KB
SHA256 3331db0c955840577c8e0aae0296cbc3f529126a6822bfb275487d2486e05b31
MD5 604d90a24fde20d51b1230e352b25b90
SHA1 152ceaef0229fc01eb9877d7b10c8f66900c3274
SHA512 d5e1f0e8b2f82ca958b3086ea7b818b6b4f15254aea478a962af8a9a86f21b4bd4af1d56d04dc0b16141a00ff80f6cd152059cb0dfdf479e1769e3582d3ea51a
SSDEEP 6144:Tjrm/bGEY4unC0HbjuQp4bBSTFgRuOKbQiqy/DYBOaCXfX3Ids3xvPs0W2CQEH8:Tvcqn4unXuQ2bI6YOKbQkaCXfnb3xvPN
TLSH
T1698423FD52E32E5AE8EF13A765A508B4E75173E27227EE2C4AF460A35CC53241416CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockPublish.mp3

Path C:\Users\Admin\Desktop\UnblockPublish.mp3
Size 560KB
SHA256 e267770ae14e52346b33c29cc42ec563b89293abd27c95246bef43f85d96674d
MD5 f2eee2870d48a9dfb1511fbd8329fc8a
SHA1 e5d812580fe900b877a79976a056131c06db29db
SHA512 d2e69bb6f30c919103591317ffa37998245b422b1667692fccc1442caa3db03b459e05b15a2946aa12ab1ab3ed093843384f9102226682693e45a3e95b37f315
SSDEEP 12288:KYegbm+yT+YGTqQsteTPfla3S7s0YwVCJbUelHMHiXGNst1P1jaZgk3J4vKZL:KmVG+YGTqiTPfA3S7s0yUEHT9tWKwJ4S
TLSH
T11BC423CD3393EAD69C01C20D6FA9B15695209898ECF5DF6BA105B0CB46AE18403F9DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchMerge.m3u

Path C:\Users\Admin\Desktop\WatchMerge.m3u
Size 288KB
SHA256 a9b3aa46cf4efba138adeb97891f2ba0b9b14f60c51605e1663668fd9a0653a1
MD5 4c3b0b87d09d0010545ef11e61f0c0be
SHA1 e94284a9221aa08ce0864814ca6e6ae4ef46752a
SHA512 900d529cc66c0b4f0d1f80e21976706c8f1018eb0588d52595339d80c8b226e2df5f70ab3e4ea8d0f2da371c977a33a6f8cb65ea36d38805adca03d1b18abfc8
SSDEEP 6144:0Az8zrdcS9HLmmp1wPV+rW4qr6l1yXFeNx+Asy4nebfo5OXTb8H:0Az8zrdcoMPV6qQmANhsy4neE5KTC
TLSH
T10854232B6B4F35746C7C3E5B18103DA10D430A027A02A1BAF9F222DD758DDE7F6A55B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 5b1bc9eaae5774d890a698df55a88ba74a1578ffa32896a40a63956cd04e1c49
MD5 1aa75b2665f626b58e02c886e3bc240d
SHA1 23da167533a5014ffcb648661f5d3fb423631ad9
SHA512 af41cefec18db61ca5643947ff08495bb322a6fa539ba4d405e711c49cb342e8008112e8f923ae6040c9fbe6bce85097dbd6323b52f92cda31dd0af2688afb4b
TLSH
T13F41AC504EF61B16E27399FB5BF10936DA21FC65A6018E1F4548434F09A1A00D8A8F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 a688909527f66e9ba1d910c40f9f88de806c8db7c0a3fddf6ab38cef13fbb1e3
MD5 4a2f4cd6b852970be75e463a08379b93
SHA1 989f4657af10ef5f7157119b53c6de462c794318
SHA512 aee9deece06974c76a552da01b142f2723ea30e1b136673eff827a4bb313ea379a6a364e9a5c2680f98e4db753b188a782a46863c2427fdab1a27b3c009d6fc0
TLSH
T15B115C000FF60969F1F781726B7127675377FC016A25531EC14D22955977120859DF93
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 8c88495948f271a83d83552b3cefffa20040ad1f2723cfd3325b654a14eda1e3
MD5 4a7871f6bc42bf8a694717b2f8f33a77
SHA1 a9e4fd47d14cedd4130113b2343afa730a7266cc
SHA512 7b9b275adf88f58922f0bd99a4505609c4acdcafd3c83d7df1c409d8bba18d770018cf3ae21577a1a61219c1140ccf3406adc1331d44a76a2f4e1f011ed482ab
TLSH
T125418A007BFA1B18F2E3867A9A333B710F7FF816D914461D5089924808A1A2059D8FB7
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 a478f0435ff520c41c7b771059953c617738828cd67fa7fd5b67f775d2ef7af0
MD5 3115daee8a16402c01591f77a2ade5eb
SHA1 530399cdeed5d70f2372f146b0cacaa6550cd30f
SHA512 36decb2988db639f358fff42e63bd2e5f123559ce4b2d4610ef497ba0fa723240942640c3b9aed650d9dd4c5c1e61d9b44ba29acd1e6b4492fd41f616c745d20
TLSH
T12011D54227B12B2BE3D385F20B2103F68B77F418C605670D8088115B9C34200D95EB9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-9-0x00007FFC0C700000-0x00007FFC0D0A4000-memory.dmp

Download

memory/4100-8-0x00007FFC0C700000-0x00007FFC0D0A4000-memory.dmp

Download

memory/4100-0-0x00007FFC0C88F000-0x00007FFC0C890000-memory.dmp

Download

memory/4100-4-0x0000000002AE0000-0x0000000002B3E000-memory.dmp

Download

memory/4100-3-0x00007FFC0C700000-0x00007FFC0D0A4000-memory.dmp

Download

memory/4100-2-0x00007FFC0C700000-0x00007FFC0D0A4000-memory.dmp

Download

memory/4100-1-0x0000000000330000-0x0000000000390000-memory.dmp

Download

memory/4100-17-0x00007FFC0C700000-0x00007FFC0D0A4000-memory.dmp

Download

memory/4684-6-0x0000000140000000-0x000000014001D000-memory.dmp

Download

memory/5652-5-0x0000000140000000-0x000000014002A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads