stihat | 31cd145a9e4871711a5832071d9c373c2a892131be7b9df6c8a6cba978370d78

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
Size 4.2MB
Sample260825-vhn4masyey
SHA256 31cd145a9e4871711a5832071d9c373c2a892131be7b9df6c8a6cba978370d78
MD5 26ce957b8ed59f9221c168cc2148b14c
SHA1 1c3dd1bbc6304cf3b81064740b84cdeaed4d9df0
SHA512 319f13326f036c50dd10c9f63b9c0814fd3f26a9f7f2bd88a2f5ccc17df66edc9e82ffd5376df45623c558ef604831e2c9de973bb4d18ae65f06a6e53ba3b42e
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6T:+nX
TLSH
T169169D42F7D4E476E0B606304D33D7748A76FC615A289B4F32987A0E2D713C2A936B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 9 IoCs

resource	yara_rule
behavioral2/memory/3124-0-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x000800000001b1d0-6.dat	family_stihat
behavioral2/memory/252-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/252-9-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-18.dat	family_stihat
behavioral2/files/0x000c00000001c64d-32.dat	family_stihat
behavioral2/memory/3124-43-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/252-45-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral2/memory/4264-58-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/3124-0-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001b1d0-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/252-7-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/252-9-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002f-18.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c64d-32.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3124-43-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/252-45-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4264-58-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
252	HelpMe.exe
4264	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\J:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\R:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\Z:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\K:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\Q:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\S:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\Y:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\D:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\V:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\X:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\P:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\I:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\L:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\M:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\N:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\G:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\H:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\T:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened for modification	C:\AUTORUN.INF	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe110000002480c9b0ad0fdd01d6182ab5b60fdd012b7529b7b60fdd0114000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2188	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 252	3124	2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_26ce957b8ed59f9221c168cc2148b14c_amadey_darkgate_dridex_elex_gcleaner_smoke-loader_surtr_vidar.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:252

