d3e95a06d3b586dc757fd613e07048f429668c3d29769e62acc1d7d1b9fb99d2

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
Size 18.3MB
Sample260827-lrbefssepe
SHA256 d3e95a06d3b586dc757fd613e07048f429668c3d29769e62acc1d7d1b9fb99d2
MD5 ba572296d042e9342494032337bb9bbd
SHA1 907c15ad408d83367f0b3983796aab1684563128
SHA512 79c90de9d185a5b8cff7af10acfb159f2ef479f173d555f58701646f60f43d4af07fea4947e3092703ee5ee1e1442b6e4e388db7aa50de1410e09415fc5f579e
SSDEEP 98304:UC+joaAr6a/m2LK7VWYyVxlGRx5hjRKVvz+KDFf356qbtJ/eFbqaJXM/6T7Xcd:bjlGLRYFpgrJXM/
TLSH
T1E7172922BB5A59ECC49AC474834646726A3134DF0B35BAFF44C496383F69AF52E3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	908	yzxrt-agent.exe

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 9 IoCs

pid	Process
908	yzxrt-agent.exe
1648	yzxrt-agent.exe
5436	yzxrt-agent.exe
3264	yzxrt-agent.exe
4200	yzxrt-agent.exe
4552	yzxrt-agent.exe
1292	yzxrt-agent.exe
2056	yzxrt-agent.exe
4836	yzxrt-agent.exe

Impair Defenses: Safe Mode Boot 1 TTPs 10 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent\ = "Service"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent\ = "Service"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent\ = "Service"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent\ = "Service"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent\ = "Service"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\YZXRTAgent	reg.exe

