darksiderat | 0bf2d9abc1648b4faa9cf815af3bb75598e8a57467bd8d3497733fe2570c9b49

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
Size 42.2MB
Sample261003-v68g6stdlh
SHA256 0bf2d9abc1648b4faa9cf815af3bb75598e8a57467bd8d3497733fe2570c9b49
MD5 0c6772c096f90cd826035a269054a382
SHA1 85fc19060b87534c90bae3d2250cba16bdbfd8c2
SHA512 1b14c5944a8d640bcacdad0d82ea0d4a0f026dea95002fce955792ada4f79f50bdf5fc495ef3220437393868fa89225bf053920200bd216d5af2c50938c03106
SSDEEP 393216:evL5BGKilbWrjDLP+MqYJj11U8Q2mG4wq8tK1r2q781CPwDvt3uFhCBFe9XbMv+U:foqAj11z4lSZA
TLSH
T1A4A76C1522690052E8A6D67CAF17968BCF71FC06B32183D3142A74AD3FB3BE51F7A149
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4124-126-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4124-124-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts.bak_brmods_authhost	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe

Executes dropped EXE 2 IoCs

pid	Process
5900	BR.Mods.Launcher.exe
4124	BR.Mods.Launcher.exe

Loads dropped DLL 21 IoCs

pid	Process
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe

Discovers running processes 1 TTPs 16 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4580	tasklist.exe
3556	tasklist.exe
4420	tasklist.exe
2108	tasklist.exe
4532	tasklist.exe
5644	tasklist.exe
1180	tasklist.exe
6120	tasklist.exe
3328	tasklist.exe
1876	tasklist.exe
952	tasklist.exe
2084	tasklist.exe
4716	tasklist.exe
1872	tasklist.exe
256	tasklist.exe
3204	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5900 set thread context of 4124	5900	BR.Mods.Launcher.exe	97

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
592	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5900	BR.Mods.Launcher.exe
5900	BR.Mods.Launcher.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	tasklist.exe
Token: SeDebugPrivilege	5644	tasklist.exe
Token: SeDebugPrivilege	1876	tasklist.exe
Token: SeDebugPrivilege	1180	tasklist.exe
Token: SeDebugPrivilege	952	tasklist.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeDebugPrivilege	6120	tasklist.exe
Token: SeDebugPrivilege	3556	tasklist.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	3328	tasklist.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	2108	tasklist.exe
Token: SeDebugPrivilege	1872	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeDebugPrivilege	256	tasklist.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 4292	5548	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	90
PID 4292 wrote to memory of 592	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	91
PID 4292 wrote to memory of 2768	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	93
PID 4292 wrote to memory of 5900	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	95
PID 4292 wrote to memory of 3204	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	96
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 5900 wrote to memory of 4124	5900	BR.Mods.Launcher.exe	97
PID 4292 wrote to memory of 5644	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	100
PID 4292 wrote to memory of 1876	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	102
PID 4292 wrote to memory of 1180	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	104
PID 4292 wrote to memory of 952	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	107
PID 4292 wrote to memory of 4580	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	109
PID 4292 wrote to memory of 6120	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	111
PID 4292 wrote to memory of 3556	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	113
PID 4292 wrote to memory of 2084	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	115
PID 4292 wrote to memory of 3328	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	117
PID 4292 wrote to memory of 4716	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	119
PID 4292 wrote to memory of 4420	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	121
PID 4292 wrote to memory of 2108	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	123
PID 4292 wrote to memory of 1872	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	125
PID 4292 wrote to memory of 4532	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	127
PID 4292 wrote to memory of 256	4292	2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-02_0c6772c096f90cd826035a269054a382_blankgrabber_coinminer_dosia_glassworm_helldown_hijacklo.exe
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:592
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore -f Root C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\certs\ca.crt
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\MicrosoftUpdate\core\BR.Mods.Launcher.exe
    C:\Users\Admin\AppData\Local\MicrosoftUpdate\core\BR.Mods.Launcher.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Users\Admin\AppData\Local\MicrosoftUpdate\core\BR.Mods.Launcher.exe
      "C:\Users\Admin\AppData\Local\MicrosoftUpdate\core\BR.Mods.Launcher.exe"
      4⤵
      Executes dropped EXE
      PID:4124
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BR.Mods.Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\BR.Mods.Launcher.exe
Size 355KB
SHA256 180177ebc4b4f7fb5fe475fce83bf324bd54aa6c5e8857afada110a358898b23
MD5 290764ecce1c2f7d9da408ce879a94b4
SHA1 ec25ba51d237d5a13dc3c2dfecf2c964b4674239
SHA512 2c2ec8a8be8acb8abf2776b896e16578e8ef26f53b6f13220bd2d416f5feab39570f3b2d047278a53cf1fec147d19547ca2ed3b3e2973d587e2a8ad3a34ff323
SSDEEP 768:9Hu/VRlgQTfpsFaYPBfRit5c3DfwOb1xgBXG8Drapk+WSssfcceYKcOY2tig:9HudRl3TMv7AG8Du6+WSss/eYwp
TLSH
T10574B004EF6354DDC1BFC0B8C5B252336971B8DD00A5ECAA559CD2632E70FA057ADBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_bz2.pyd
Size 85KB
SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
MD5 94fd94a3194ef83be4437755a14cb810
SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
TLSH
T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_hashlib.pyd
Size 67KB
SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
MD5 d60cc3d94442491b3f8657d54225198f
SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
TLSH
T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_lzma.pyd
Size 157KB
SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
TLSH
T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_socket.pyd
Size 85KB
SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
MD5 b042a4ce17bb4174ee2a927746f13f97
SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
TLSH
T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_ssl.pyd
Size 179KB
SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
MD5 0e79667c70090d09216d6a84f9c81273
SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
TLSH
T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_wmi.pyd
Size 39KB
SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
MD5 d1eca38c5e1e76abe6a5eb862767e009
SHA1 021b3fd3b5f7bf3c236832283c95f6fa979e565d
SHA512 08945a1c25f7271e5793fb4706b896471e51cb2723a816e78115db3eee1d3b820cd7817fd7e524ecae9e0e72a8973469c127cda26c87ba3441abfa00cd7d932b
SSDEEP 768:n2/EEqrVmjsGuN6S9VVwIM3i7Vo8y++RYT2Ip48Txf1mlDeI6JSU:yE9BE2N6S9VVwIM3ie8y+kR9wfIUJH
TLSH
T1DA037EC9E6680052EA57CA70C5A5CE53F635BB932711938F326982991F333D1E73A339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\_zstd.pyd
Size 491KB
SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
MD5 11e408a51564f9626db73bb282aeeefb
SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
TLSH
T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.crt