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:1344

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4264

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.exe
Size 4.2MB
SHA256 9224304e86ffece69b6a18a05631dcbb668a02868ed11ceab76ff2e354fc9f60
MD5 936523d57b3e7ac99bbe4597b07abc03
SHA1 549731c8852d9ea37b230c978ef8839c35aa7b7c
SHA512 12f3e128ce41b6ac4f61569d3ebbe721cc51ca92f992effe9a66da49e98900a58889e193a6922f97d0639dc0e28376a5cbdc4556721e74446a59b73ac5430851
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM62:+nS
TLSH
T137169D42F7D4E476E0B606304D33D7748A76FC615A289B4F32987A0E2D713C2A936B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 239469568392a67226ea2cdf45a16a4fad558ee073d632eea3fe41b126bb3830
MD5 cda25b5175c19bd3f74654f5c798265c
SHA1 fbac9ff87e87cd3528811b81e5161d6eef6b177e
SHA512 40bbc5737d21a411007e2bd12d46da81f67b21fa82d092ae26c7f76ac971a576742a18a84efd8540f94da7e1c5476a4ed9c726c081690bc5adc36580f76f6741
TLSH
T16D31C91A5BDB1B62F2B6DA36D4F2A5499975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 33da299cd5fa6d1e07295df4b45ce7e0fe06ee8173d8d0f4b344f9c353232fef
MD5 7e07265d7f16b5018af901b07a0d612f
SHA1 c61852ee81bce66c3a92c269238e3b9ca7e6f83c
SHA512 1a1e2c43a30bf822cee271ef0ffe5b6a9ff37770305db81eff86c61e47df54c2fe297da38f7cff89450841b91286d83fbc24c5a2a56e386168f443e24686449d
TLSH
T17111EF152AD22B32D3B0063664A363178277BC02F8EC4F6E818A83802C0A101DE05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 670eced2e87e04997f524afeb4c0d19fc8db2bd8a58d45226ee54935858969d1
MD5 18ffb8286830c2cfe2f62c47de3ec669
SHA1 fb11fdedfe33880dee6b328beb4e9be59b42ee1a
SHA512 380bee5eb8f98d33d65888e86bd7707783c2ed80863403fd64b1c3c5fce496fd129559c913d0f7df46157142fe3bf991cb01bc1d1d91dfc8f699f7bd8679486a
TLSH
T10511AF152AD22B36D3B1563664A767178277BC02F8FD4F6E818A83812C45141DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ab25f41bb8ff0464d3926da71403ba2527c48ec3a03b24e7fa5d9cd32d8c2aa8
MD5 9cc103682d4026db1782da2d1b9c038d
SHA1 e1711807d2a81d88dc262f36af80470c61d1f54b
SHA512 4c9d7fd172ec0cdd4fb661046ab18cbc08e5f2d42e65226f3a23241a102380a4e567db248dbeca2ba78f6f70819d2f7cf8441b25eb60d9502842ad0f9a33def6
TLSH
T1E431C91A5BDB1B62F2B6DA36D4F295499975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fe035b16a756445dc260c9b03800d3d51ebcb819f469190219e5cd4c4ef4e389
MD5 6163c043601d3cf521a8f5e07f798065
SHA1 15efba54be423a9ddbbdf6c4fbea705c81f349a7
SHA512 a4fba1e4a6ade1b52f9207bd798ca980830d31a913d3e4c0600dea833b5f29bdd6f02dec99035e1456963a57d055be5a401d7fb2ae66e06bdd48c4f6747c339d
TLSH
T14411EF152AE22B32D3B0063664A763178277BC02F8EC4F6E818A83802C49101DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c8d75b489a824ceec6d7be33b1cf158016fb733bc9574038f785c1b35972dd6f
MD5 e19ad57025022db2c50ef8ccccb1948c