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4872	icacls.exe
4428	icacls.exe
2780	icacls.exe
2764	icacls.exe
1992	icacls.exe
1328	icacls.exe
5392	icacls.exe
5264	icacls.exe
2304	icacls.exe
1296	icacls.exe
5020	icacls.exe
4972	icacls.exe
1800	icacls.exe
3292	icacls.exe
6016	icacls.exe
4644	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\YZXRT\yzxrt-agent.exe.new	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\apply_update.ps1	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\config.json	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\YZXRT\yzxrt-agent.exe	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\yzxrt-agent.exe.old	powershell.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\config.json	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe
File opened for modification	C:\Program Files\YZXRT\agent_service.log	yzxrt-agent.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fvxz2o4a.ohi.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rwxpzex3.tnb.psm1	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5636	sc.exe
1628	sc.exe
2852	sc.exe
5996	sc.exe
1496	sc.exe
5308	sc.exe
3612	sc.exe
5160	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5924	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
5128	reg.exe
1940	reg.exe
2124	reg.exe
3108	reg.exe
4544	reg.exe
3512	reg.exe
4752	reg.exe
4968	reg.exe
3540	reg.exe
2548	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
908	yzxrt-agent.exe
908	yzxrt-agent.exe
908	yzxrt-agent.exe
908	yzxrt-agent.exe
908	yzxrt-agent.exe
908	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5924	taskkill.exe
Token: SeDebugPrivilege	2736	powershell.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
908	yzxrt-agent.exe
1648	yzxrt-agent.exe
1648	yzxrt-agent.exe
5436	yzxrt-agent.exe
5436	yzxrt-agent.exe
3264	yzxrt-agent.exe
4552	yzxrt-agent.exe
2056	yzxrt-agent.exe
4836	yzxrt-agent.exe
4836	yzxrt-agent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5160	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	89
PID 4636 wrote to memory of 4116	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	91
PID 4116 wrote to memory of 4880	4116	net.exe	93
PID 4636 wrote to memory of 5636	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	94
PID 4636 wrote to memory of 5924	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	96
PID 4636 wrote to memory of 2764	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	99
PID 4636 wrote to memory of 1992	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	101
PID 4636 wrote to memory of 4872	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	103
PID 4636 wrote to memory of 1328	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	105
PID 4636 wrote to memory of 2304	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	107
PID 4636 wrote to memory of 1296	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	109
PID 4636 wrote to memory of 4600	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	111
PID 4636 wrote to memory of 1800	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	113
PID 4636 wrote to memory of 1628	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	115
PID 4636 wrote to memory of 2852	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	117
PID 4636 wrote to memory of 5996	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	119
PID 4636 wrote to memory of 5128	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	121
PID 4636 wrote to memory of 1940	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	123
PID 4636 wrote to memory of 4180	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	125
PID 4180 wrote to memory of 5336	4180	net.exe	127
PID 908 wrote to memory of 3512	908	yzxrt-agent.exe	130
PID 908 wrote to memory of 2124	908	yzxrt-agent.exe	132
PID 908 wrote to memory of 3740	908	yzxrt-agent.exe	134
PID 908 wrote to memory of 5376	908	yzxrt-agent.exe	136
PID 908 wrote to memory of 5020	908	yzxrt-agent.exe	138
PID 908 wrote to memory of 1648	908	yzxrt-agent.exe	140
PID 1648 wrote to memory of 2836	1648	yzxrt-agent.exe	141
PID 1648 wrote to memory of 3524	1648	yzxrt-agent.exe	143
PID 1648 wrote to memory of 5392	1648	yzxrt-agent.exe	145
PID 4636 wrote to memory of 1496	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	147
PID 4636 wrote to memory of 5436	4636	2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	149
PID 5436 wrote to memory of 3248	5436	yzxrt-agent.exe	150
PID 5436 wrote to memory of 4612	5436	yzxrt-agent.exe	152
PID 5436 wrote to memory of 3292	5436	yzxrt-agent.exe	154
PID 1648 wrote to memory of 4296	1648	yzxrt-agent.exe	156
PID 5436 wrote to memory of 2780	5436	yzxrt-agent.exe	158
PID 908 wrote to memory of 2736	908	yzxrt-agent.exe	161
PID 2736 wrote to memory of 5308	2736	powershell.exe	163
PID 3264 wrote to memory of 4752	3264	yzxrt-agent.exe	165
PID 3264 wrote to memory of 4968	3264	yzxrt-agent.exe	167
PID 3264 wrote to memory of 4648	3264	yzxrt-agent.exe	169
PID 3264 wrote to memory of 5056	3264	yzxrt-agent.exe	171
PID 3264 wrote to memory of 6016	3264	yzxrt-agent.exe	173
PID 3264 wrote to memory of 4200	3264	yzxrt-agent.exe	175
PID 4552 wrote to memory of 3540	4552	yzxrt-agent.exe	177
PID 4552 wrote to memory of 3108	4552	yzxrt-agent.exe	179
PID 4552 wrote to memory of 6088	4552	yzxrt-agent.exe	181
PID 4552 wrote to memory of 4976	4552	yzxrt-agent.exe	183
PID 4552 wrote to memory of 4428	4552	yzxrt-agent.exe	185
PID 4552 wrote to memory of 1292	4552	yzxrt-agent.exe	187
PID 2736 wrote to memory of 3612	2736	powershell.exe	188
PID 2056 wrote to memory of 2548	2056	yzxrt-agent.exe	190
PID 2056 wrote to memory of 4544	2056	yzxrt-agent.exe	192
PID 2056 wrote to memory of 928	2056	yzxrt-agent.exe	194
PID 2056 wrote to memory of 4764	2056	yzxrt-agent.exe	196
PID 2056 wrote to memory of 4972	2056	yzxrt-agent.exe	198
PID 2056 wrote to memory of 2780	2056	yzxrt-agent.exe	200
PID 2056 wrote to memory of 4836	2056	yzxrt-agent.exe	202
PID 4836 wrote to memory of 872	4836	yzxrt-agent.exe	203
PID 4836 wrote to memory of 1456	4836	yzxrt-agent.exe	205
PID 4836 wrote to memory of 5264	4836	yzxrt-agent.exe	207
PID 4836 wrote to memory of 4644	4836	yzxrt-agent.exe	209
PID 4836 wrote to memory of 2424	4836	yzxrt-agent.exe	211
PID 4836 wrote to memory of 4712	4836	yzxrt-agent.exe	213