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\certs\ca.crt
Size 1KB
SHA256 c6d2921edbdbc545bb96f7d68f77cff362ebb6532b934a05c6d9f949bc3790d8
MD5 6795373f512b1e93aea0436e263e8d82
SHA1 c78c810e6fa470b78e024056d979165c0be08665
SHA512 f7e751233a1f58d2bd1ff5a7189b727bcbe77a2c8cfb08a9d439962977695766c5aeba313a50c35549933a2351360df430126030603072426d25b0cf85a3c72c
TLSH
T1121189496EDB7D4EBCEF5A30DC51702A086D1D6C56E5D20D0D3030C59B549D8E1FD09E
MD5 SHA1 SHA512 TLSH

Submit Download

server.crt

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\certs\server.crt
Size 1KB
SHA256 c712674401db55916023ff20258b966ce3087c0cb9241f305343601441f8d8bf
MD5 b73ebf78a380dad1d585a480ef8cdbb0
SHA1 7917263e5cfb32459a80b0ac5e9a7dbc9b384861
SHA512 81adf992609b59c89eebce433c81473f5e65236b0fac3a1291227c485c917f8a4d95d2dd56b43c8363a0cd62100f638b73a10abce915684a124544efe97b424b
TLSH
T1892174BA1E452C75305AC335DACF042EAF9834E86597F32B8DE790425A84D6512FA289
MD5 SHA1 SHA512 TLSH

Submit Download

server.key

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\certs\server.key
Size 1KB
SHA256 c545669b209e7f71a36d896253157fc6d4727170bb59a3305b9042c8f7eafa61
MD5 e77232ed71ca188696bf4199dfa61c42
SHA1 184d693a6621b16f16088700332a9065a93e950d
SHA512 42fda373a97194b8f540f902f20a3702c6fc014a610f115e28c53ac8efa2d5e5ba7a98aea52610f64637dbcdca2ae6112f6471b49ccce132362b177afc96ebc9
TLSH
T10B31F83B42A81C84D69CE0F666CB3DB7B7D2C5D2A2FA0B2C4593E03531A801169B5D94
MD5 SHA1 SHA512 TLSH

Submit Download

kyo_loader_one.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\kyo_loader_one.dll
Size 22.9MB
SHA256 caf1bc3f32a3274f471caed53cd8476d777dbbf4c9012b4beb17e4ed0c5c6113
MD5 dfbb36a6c0c70445c72841e5e10eb0d0
SHA1 c11e86c13ea49f42434f5b250307efb9a12bac0f
SHA512 4a2d6ade77e276730287f764d37e84a2c2b4a3af9226785c99741ea66e67a99bff5521e03de4547302b814ba2a3fa483b304b505ff63a9696070829c7595bcfa
SSDEEP 196608:JIcdXyQQZzTgIO8vBGKxglbm1rplDLP+h6qP0z+O45P2Nj1HV52nMN0Te:+vL5BGKilbWrjDLP+MqYJj11U8
TLSH
T18837194512690412E992E67C7F2AD6CBCF71E807F31283D3542B489E7B83AB91F7A05D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\select.pyd
Size 32KB
SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
MD5 b6021321b7fd33c8c8a4079131625fab
SHA1 b8a812e37647eff1f0dc0689ab0fc7c6dfdb70f1
SHA512 4f31fe858655e82575216e55bf940cff6606b2869db1e567e7966e96f1b09391fe4beea0d6c00225093ad8b7248ae63ba8652365e0b9f396c00f703b73ab8e20
SSDEEP 768:yB7Y4HfJeHrFsIMRGno8y++RYT2Ip46htTxf1mltPRVgg9:yB7R/JeHrFsIMRGo8y+kR96ZfIZR+c
TLSH
T1AEE26DCAAF645043EAA3C63186E2DE83F539B7E35611829F31B981990E173C1A337359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\unicodedata.pyd
Size 740KB
SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
MD5 62a8f384eff5516c5941261b8b8c9fd5
SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
TLSH
T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5548_943906_lpQeHiS39LU\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4124-124-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4124-126-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5900-123-0x0000000140000000-0x000000014006E000-memory.dmp

Download

memory/5900-127-0x0000000140000000-0x000000014006E000-memory.dmp

Download