SHA1 86616ab826e4b3c82bae7514e90addb1d359e068
SHA512 96a9a149ff3d90b42e302a4ef802544c3ac45c7650e633c571b2cc96abefece17dcb5b0173183c2143ef0cbcd3f74ba68bcdb1b4ad9cb959e8e406e211e98efe
TLSH
T1F611AB192AE22B37D3F1463664A767178277BD02F8FD4F6E818A83816C4A241DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f8a427ba43298bf1ccf0d65b09ef74446e4f9ec580e6d3a5f76f9bfd97fff402
MD5 f48bf6eafb6fe47668da0fd79ab404b2
SHA1 2b89a3383cb298d40d94775e917732d1855d4857
SHA512 7578d9c24c046f5d5d64e1c90a34341db843fac05e6af92aab7840c5fca66a0eb82349dc7338009231c7cd2f1a1ba05ac59440544b7419cf2cc7bd6732296667
TLSH
T16831C91A5BDB2B62F2B6DA36D5F295599975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d12564f5f783917b1eee65404c022f49a66dc2839737bda6546f29daca0cbf73
MD5 e9eb81b9329e0705992f32968ba48f33
SHA1 3ab2a1b61fc7e37bb1e809ffecb2a2271b95449c
SHA512 d3567a4228e45f2fc17a3cbbe6aaaf611db3e3f5ffe96574d3d2cddf591eef3df7f56035de9f3cc4d742a97eb4f40623887aab1fa3f1fa9ee8b0b6c1be9549c1
TLSH
T1C311EF152AD62B33D3B0063A64A363178273BC02F8EC4F6E818A83802C05141DD05F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cf25e19d65b2af1aead6372892d51a2a7ca1d8f4df5bf811f86d5f7ed20a0a15
MD5 515b5a16b0ffc7baa01e758e3e71626f
SHA1 a43575bfa4b8a13a5bf034f5c892f61b2e3aa825
SHA512 f282fff9c809e5cb1ae15cb9fd170d219c4294fa5ca5c825b9f4090b7695e31caa246968678485895412f0d375b80df28904b4d8ce18863f88efd3f1359a148e
TLSH
T1D131D70A5BDB1A62F2B6DA3694F294499975BCD0BA05FB0D00C0824C1C32B82EE01F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 414fa27c9e21b03138e58853679f75082b7e05bcad4a9f327c0c8112e7317dc8
MD5 4d18a5a7df208f491ee950daaf37adb2
SHA1 9d6aefe70a757b975fa57247a47568733630fbba
SHA512 a83ef560c720022238781a4e441e21f7fc5faa7c5073db0f1da7e95f00ac62ae8daa314c06039b46f0702b2b371a9d2e29ed41c4a51c8c25fbb49f712d37167b
TLSH
T13D11AF152AD22B36D3B1463664A767178277BC02F8ED4F6E818A83816C49141DD15E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a398a7e31fd6a7cc3a0c868720cb270a17d8149dcf8c1eee8b4bcf577c8a29f5
MD5 4503e31dac315039124c7e001394b80b
SHA1 5f7a3beac33eb5fb7aa5e5e5916790a4648164de
SHA512 ef58ae9b775ecf84aea65da2164d83196e218357e74d19926fc43980b60a46aa3796583d05b3dcdb9d990c886b9fe9fd10fc2b5eb7ac92f69ee48e2c6c8f3668
TLSH
T1BE11AF152AD22B36D3B1463664A767178277BC02F8FD8F6E818A83812C45141DD05F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6876b62f73b0dcf4a65d28f6e2523dbdbf49a487b2d616d3b8c30c7a2de49179
MD5 7afa12c49d45fddbbca6d4a9b5d4e32b
SHA1 3453287ed169e2bae31da594f513fc9970fd9b58
SHA512 c9af55f8b5941af18569d3dd61f384230e406f4d2786f25e1f76e2a3d22d6b9d0feeef9086162927b11395245b866cd5dae1e661de86ca1f5c269599c887eca9
TLSH
T1D631C91A5BDB1B62F2B6DA36D4F295499975BCD0BA15FB0D01C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 69142e4e0b91f31eecf5f6ad22c38bfaaa64b665b74b87d15fda33c6564b51e9
MD5 4c0ce00a24ba0040736d3c35d0db8353
SHA1 bdc02a996edff7464f535a24de003f195cf5e86c
SHA512 3d45af065db94db011d867cec8c3c83ca66b658e5dae0a22da7270d97f0d3b6114dd00f27809980811aa2c5f2379e5ea30fb8916d5a676b834bf6a0ffeda4c8f
TLSH