Views/modifies file attributes 1 TTPs 8 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3524	attrib.exe
4612	attrib.exe
5056	attrib.exe
4976	attrib.exe
4764	attrib.exe
1456	attrib.exe
4600	attrib.exe
5376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\sc.exe
  "sc.exe" failure YZXRTAgent reset= 0 actions= ""
  2⤵
  - Launches sc.exe
  PID:5160
- C:\Windows\system32\net.exe
  "net.exe" stop YZXRTAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YZXRTAgent
    3⤵
    PID:4880
- C:\Windows\system32\sc.exe
  "sc.exe" delete YZXRTAgent
  2⤵
  - Launches sc.exe
  PID:5636
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /F /IM yzxrt-agent.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5924
- C:\Windows\system32\icacls.exe
  "icacls.exe" "C:\Program Files\YZXRT" /remove:d Users /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2764
- C:\Windows\system32\icacls.exe
  "icacls.exe" "C:\Program Files\YZXRT" /reset /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1992
- C:\Windows\system32\icacls.exe
  "icacls.exe" "C:\Program Files\YZXRT" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
  2⤵
  - Modifies file permissions
  PID:4872
- C:\Windows\system32\icacls.exe
  "icacls.exe" "C:\Program Files\YZXRT" /inheritance:r /grant:r SYSTEM:(OI)(CI)F /grant:r Administrators:(OI)(CI)F /grant:r Users:(OI)(CI)RX
  2⤵
  - Modifies file permissions
  PID:1328
- C:\Windows\system32\icacls.exe
  "icacls.exe" C:\ProgramData\YZXRT /inheritance:r /grant:r SYSTEM:(OI)(CI)F /grant:r Administrators:(OI)(CI)F /grant:r Users:(OI)(CI)RX
  2⤵
  - Modifies file permissions
  PID:2304
- C:\Windows\system32\icacls.exe
  "icacls.exe" C:\ProgramData\YZXRT\ipc /inheritance:r /grant:r SYSTEM:(OI)(CI)F /grant:r Administrators:(OI)(CI)F /grant:r Users:(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1296
- C:\Windows\system32\attrib.exe
  "attrib.exe" -r -h -s C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4600
- C:\Windows\system32\icacls.exe
  "icacls.exe" C:\Windows\System32\drivers\etc\hosts /grant Users:(M)
  2⤵
  - Modifies file permissions
  PID:1800
- C:\Windows\system32\sc.exe
  "sc.exe" create YZXRTAgent binPath= "\"C:\Program Files\YZXRT\yzxrt-agent.exe\"" start= auto obj= "NT AUTHORITY\SYSTEM" DisplayName= "YZXRT Remote Service"
  2⤵
  - Launches sc.exe
  PID:1628
- C:\Windows\system32\sc.exe
  "sc.exe" failure YZXRTAgent reset= 0 actions= restart/0/restart/0/restart/0
  2⤵
  - Launches sc.exe
  PID:2852
- C:\Windows\system32\sc.exe
  "sc.exe" failureflag YZXRTAgent 1
  2⤵
  - Launches sc.exe
  PID:5996
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:5128
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:1940
- C:\Windows\system32\net.exe
  "net.exe" start YZXRTAgent
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start YZXRTAgent
    3⤵
    PID:5336
- C:\Windows\system32\sc.exe
  "sc.exe" start YZXRTAgent
  2⤵
  - Launches sc.exe
  PID:1496
- C:\Program Files\YZXRT\yzxrt-agent.exe
  "C:\Program Files\YZXRT\yzxrt-agent.exe" --worker
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\system32\reg.exe
    "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
    3⤵
    PID:3248
- - C:\Windows\system32\attrib.exe
    "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:4612
- - C:\Windows\system32\icacls.exe
    "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
    3⤵
    - Modifies file permissions
    PID:3292
- - C:\Windows\system32\netsh.exe
    "netsh" wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2780

C:\Program Files\YZXRT\yzxrt-agent.exe
"C:\Program Files\YZXRT\yzxrt-agent.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:3512
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:2124
- C:\Windows\system32\reg.exe
  "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
  2⤵
  PID:3740
- C:\Windows\system32\attrib.exe
  "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:5376
- C:\Windows\system32\icacls.exe
  "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
  2⤵
  - Modifies file permissions
  PID:5020
- C:\Program Files\YZXRT\yzxrt-agent.exe
  "C:\Program Files\YZXRT\yzxrt-agent.exe" --worker --secret 616fa407-f744-4a61-8a8a-5110358787bb
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\reg.exe
    "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
    3⤵
    PID:2836
- - C:\Windows\system32\attrib.exe
    "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:3524
- - C:\Windows\system32\icacls.exe
    "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
    3⤵
    - Modifies file permissions
    PID:5392
- - C:\Windows\system32\netsh.exe
    "netsh" wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\apply_update.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure YZXRTAgent reset= 0 actions=
    3⤵
    - Launches sc.exe
    PID:5308
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure YZXRTAgent reset= 86400 actions= restart/5000/restart/5000/restart/5000
    3⤵
    - Launches sc.exe
    PID:3612

