ratonrat | c2f5d16fc8a66951988a5d81659ee66e372e9494c19a339cf6eb697847620856

Analysis

user interaction
yes
max time kernel
65s
max time network
82s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/09/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 3.0MB
Sample260920-e49dpabp2s
SHA256 c2f5d16fc8a66951988a5d81659ee66e372e9494c19a339cf6eb697847620856
MD5 f0587783a620c0a76739946fc5dd774e
SHA1 30d94f2df866e00b58dab909f002f4ee3872ffc2
SHA512 410f269fd0e14947734f42171763e651d3a4d5e3f6124e36f5058af7f052b065b22157e2c38d871d743bb57c5826f64527b2412b144fc077ef5a6921f21b5910
SSDEEP 98304:cZod9rGE5TDSkZG3klEB37BfidnZFEZmDbWQ:cZ3HkZ8kuZ7QZFZDy
TLSH
T149E53376D5520EE9D477EBF09215A9CC322BD3BC27248E484F5A2B3484F3164EF86867
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution ratonrat persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

Mutex

yt2VYrvFgXmX8CP27YQCM4a

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
true
open_website
false
process_critical
false
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4376-1-0x000000001E3F0000-0x000000001E6E0000-memory.dmp	disable_win_def
behavioral2/files/0x002000000002b289-6.dat	disable_win_def
behavioral2/memory/1820-13-0x0000025C586E0000-0x0000025C5896E000-memory.dmp	disable_win_def

Detects RatonRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4376-1-0x000000001E3F0000-0x000000001E6E0000-memory.dmp	family_ratonrat
behavioral2/files/0x002000000002b289-6.dat	family_ratonrat
behavioral2/memory/1820-13-0x0000025C586E0000-0x0000025C5896E000-memory.dmp	family_ratonrat

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4376 created 3168	4376	Loader.exe	54
PID 4376 created 3168	4376	Loader.exe	54
PID 544 created 3168	544	Loader.exe	54
PID 544 created 3168	544	Loader.exe	54
PID 544 created 3168	544	Loader.exe	54

Executes dropped EXE 3 IoCs

pid	Process
1820	Soft.exe
1068	Soft.exe
4172	Soft.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4376 set thread context of 4792	4376	Loader.exe	84
PID 4376 set thread context of 544	4376	Loader.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4816	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2040	timeout.exe
648	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
544	Loader.exe
544	Loader.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1820	4376	Loader.exe	83
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 4792	4376	Loader.exe	84
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 4376 wrote to memory of 544	4376	Loader.exe	85
PID 1820 wrote to memory of 4816	1820	Soft.exe	86
PID 4816 wrote to memory of 4064	4816	cmd.exe	88
PID 4816 wrote to memory of 648	4816	cmd.exe	89
PID 4816 wrote to memory of 1068	4816	cmd.exe	90
PID 4816 wrote to memory of 2040	4816	cmd.exe	91
PID 1068 wrote to memory of 4336	1068	Soft.exe	92
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96
PID 544 wrote to memory of 4864	544	Loader.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Soft.exe
    "C:\Users\Admin\AppData\Local\Temp\Soft.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_gEOQz2YSmOswqnffYuQEQLSjKz7v17.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4064
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:648
    - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe
        
        "C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Soft" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe\"" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4336
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2040
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:544
- C:\Windows\System32\typeperf.exe
  "C:\Windows\System32\typeperf.exe"
  2⤵
  PID:4864

C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe"
1⤵
- Executes dropped EXE
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Soft.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Soft.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.exe

Path C:\Users\Admin\AppData\Local\Temp\Soft.exe
Size 2.5MB
SHA256 2daf95a7d0cb7579036afc7c1d58693cccb9351c6ea9c6b6475503ab61bfb92a
MD5 36878773b7aff5f72057b8b030f5f63d
SHA1 758ebeff325cf82f22b759ffd5aa8390a0535a5d
SHA512 f421442640018d792e5d5c07ecde5cc0ff12a1a1a771237e661bd0a95a62704c219522d84770337a15050698e6c905ce3774770068cd31bd3f01a6b3300eb3e3
SSDEEP 49152:cZagVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4tb:JgVUuHjkDGjYQDGuRxzew
TLSH
T176C5F10933E98A09F1BF0BB8A4B1991A47B2FD479C56DB5E1CA575ED04B2F04ED10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_gEOQz2YSmOswqnffYuQEQLSjKz7v17.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_gEOQz2YSmOswqnffYuQEQLSjKz7v17.bat
Size 518B
SHA256 1b811446a91adf269cef572c35035a0eeaf382e1fdf526c4d58752302e5442b5
MD5 bfa72e814857b8ed0b8280a6e9b7121b
SHA1 0cfdd2273c6ba0535ee3a8ceff198a25c5c73464
SHA512 0714b959f40263a399087f717c066eb2eb08608a018323a2dbeac9c267410b9b2d7a1c97452c3350cff5602f54561b53dccda2c635e9a71768cf0565464c4819
TLSH
T1B8F02E0A228E831A0410523B0EBB708CC1E9486B6F84B6823B20C41E1B9341FAAC37D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/544-23-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/544-110-0x00000000012B0000-0x00000000014B9000-memory.dmp

Download

memory/544-109-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/544-24-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/544-26-0x00007FFE1B520000-0x00007FFE1B729000-memory.dmp

Download

memory/544-28-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/544-25-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/1820-29-0x0000025C5A6D0000-0x0000025C5A6E0000-memory.dmp

Download

memory/1820-13-0x0000025C586E0000-0x0000025C5896E000-memory.dmp

Download

memory/1820-74-0x0000025C74690000-0x0000025C7469A000-memory.dmp

Download

memory/4376-0-0x0000000000960000-0x0000000000C6A000-memory.dmp

Download

memory/4376-1-0x000000001E3F0000-0x000000001E6E0000-memory.dmp

Download

memory/4792-18-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-20-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-34-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-22-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-21-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-19-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-17-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-16-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-15-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4792-14-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4864-127-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-170-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-125-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-130-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-129-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-132-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-133-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-134-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-135-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-136-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-137-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-139-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-140-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-141-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-143-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-144-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-146-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-147-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-149-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-152-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-154-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-157-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-159-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-163-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-167-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-126-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-175-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-174-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-173-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-172-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-171-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-169-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-168-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-131-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-166-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-165-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-164-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-162-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-161-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-160-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-158-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-156-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-155-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-153-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-151-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-150-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-148-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-145-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-142-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-138-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download

memory/4864-128-0x0000020B700B0000-0x0000020B707ED000-memory.dmp

Download