T19411EB192AE22B33D3F0063664A763178273BC02F8EC4F6E818A83C02C0A201DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1b6b94099e52e9c1bccf327f47ac855e0eeb5a55b18df093b6e1aed3323de2b0
MD5 db54d7453669d42b471075952a19ec48
SHA1 97db72ac9182c37533e000323f82894c7c4298ad
SHA512 4c556e449c417650a49f622dd4ef7d5ede395dbfda2d31f85027716b43b6d98064ff68b4dd7d570808ded2900f4ffcebe96754b752ffddcdca9cbaec65d6b6f9
TLSH
T12931C91A5BDB2B62F2B6DA36D4F295499975BCD0BA15FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9f9910ba1f6a7bd83de91e43fcf54575d037d911cbc0620053229cbb17119516
MD5 8a6dc18078ee78b85ebcc332f262d668
SHA1 99cd87e0707a4d21a8e0180e3a81896cb31d2750
SHA512 99050fc3562cc6f57a047c029076dd41d668331acb34579656005e52f7523891169a8d85e09a2e5b13c11b84068a7a2206a0816b6fd3b33687dcb212cd80f6ca
TLSH
T1A011EF152AD22B32D3B0063664A363178273BC02F8EC4FAE818A83802C05101DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d11b732ef7b9685d67840bc19e936d71dacb8e64ab0ce7309db51e6f50b57dcb
MD5 c947120affb3bc6c1519e687c14aa998
SHA1 7e3d5c0338c065ac0b3d61f34d2b44d7f84ec5f2
SHA512 0422a423ffb5529b252d6b59103b1aa68031af73809dde6316e2066f1cec49905f5bd8a612dcb8c82176c31c903db92d5d31147b15f0b5ba976b95cc62a02f4a
TLSH
T14211AB192AE22B36D3B1563664A767178277BC02F8ED4F6E818A83812C4A251DD05F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cad7a979bf52728d60470db90b79c7147b681cf68ed9aaab72db18240c2fbc7d
MD5 e321d7b537dc850efcb28ea0bc549612
SHA1 a2faecc39f19c1a861e5d26861faf9fd73b44014
SHA512 e51e8108c7882a26fd5f9b44f2212b22898e18bf8c12c71b5cb8b6bb138d64488f6ac533bc3d298706af4299b8728a6fb8c23f61e464f004ffd2d08f7ecb3f7d
TLSH
T11E31B71A5BDB1A62F2B6DA3694F295599975BCD0BA05FB0D01C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 db80c6376610fcda400262ee2cd64ab0f8d5a2683139dac9077bf342fdf716c2
MD5 2ccaaebb0ac9523c2366680c3ce0d0c6
SHA1 9d7ba656417abe2a1dc14fd881bd3bf60c4b5f45
SHA512 8b0a52446745f2df6355b1756b7fe29a396009f916ae25337fd7ec9089120e3b440f89dea4e123b0319983904ebf7d398be697d5829b0f8f93af3ba4f483f220
TLSH
T13911EB192AE22B36D3F0063664A363178273BC02F8ED4F6E818A83802C0A201DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e3f54f464b80a2ae6832e7b4c406b226828b28692ea99f33af1bb4c4d056d590
MD5 908682312201b679ed817a7b9d38a5ed
SHA1 0916ac991cf84b4cd17e29ab8734bea1abc38836
SHA512 48a50ea458cbd1e486c51723e69362b11c29115415e0507c61f58c48719a04eaae31de6e5076ed15a8774dc03b892533e85d3a8fe3702b4517380dff99c4cd0b
TLSH
T1B111AF152AD62B36D3B1463664A767178277BC02F8ED4F6E818A83812C45141DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8a2337734df39a35a3f533c61d7043680b8cf0f25a678dc73e8840668591c09f
MD5 3c8f0198ec33671937362e5860c7417a
SHA1 a7d4d17ac75e740de1de61766e084fdc29c87d94
SHA512 5e8e4344d1f8dbb6200482ed2af512cf2d0ca0afea75c93290602d0b724b17157ab096e67232c3540f7b3ef4091e61251d6646bc9698db7fa5a59811b93b0350
TLSH
T16A11EB192AE22B32D3B1063664A363178273BC02F8ED4F6E818A83802C0A241DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 72066f914c2def6ba1f917bf2f2a1dd476bf306f5df5e54322b0164f39abfd8b
MD5 16caf00b01ab3bf35bef4f7c311b2c41
SHA1 aaa7a574abd4d3be43e8d6ffcde9e30cea7b7435