C:\Program Files\YZXRT\yzxrt-agent.exe
"C:\Program Files\YZXRT\yzxrt-agent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:4752
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:4968
- C:\Windows\system32\reg.exe
  "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
  2⤵
  PID:4648
- C:\Windows\system32\attrib.exe
  "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:5056
- C:\Windows\system32\icacls.exe
  "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
  2⤵
  - Modifies file permissions
  PID:6016
- C:\Program Files\YZXRT\yzxrt-agent.exe
  "C:\Program Files\YZXRT\yzxrt-agent.exe" --worker --secret 1f2fab65-a69d-42fc-a8ac-7d98f8879059
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4200

C:\Program Files\YZXRT\yzxrt-agent.exe
"C:\Program Files\YZXRT\yzxrt-agent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:3540
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:3108
- C:\Windows\system32\reg.exe
  "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
  2⤵
  PID:6088
- C:\Windows\system32\attrib.exe
  "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4976
- C:\Windows\system32\icacls.exe
  "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
  2⤵
  - Modifies file permissions
  PID:4428
- C:\Program Files\YZXRT\yzxrt-agent.exe
  "C:\Program Files\YZXRT\yzxrt-agent.exe" --worker --secret 2f564c11-a985-4d53-a163-24b44e0799d3
  2⤵
  - Executes dropped EXE
  PID:1292

C:\Program Files\YZXRT\yzxrt-agent.exe
"C:\Program Files\YZXRT\yzxrt-agent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:2548
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\YZXRTAgent /ve /t REG_SZ /d Service /f
  2⤵
  - Modifies registry key
  PID:4544
- C:\Windows\system32\reg.exe
  "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
  2⤵
  PID:928
- C:\Windows\system32\attrib.exe
  "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4764
- C:\Windows\system32\icacls.exe
  "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
  2⤵
  - Modifies file permissions
  PID:4972
- C:\Windows\system32\icacls.exe
  "icacls.exe" C:\ProgramData\YZXRT\config.json /inheritance:r /grant:r SYSTEM:(OI)(CI)F /grant:r Administrators:(OI)(CI)F
  2⤵
  - Modifies file permissions
  PID:2780
- C:\Program Files\YZXRT\yzxrt-agent.exe
  "C:\Program Files\YZXRT\yzxrt-agent.exe" --worker --secret 4c11dd67-56f8-43dd-9527-7be7ed30b94d
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\reg.exe
    "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f systray.exe /s
    3⤵
    PID:872
- - C:\Windows\system32\attrib.exe
    "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:1456
- - C:\Windows\system32\icacls.exe
    "icacls" C:\Windows\System32\drivers\etc\hosts /grant Users:(F) /grant Everyone:(F) /q
    3⤵
    - Modifies file permissions
    PID:5264
- - C:\Windows\system32\icacls.exe
    "icacls.exe" "C:\Program Files\YZXRT\config.json" /inheritance:r /grant:r SYSTEM:(OI)(CI)F /grant:r Administrators:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:4644
- - C:\Windows\system32\netsh.exe
    "netsh" wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2424
- - C:\Windows\system32\netsh.exe
    "netsh" wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 5KB
SHA256 d420c09f0be191471eff1909ad45534af319bb9e226a296eefc22c3dc571b9e6
MD5 c45b72d8fb485a752d861734092306a9
SHA1 ca007701e55f71023af7817a778391b7d86f948a
SHA512 614ff6f63e272b6e496275e10d5f5554d0bc1e32f3da5f1f3fd6acfed8abbdea96b94f03f464a16597266b0a2406a66ba060fc60df24cc5531c03824d32cea88
SSDEEP 96:oid7tHbkA/U9nhOIPDvGm+NlF3lA//tH/YC:ddF6drvGdNlbA/9/YC
TLSH
T180C1C92914FD14BB0E1F0159DA460FE17E5C75DC0BC66C84B7948AC522C39BE9AE1F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 6KB
SHA256 63c429ad83ef65ce3cd743a3e8e61189a2a3214a54001b443391a9e55e1c1f94
MD5 e4599851bd1612315c39cd927f8b22d9
SHA1 90dbd2bbbb8f11e57b6344ade7e06a3888e4fd9a
SHA512 8422a5b3a8ff5e014e0a2be579d9cadd7210532b4b1fa2dfafc2494e25653df3538421c445d573a623f91e638b79f3d7b0792715d1ba8300423740d305298ce5
SSDEEP 96:oid7tHbkA/U9nhOIPDvGm+NlF3lA//tH/YMW2S8:ddF6drvGdNlbA/9/YE1
TLSH
T1E8D1B92814FD14BB0E1F4159DA420FE17F5C74DC07C66C84BB948AC522C39BA9AE1F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 521B
SHA256 df960f86e4ca218986045ecd2471e8c27d288c0852c901332c52b7bdf9ff7583
MD5 49fe38fce9c6705f4f7e08774fa87336
SHA1 615a087a25e20bcf713eda704d31d2636281ba11
SHA512 cd6c59ab1952cd02414f9ec4a9ec44390157e9ac92a964215f75fcb1fc64e957a9c34a4fabd95e85381c98241eb6199bd195c72a23612fc45cb7516be218201d
TLSH
T16AF0E22404FD447B9A66024DAE2606A17E0DB5FC83822C60BB340B9536E796C0BE2743
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 1KB
SHA256 0ba67fc0d90ca050aa16494339b1ea2df8ccabfb5de70f86993452634e58bd82
MD5 40b63b3a7eca5b8c10527a283b26cf6d
SHA1 d184ca8028ceb97e6ad7aa4d0b9f778877743531
SHA512 131de96aabf7ca1759991e6eec54b4076a01ce8433251ee18bb383b34d8fd97f4709b982939d512f1245a73597b88ee3f6cd032d567c2e52c2d045298a222008
TLSH
T18011380414FE047F4A5A81499D260BE17F0CB5FC43C26C50BA640A8523E79B95BE2B86
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 1KB
SHA256 f7bca21c637947feb28fd809a81a89fc037938d4c5b6b05915782cc0a5223fcd
MD5 24b87e5c15e956001723f2e57eb9c974
SHA1 9d5acf88563869ccab02dd202ea47006c7620914
SHA512 0e27985a550672a50d8a1152941c8d0c233626db3fa7a7ca6612c635f52f7ca1965d758a9179e43da63002a63ab9154e5366402795361c6ce768078fa4de0657
TLSH
T15C31560404FE047B495F45099E964FE17F1C74EC47C66C54BAA84E8523D39B45FA2B8A
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 1KB
SHA256 60b212596efe381373f4435353c353ce8efc0a291418dd4a8befb732027d8fb4
MD5 aa729c37b00b9f2eb95c54316310fd20
SHA1 3779e9d457fbc85adae872f1f10ac5d37a696b0b
SHA512 6d504be48ac18872e0a59670114ee1e0c4b56e48d61f5c2ce86227388346e5fc7a3681e44e358df73b486021e91ca8a75703036122358bc7762b60066b9658e2
TLSH
T11A31660414FE047B494F49199E964FE13F6C74EC07C6AC54BB984E8922D39B49FA2B8A
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 1KB
SHA256 534591dae22769c947cb2e009b272eeae6847da296c80313ee1f51dd1f92d563
MD5 00b4af4dafdde9a523f60c77304fde66
SHA1 db81afb3a528f49294931153872e31e77f23bfc0
SHA512 c8b7b6cd852e3fc08de4fe6fa4296996872563f7e74221c35f02619ce2f22e38cc8a8ba8f7aeaa1446ed4815ea235061c8d0e70bf0fedeefca0254d5582e4a1a
TLSH
T19631880404FE087B094F45099D924FD17F2C78EC07C66C54BB984A8A23D39B49FE1B86
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 1KB
SHA256 4dcaab1977dfc82a73cc2cdb162f9765eb2f7b16d3d72aff1d1cdd427b7f7a25
MD5 4159ead9b15b9f8a6eb90d0501766f79
SHA1 b8d4b35a18e4def02e1bbe98ce6ff12dc305ba27
SHA512 b8ddc79ca603034733ce1890b18819643ede66c26f8188b54f990131880fd6428709795c1f62df58857c4c23de4ccfa80bf045b4a57d963bf242ae7f6364f8f6
TLSH
T14031680414FE047B495F45099D924FE17F2C75EC07C69C94BB984A8A22D39B49BE1F86
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 2KB