SHA512 80ce708ac92a551727fb17e8bb35c916743167e38663403ed05b02a7d29ce19bc51657e3c47136913261e7b273b14c474e0c703c8c944aeddb8f56064d03301e
TLSH
T16211AF152AD22B36D3B1463664E767178677BC02F9ED4F6E818A83812C46141DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c470d683e038a54c409be9b786e7e944827d16bcad29fb124a5f03bd569cf78f
MD5 c1c877795270cb681cf1d5f5bdcfa0fb
SHA1 e53043a06db3d2f9855cf16ae842a69e21d79bee
SHA512 f94fceaeae9510df923f2afac0145c3a4b16ff859bbf8ac4afcd7f50c8b2efd98ba52fa88e66a9aa1c42c6e6424a7129f5f0639db5be4cf147804f03717936ac
TLSH
T12B31C91A5BDB1B62F2B6DA36D4F2954A9975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8a0e81520f52c5af889a5586625ade97f193db9dbfecd6e20fe747645153f022
MD5 c3c2f4a771120b759e757bad87a6cc4f
SHA1 3d1b4eec11ad0e74c547a3537ecfccaca5f83392
SHA512 5c0415a52db0415a00197fe83139d33defb590d0a68007d87b1103cb86d5efc2f04f11708c1ff67f3829dc04ec819711e940f394d696fd7051b276ed0a6f1ce5
TLSH
T14611EF152AD22B32D3B0063A64A763178273BC02F8EC4F6E818A83802C05101DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 664a3d3e604de4feb18e41794ce6cc6af3ec8c4725565ab81c7dcf5bfb84a23f
MD5 956fcc3d213b08335803856ca9fc321b
SHA1 b835904b9358f86d798fc192bda1ee03e69c342a
SHA512 51f6beecd807b50cbfc8fd1208886e8f33bf386c65d1652a593bbfbf3c520ffc8afe6de802f87617061654286441caba7726c090ca89b7f7e578cc86aeb4d7b9
TLSH
T17731C91A5BDB1B62F2B6DA36D4F295499975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f97d6051c46661e9ccf62da470b5e55fae72a2782965f89e8f6881f15343673e
MD5 870c81be1a382db3071f791dd6fa0754
SHA1 5b24ba9cb929d87eef1014223f93db92aae5e0c3
SHA512 07ceca8e7d995d14b7ab60d6f17fe6172ff510b7f40d2c3e39f61f3d9b07787bcfbd3f2912eb3c26cc052155ceaa86c3fd5c13e01845a877db1f1066d9429212
TLSH
T1F011AB192AE22B36D3B1463664A767178277BD02F8ED4F6E818A87812C4A241DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f95fdd5f30919db1a49b97599171ef782fdc01b90f9435e93e84bc14eb348a24
MD5 5dcb21899554fd7edf7658f7ea7610d1
SHA1 604695a9c4024ad71c6726303758df219f8105d1
SHA512 19582e8e3242e893e2a4c386b22938296418218540cefe3dc85f1553bcebd14e3d39c295a0c0ce6e0097c70e01cfe64be68b442c87fb2dd20f885dccf6adbe01
TLSH
T10D31CB0A5BDB2B62F2B6DA3695F2A5599975BCD0FA05FB0D01C4824C1C32B92ED41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4a3ad88917fbb7b9bcedbbb4c704c2497c2173d8874a569a60af19549a349242
MD5 33cc2dd62524397a709f5383f4825144
SHA1 bab043ab4ba17db30eea27bac95dee45ec657367
SHA512 cebc8156e2db2ed3ec9280905a14d16e35d5e915a5378365f70d1490cfd251405c12178723f268f91357330e3b062bb813a1913517543f8608c548128f8828b0
TLSH
T12C31C91A5BDB1B62F2B6DA36D4F295899975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 20c6691bc533acbe2ed9e03252b30c6f8551899df977a8573f7edd5b15f66bcd
MD5 ecb77b445f52219f8e4b74e2c3637e61
SHA1 a092988e516533b977ee92e1659a966b25716b38
SHA512 f516735c886ba88a67b5d337959b6f142a853021a5895c0b8ca61b9b1e99027832995faccb1ca0d589f74675289cfd6b1e85fecd0becf09fe4e6c14cb9235dee
TLSH
T1FC11AF152AD22B36D3B1463664A767178677BC02F8ED4F6E818A83812C49141DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 165aa2e94239742528233d6eb7e2ebc60abdecd74b2bdb77c568eacb36f43ac4