SHA256 f917ca4fed9f7276b3b38debcba6ab11bb27af9641f7852f79e848e21811c34e
MD5 ed0967a7ac7c96efc7359d6cc685c353
SHA1 ab11809ed5e065c539edfa78673f3c47e75d4239
SHA512 75f7a459b3100d836ad8e93ec4d66baf21e6be9d69c6357dd97d3fb6382112aed5363ad3d2a870b8299dca54b2366cf14ade246d8403c5aec7d0092a12aa3b53
TLSH
T13041790444FE047B095F45199D824FE17F6C74DC0BD6AC94BB984ACA22D39B49FE1F8A
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 2KB
SHA256 f721369ecb99f25e212a08e5516abff9926474db7c4ddf88ae0de683b8dcc8ba
MD5 c9495d88a1289a07e9a15e9f104718e7
SHA1 94477c12150e54d2449dd9c7c64f0cd2921cff3d
SHA512 6f986113c9f7c5051988553ce95bc3a9c577f7dc5967582ddb58109b0242c52437f2a4688ededcf9fc59724815ede9b0afc1c9a2f0d7a352208cf455a14f3406
TLSH
T11941870404FE047B095F441899864FE27F6C74DC0BC69C84BB984ACA22D39B49FE1F8A
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 2KB
SHA256 13908b0872be8194e037333f7b4abb31032288d077031ecaf6cad1e71b2a97ad
MD5 45b6985a64f8eb690462f70ace6e2c59
SHA1 6fb3da4f867c4f591c4f05dea356dd10aff68ac3
SHA512 d7860cc6b7ff6117a83d5d52c7470a9a48b7ca8e840b0604aebb7d337e59561ff285780844f01312d6578070702d94e75dcfe52b2b09bb3e4104848506e522c7
TLSH
T12E51860414FE047B095F44089D824FE27E6C75DC0BC69884BB984ACA22D39B09FE1F8A
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 2KB
SHA256 f399f6d733104ce3305f34a475f02159db61e8311ae58a297f3ac47c1a050863
MD5 f570d0830c07f5d04eccf6a1de0f9c48
SHA1 09c526d46e7f1ea69fb750908942b46ea2423b75
SHA512 f6ad61404c5f4eb5d83b5348f81d29022d15fdc5e099f64c926de9bd8d4493c5a1f586e7cff271f8b9597e5a358931d42a3c4aedaf3c95f76275970e8e775e58
TLSH
T13251880414FE147B095F54189D824FE27F6C79DC0BD69885BB984ACA22D39B09FE1F8B
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 2KB
SHA256 d4f11213ffd15a69c1778428cde45cbd74d99ef2b5f90ae48d0efe0f4929aaf6
MD5 fd0393a4841d121498a230c318b76bbb
SHA1 b71dc60a118644d74c9c3e85efb29d45a8518059
SHA512 fdd0928a7b6f27f365fd5a41239cf1af1c8137b01cc1c530e12abb78c7ac6027ae6e9d4faea705f0acdedcaf5a5fdc2b5a66a3b4284e0af702bd20d95e726a53
TLSH
T1D151880514FE143B091F54189D864FE27E6C79DC0BD69C89BB944ACA22C39B09FE1F8B
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 3KB
SHA256 db8c7ee241fd2c859d53fc1a75167c7bb73fb1bdb052d2b732ed2ca1c3c4e684
MD5 7a9cd3c4397380066e921edf916e05a0
SHA1 365143cac5aedae2e66cfb76a4d1a0ee91bc1ce7
SHA512 58a1cc772cc43057e4c44fd8b27cca5738852ea2b0ce851aba2dda45d7323d2c88557dbf97885091cc39a3a1278cb9cb381068461085007045d5fd35a37322bf
TLSH
T1DF61BA1414FE143B0D1F141899864FE23EAC79DC0BD65C89B7944ACA22C36B49EE1FCB
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 3KB
SHA256 127c2a19a30d8c8ef5c397b17e00ebdf3529d33d0c3e16bd617fc2baedfa43bd
MD5 35700949c3ae01762d4d255f0ce20e18
SHA1 167ba48a925d5657a993a37abf67e56e43c676c3
SHA512 c4f75b0dbab966ac48af2de4a0c3a29c4630739d6430c2d530146ae0ff8621cc4e5bd7b3294b082c47566e4e095477073b1e63ec45b568c5113e1940dfa01f98
TLSH
T1E961DA1404FE147B0E1F141899864FE27E6D78DC0BD65C89B7944ACA62C36B49EE1FCB
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 3KB
SHA256 bafe2248ae1c3b530794278a00f9cc45de3972cbc9ccdca3c00e8651613d325b
MD5 7941a6350b35fc4ab9c777ea39138571
SHA1 62a76d77d8ab65a94e6ac7fda9f680f993591820
SHA512 415bb050b78d7b423c2024dec6f488111d3e6f9ccbb5dca2471b29f2bb67e4e30297446f2a3ee91ffccf0dd75ec702e9c4861b95db45911b11b2cc2181e1b69c
TLSH
T12D61CA1404FE147B0E1F141899824FE27E6D78CC0BD65C89B7948ACA62C36B49EE1FCB
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 3KB
SHA256 35d0c2a5368bfbf5afa1ec040e952945db4e6897f8b1188397cd66eb7cb3f538
MD5 eba8d2701f5ad9244f0cd3737135c146
SHA1 0925aed1e75d8f374f11ed3f64edfdb7cecc8413
SHA512 a500e6bff8a7c820e43513793ed2c1574998bdc8b1a9676adf01b57d974d925a3f803887ae4b6f7a71c4238e4a949913d88cfcf606e13ae447a0461077c0f2ea
TLSH
T18471C91414FD147B0E1F141899824FE27E6D39CC0BD65C89B7948ACA62C36B49EE0F8B
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 3KB
SHA256 5a5c22123c2f11d0f3f0e70bb01337a9be6072204a5103dbf331fbf1a9e169f0
MD5 8c55fdb1279c2688215d5f94ec230929
SHA1 19fd8eb9f8b3380e87e1d522093e1b0020612afd
SHA512 3419e25431b60d02eb6864ade00bfe311a30fa3f493b123fff3e9d15afadf418629dcdbb0860495cfad28150a5ab6b00e5a6fb79c0f2117c390ecaeedad02005
TLSH
T14571CA2514FD147B0E1F541C99424FE27E6D74CC0BD69C85B7948ACA62C36B49AE0F8B
MD5 SHA1 SHA512 TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 4KB
SHA256 751f43ddfda17a91353bea6df35e7d882a1258fb95b84c063763fd4a391d8fc1
MD5 785010337fa86594bf406652abf799a7
SHA1 99783a1d4aaa51da2ed33d855d696653abc570ea
SHA512 a8c7c8a8bf0e5f476f5f4a60c522a859c16ccc46b7381e066bf082ec470eafc70036e3687904ba3d4b2cc9f9459cb76b24c8b0e58c6642319e7e646fe03f252c
SSDEEP 48:oidA79ojsIJHbp9ojatj/2Yg9Lm849ojbrtjm/ZJVRgnuH2CMqgtEgGExouc/FlI:oid7tHbkA/U9nhOIPDvGm+NlI
TLSH
T1F291B92904FD147B0E1F101C99420FE27E6D75DC0BD65C84B7948ACA62C3AB99AE1F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 4KB
SHA256 6de2cdd0a53fb1cb867400a4d9128facdf2aa245b22f3e6729ba587983e1efa9
MD5 38e6d3dce30b54e810f2f1a538956242
SHA1 7993875587ed718831757e1b08a97eebff1311d6
SHA512 b5a5675c9d8d939044b4e70c41adc36d811c3351aed53da4d777a1251ed83128cc6fcef5b0929f972c94c308c0733c8bbd6f76549eba7c15f11e7602e39be73c
SSDEEP 48:oidA79ojsIJHbp9ojatj/2Yg9Lm849ojbrtjm/ZJVRgnuH2CMqgtEgGExouc/Fl+:oid7tHbkA/U9nhOIPDvGm+NlF3la
TLSH
T183A1DC2904FD147B0E1F0419DA420FE27F6D74DC0BC65C84B7948AC962C35B99AE1F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_service.log

Path C:\Program Files\YZXRT\agent_service.log
Size 4KB
SHA256 9030f90edf22d1e3dc3bf737c9b40cfab330c07807b01a2678024eecb63e3cdb
MD5 83689720641c73e13784377969582786
SHA1 059bdbcc0c5bae560927fd07c9fef89e9a38bac3
SHA512 93fcd476305397df2a3845a13c9aefd553f7c46e7fa52f143d08f6d9a53ccc7ca9ad34ce1eec06e376d8ee9a39c377072cc0da990d6e46950fb6b6516de7c11b
SSDEEP 48:oidA79ojsIJHbp9ojatj/2Yg9Lm849ojbrtjm/ZJVRgnuH2CMqgtEgGExouc/FlR:oid7tHbkA/U9nhOIPDvGm+NlF3l9
TLSH
T155A1CC2914FD147B0E1F0419DA420FE27E6C74DC0BC65C84B7948AC962C35B99AE1F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Program Files\YZXRT\config.json
Size 450B
SHA256 364feb941aa18ce5bc9aa020166aee98f7f158e28b2f83a597d491f762aba91e
MD5 2bd562e8f51133b3dc7e8623ab56c95e
SHA1 43d9fcaf5e5b8651d4dc259dc6885b7bc239a851
SHA512 747236cafac9dadeb5e935cd1607203e89df4e0631c8e04b57726e6eedfa5de77659501163803ffb607dc57aade79f63b19f44f6cc111a56d7b8e6e3531984f8
TLSH
T161F023F30980EE8C77990A8DB89333985C26F407AC00610972C7125DA4E7142C5B8E37
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Program Files\YZXRT\config.json
Size 65B
SHA256 bdec0acd5c9c85621e2398f6302f2395bdeb8dcdb6124d7bd88a43a60f7267f3
MD5 4d72e7a5535340e5e29f3268f8c55b88
SHA1 bc1145c301a2ae235dd095bf468d151c15c95297
SHA512 7fea450fa6defeec3c4237e06429af1667c09c540a3f8b272023252ca801da028c1a5c9edb4f4d36e8eab88dc024ec4fc9e3bb1c76eb58275d87adc8bae1c164
TLSH
T166A002944E4B10BA0C55B1A540815BE4235FBD7D45B0590CD3C4F245894E1D926DC44A
MD5 SHA1 SHA512 TLSH