MD5 dd30fd02368e443c230ce78c403139f8
SHA1 9bca34bf54af2f7f76231bf4008b0bab2956c5ad
SHA512 bb048931b86f09431a2e29c242c7636d7665c782b3889f67f9c3ca50ab46fb376baa3774c37119053481260a4909397b556baf3833b9e35aa72ca4d265cfa361
TLSH
T1AB31F90A5BDB1B62F2B6DA36D4F294499935BCD0BA05FB0D00C4824C1C32B92EE01F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8c1c744b5af11d53cda6b1c0b52ffa2afed663fcfff81682242ea0cc1a849dc7
MD5 c91362fbf6c6fd8473d343dcbf4d5033
SHA1 9b7d6e6aa35347112939f5ca6a08de39ba2456fb
SHA512 d51ea7ecc724e9bb40c5675fd5d3a2d9f3d4ddd493d2032c0993f17721531c8faea69c5257794facc4d7803a07cffd599beca439a0e1722559f33c12f072b352
TLSH
T14C11AF152AD22B36D3B1463664A767178277BC02F8ED4F6E818A83812C45141DD15E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c571e32c1555e30615f618655196d5e98fb18251625b9fe55cfd32a897aa664e
MD5 eca54274e8dfa6ea9d1e430abbd230a9
SHA1 8aca6c87d5f17659f05e438a242c7ff67e5200a6
SHA512 a3f5e69ea5e3839d35a0b2a2fbe90b8c6862c553ed978b054160ed84e9d50073981e79af25392419b8b8954a4b8f708fe75e381dc481c7330e52e3ae738ad589
TLSH
T12311EF152AE22B32D3B0063664A363178273BC02F8EC4F6E818A83802C46101DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d3d91b7b41fc46ea7726fbee9515439ec575bfa7f82ddc145af429a878ca5590
MD5 1703dc8188e107ad7800cfd9e260ba28
SHA1 a3a4847f916604bf5b8c1023ec9eb9955bf849e8
SHA512 61cd3bd216a5730872952a33eb02553602dc2a3d65fea453cbb95ebb0e36e78e020d4c0c6a75205fd07d36bb7aac6a95dddaba91e0f42163c311152cfc14256e
TLSH
T14F31C91A5BDB2B62F2B6DA76D4F295499975BCD1BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c46a37ca5ab0abf50e4b91f62b75d1456e0b816c07fbca249c14367aabdc7679
MD5 13771974a9316a759804b4b95b095474
SHA1 6dad46215d076e70618a95b2c47285b7a6572e86
SHA512 145f4a848cb2849620e7e984677d42fe78fedf902b15d7a204e27cb8ba953c43b5f4f5814f8fce462c4abfa0c2803348c0f7bffd37142ba966698092899814b8
TLSH
T16311AF152AD22B36D3B1563664E767178277BC02F8FD4F6E819A83812C45141DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e0cfb8d7bb85de7a82a45fc034262fcc9be91b6930a8b36f89ce5aa3ae22b40d
MD5 b5e94fdf3b3c38fca02e7fa440abea9b
SHA1 bba5278a49da424da54ce6b1f6b32fb421023bb9
SHA512 b8cbd4ff648de579c5d7480ab64045394610f4aca69530412bf44b1a4ae9181b94985968c219c00dbcc0821825102e0929185a4d7f73eb819c0e094ca491dc40
TLSH
T1B031C91A5BDB1B62F2B6DA36D4F295499975BCD0BA06FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b33b75810012ff22edbdf15a4237ee438ddda07f364174e7bebe2760f9e56685
MD5 69509f408988ce7e56ec803007572e47
SHA1 916afeaebab1d8c85545dd28a96fc71019164d39
SHA512 cfb5f51d5d54cc3333745c72bd8d301b1b4d9e0a313f82b6b4491331e47170df0c06c6d04ec04dc7015b43bd5d5f146ba7dd80b47085e16a1caf79e4f778261f
TLSH
T15C11EB192AE22B32D3F0063664A363178273BC02F8FC4F6E818A83C02C0A201DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 225895f74006db70b0369087469ba3452ad0684ab49c6b7bb2688061b8e63097
MD5 76fbfac6b431ca82d1f6d9f90c8882c1
SHA1 88603c830841a8e543311acd4d59180e1b63800a
SHA512 b11fc0ea7999c897a518edb62a196f7c9a1a1c56ab4401599679c692c75420f26cc40131c4a74fb3996fbbeefecbba6a5b495dec3f2e2d0ec10a73fec4c6ee59
TLSH
T1EF31B71A5BDB1A62F2B6DA3694F295499975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 48290266c67899b43dbfa2fb338b161fa113e0d5807060a167ce9afcaab838ec
MD5 8471d92b952b95151c8382d4e02b1531
SHA1 6e8145ae673869a98fed4ac0f64ecdbe2d6526bc
SHA512 823035c7dc9376e640c1974467568cedc89a65f35219f6bb1252f8946ca690d1125b665947fd7491f4bd03dc399edce820ca3e078fd3901fc939087653d96c83
TLSH
T1B111AF192AE22B36D3F1463664A767178677BC02F8ED4F6E818A83812C45241DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 cf0b5a73da0fef1f6f2cdc0a0c1e7e3813f598970d726c781179ccea33fe5891
MD5 f31575d6ce6874d77b71be0041bb73fc
SHA1 aa9bb1278149d46b5356293fcacdfd2338a3e554
SHA512 0a9c8b556ec223ddfb0419b1063f32fce0fdbeb0d248569cd754deaed28a45a26740ee145681e59659410b44b2f64f78502c62771e137d78cdb82b61d2fa2d26
TLSH
T1AF11EF152AD22B32D3B0463664A373178273BC02F8EC4F6E818A83802C05141DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b47f84bea14db42150a48c4017869f447f887ce4b2a83466d1a27b0df6c636f2
MD5 f8c5bccfc85b7f27787bcab706c0ab03
SHA1 d6941983134b6f346a8101325fdb494d73628e86
SHA512 c9df74ec05982505e3e53bdd3ad93e405a93ff587a04d63e66037d60120d8011a8af24c4ac7da5692854ebdb8e1b848813aec2c11c021691ff82aa267deaadcb
TLSH
T10331C91A5BDB1B62F2B6DA36D4F295599975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 5d6c86ead07591b7c85426b29d0b093d244c0fdaf5d55eb178c971301aa98c63
MD5 610b7b3485c0ebead3b3527c8d5c66a2
SHA1 5d1cda717689ddaba59f5e16ceb9909eea66f601
SHA512 45596435e1ea6c818a11578e71da4e58aeed8c7a59a9e500c1c405eaa7efcc1e3162849652ee06598eb8a22540fffa7c57ef5a62689a1862c1f618a06d75cb8a
TLSH
T14C11AF152AD22B37D3B1463664A767178677BC02F8ED4F6E818A83812C45241DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1370a27f2668eb927b4e1d46b4480ae900cfd1599e1a8c2e9f31ad9bc5fe50f9
MD5 9077aafaa037a2df73170e251f24f0f3
SHA1 86d8e0ec73a460155a656af4f42efcca8397610e
SHA512 c23bec7bacbbdc52f5e606ff951643a4ea09742a2d3b5206bc98f9c08ae257b12d57e45533d539af32babf05f2f877daf83a2f2511e38231c7bc4a84a606d69e
TLSH
T1EA11AF152AE62B36D3B1463664A777179277BC02F8ED4F6E818A83812C49142DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 501e6871e9f4affba8fe482a6d7dbc6b9fbdb2e9b5b1ff2c6233631c0b300eb8
MD5 36d114fe672f1577551d053bfc876dea
SHA1 43f44622d50d875f818302a8aa65a9a61f160942
SHA512 4dd6306e1450ea4fd1236b61b4aeb195dd05c8b537906b19093424bf05aea96ef99e9520f5094c9d2de3aa7b4dec0fd571bea6ace5744e0f0c978abba5689c47
TLSH
T1B631C91A5BDB1B62F2B6DA36D4F295499975BCD0BA09FB0D00C4824C1C32B92EE45F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b1e726e3de63ada13c748e8a1c4d20ae59c21a67fde798b104dedf7613e806ba
MD5 4804c4e02a165741ee4c95775de410ad
SHA1 c105d712895083a332fe3f286a66f6bbaf71ce51
SHA512 405f592639ca1408b6d8cb338b41d6156be6491df473fe2b9a7002decb3faf96eaa899091cbe79782e09e8008fff2ef9017d5d936c960f9813cc8f0e2cd38e5d
TLSH
T15111EF152AD22B32D3B0063664A363179677BC02F8EC4F6E818A83802C05101DD15E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b6e620b95e94a8a8ba0bd46de78bcb0c9d42bb23c697bcdc6aefd3e6375b4251