Submit Download

yzxrt-agent.exe

Path C:\Program Files\YZXRT\yzxrt-agent.exe
Size 15.6MB
SHA256 a320c1b9b52104fb81625c9fd2c6d6e133f4e54010de2eb8c006924dc3fa1625
MD5 b9c901cbff87fed152ec56964e28c335
SHA1 317b9179da7cd2007ca0a875acb98457238a1f60
SHA512 10c6c968fc24ce46b3a120f7e65bf142f15dc2232afe8b7c938ed157677085112f1ca596cdf5405fa4a06c951e3bcf4502ede7838d870d0df63603127a732bf3
SSDEEP 98304:F2LK7VWYyVxlGRx5hjRKVvz+KDFf356qbtJ/eFbqaJXM/6T7X:2lGLRYFpgrJXM/
TLSH
T120F63812BB9659ECC49AC4B4834646736A3134CB0B35BAFF45C492383F69AF52E3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\ProgramData\YZXRT\config.json
Size 450B
SHA256 384a2539a1a9024e6c7ca72994fd423ae5c0529d9135caec70750d1daa4479d9
MD5 a73c05412e51f8646a7b5bb3b75baac1
SHA1 1ee9309386007f1b2b9e5a55def86e719343523b
SHA512 839df9aec04a48423c4d029c8cf9f6121f8acd2f4468b095ee1f78dc043a93df126df97556c9f615c61d333289bc32739da9093ed2bb130040cd5d5644d1ae41
TLSH
T133F0233604C05CD939632C9F088171D07E67BA9FAA88BA0D14C2276B02D4887D64A51E
MD5 SHA1 SHA512 TLSH

Submit Download

apply_update.ps1

Path C:\Users\Public\apply_update.ps1
Size 1KB
SHA256 13a1d2009bcc28493a9e783bada3e89f8cb5f992069f625e0262342a631145df
MD5 7a0ed3b22d05302ab0fa6e14f5ee4000
SHA1 cb437a53a1bc9414c86f86b84bfdf9c85eec66db
SHA512 b70d49666e6912df54aa3b13f79f57e0ff0b731db4c9e42ba100c43e6359ae447ab59cc8d892a7a115e4ff2f6d67c01aca067ce4bd56ab42964e81c0f953aa1a
TLSH
T12931C08225A422E2D5831F339AC713DBBACBD47F400E070034AEC24A7F7103E6F5619A
MD5 SHA1 SHA512 TLSH

Submit Download

yzxrt-agent.exe.new

Path C:\Users\Public\yzxrt-agent.exe.new
Size 15.6MB
SHA256 7678eb121151ac81014f69757cb5cb9dc74053ab39bc9d70e1c86c9116e1c2b3
MD5 9e1c4910bdd3832fd4b88a48b4721127
SHA1 f08f672d31a1baa922ed96d5b4a03637a25577ff
SHA512 b0596b813b211579dd96d5dd9e5c212f798eead6e95ee55d2f5916f34666ea3dc08791e56d7f849a55d1f6c86afdf13f06ce5572ef97f6ff93d0994f39d25b8b
SSDEEP 98304:Bi4U6Y6574H+3CDtLNANkgjhM9Q8NYeI/STC/N2bqjBIGlp2LSAexlKt8Of7Y:rJs+306kmUNBnyBIgh68
TLSH
T1E3F63912BB5699ECC49AC474C34686636A3134CF0B35BAFF45C492382F69AF52E3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2736-74-0x0000023FF73E0000-0x0000023FF7402000-memory.dmp

Download