MD5 89709218a30d3afb2036da5d57c3458d
SHA1 1cca26bea6d34e7cfa187f8e71c0d0a6424dfb2b
SHA512 bba5fac97d8e1fa1d94a3213265c06f14e20652d29d7b60207e6b91e1d26dd45d0268381ffbc35c39dbaa47b3fea7f22cb4c7fc69e75d41cbad82275e358cdd3
TLSH
T18731C91A5BDB1B62F2B6DA36D4F295499975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2740b43739f53b13b5755d4ec5cb6586b48e539b0b90b4945af185bd45b3fd2c
MD5 0bd2a80933a4b7e75d685d8881eb71fa
SHA1 1a491bb6acdc589ee9b714bb8e555cc141278b46
SHA512 06b390fdfdb4c5416b41666f1058c893d35a2204dd721a59eb1cff7fe0e76583c8170a0ec9e6681e158062e192c98160cf10cc85551648ba73faa70a71ce09aa
TLSH
T10411EB192AE22B32D3F0463664E373178277BC02F9ED4F6E818A83812C0A201DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b9a15ee8355914255a8825d768419bc440ca1164bf53cadd4115e001ea4c0e24
MD5 1e2881c6cdc2924f11f654e5cb88f04b
SHA1 9b90ef267ff13015e41fa0f8089cf617226a2a98
SHA512 58705ac92f9775f246c3b3f8f952d474df2b736fa1dc22f8660a5ad9e62225586352d24a1ebe57217457517fde250b9ab893868c48b041aa44b06e20e8fce0c3
TLSH
T16631C91A5BDB1B62F2B6DA36D4F295499975BCD0BA05FB0D00C4824C1C32B92EE41F0F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c0b7c6a1d37dd02771fb6427eeaae5b975c11f10dd1de06eca2d0b98d8d6a296
MD5 b88e8fdb113a3a9d1e7492a5feca9aba
SHA1 3a21e914222d52d5ad84f2cbce4ee80284e6fe0c
SHA512 79e6c9a4dd02344677ce5defd82ab47c34ddd2b0c646e9fe6a6ba26e9def35a0067dfe780c8ba5d9e0bcdf7b7a3803665ab595ecefecde6e6b6531d07c1ca03b
TLSH
T1A311EF152AD22B32D3B04A3664A363178273BC02F8EC4F6E818A83802C05101DD05E6F
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.4MB
SHA256 842be7e3b0e3f1cf6f14b4328daf93ec74cc641dc97e308a08c91549cd909880
MD5 708857c9059fb73006d77173c3f899eb
SHA1 a0bf36eaf88a0c356ce33f203f7b3e612363aaea
SHA512 9383a7aa4a9440fb58f839160e9abbd45f2e81cacdf62fc783f055fffddfde7b1cd45510101236a50e583f0cbd260b82354a4ed6774d255d4e267ec17e7611cd
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM65:+n9
TLSH
T1E8F5AE02F7D4E872E0B601344D33D7748A7AFC615A189B4F32987A0E6D717C2A936B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini
Size 4.2MB
SHA256 f91ca417a86267e3dbb569df0bb56d69cc8559fbcec7e9e19439ebc1b6fc508e
MD5 5b1c1cfc912217ad2c642a9c50047f8d
SHA1 d11f195e607c1ce95b1e7bdcf647357a608553e6
SHA512 0337e0adb0ecd7b945604f82aaf7aa422fe3bf8136111bfea2552fce8b67288d738065f69d16ab69bfdf4299f700f04da03ad1c765063d6f8d1bbe65512a5bec
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6B:+n1
TLSH
T1A8169D42F7D4E476E0B606304D33D7748A76FC615A289B4F32987A0E2D713C2A936B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-45-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/252-9-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/252-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3124-44-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3124-43-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3124-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3124-1-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3124-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/4264-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads