deerstealer | da690a0f459e4c2167d0d5794a385bd7707a64e0b7e934b9f7d18b43b7065a81

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/10/2026, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AUHAVKIQ.msi
Size 7.8MB
Sample261005-g8d5fsfb76
SHA256 da690a0f459e4c2167d0d5794a385bd7707a64e0b7e934b9f7d18b43b7065a81
MD5 2fe8c93bf8b99b55efbfb758ed4c8c42
SHA1 c8091bf9f6a3154e7eef872fd63ecfb64724cd9c
SHA512 7dffb4530af25d29c2cb68fd6ecf82ec41843485c4d1478e25417abf77ec10eaa5787778bde343183c0aca01f6c6a0442f37d33bbe941e0e84f5035b3324e25c
SSDEEP 98304:X7lYSK+Kq8wdseWDp5VhvjnoPsnkpqcIeNzEc1ODTnOeOss46iUPXKgRt5AMWdoV:5WtwdWVV2sF1cITnCsVps/tlGAWqT
TLSH
T1C9863368EA134B9FC9D2B6F2001F98B132617D802699D6D767E37D45EE36240C86F09F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery deerstealer hijackloader loader persistence privilege_escalation ransomware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\broker_cache
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
stealer deerstealer
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects DeerStealer 11 IoCs

stealer

resource	yara_rule
behavioral2/memory/4260-81-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-90-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-91-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-95-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-98-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-101-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-104-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-107-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-110-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-113-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer
behavioral2/memory/4260-116-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp	family_deerstealer

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c53f-52.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
5460	DispatchMeta.exe
1532	DispatchMeta.exe

Loads dropped DLL 7 IoCs

pid	Process
5460	DispatchMeta.exe
5460	DispatchMeta.exe
5460	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe
4260	RaModule86.exe

Enumerates connected drives 3 TTPs 53 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	DispatchMeta.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\E:\	DispatchMeta.exe
	\??\F:\	DispatchMeta.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\E:\	RaModule86.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
	\??\F:\	RaModule86.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\E:\	DispatchMeta.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 4260	1532	DispatchMeta.exe	99

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59bcde.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{096CC793-D1B5-48CF-83EA-4D4D5D5653B3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC317.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE05CE6856C87B04A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08ACF14172BC902C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bcde.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2A8A05F2D1F87695.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF14175B4A96E609AD.TMP	msiexec.exe
File created	C:\Windows\Installer\e59bce0.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2200	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RaModule86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RaModule86.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DispatchMeta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DispatchMeta.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000094b15be3c89983180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380194b15be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410194b15be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e394b15be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e694b15be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	DispatchMeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	DispatchMeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	DispatchMeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	DispatchMeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	DispatchMeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	DispatchMeta.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
616	msiexec.exe
616	msiexec.exe
5460	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe
1532	DispatchMeta.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1532	DispatchMeta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2200	msiexec.exe
Token: SeSecurityPrivilege	616	msiexec.exe
Token: SeCreateTokenPrivilege	2200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2200	msiexec.exe
Token: SeLockMemoryPrivilege	2200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2200	msiexec.exe
Token: SeMachineAccountPrivilege	2200	msiexec.exe
Token: SeTcbPrivilege	2200	msiexec.exe
Token: SeSecurityPrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeLoadDriverPrivilege	2200	msiexec.exe
Token: SeSystemProfilePrivilege	2200	msiexec.exe
Token: SeSystemtimePrivilege	2200	msiexec.exe
Token: SeProfSingleProcessPrivilege	2200	msiexec.exe
Token: SeIncBasePriorityPrivilege	2200	msiexec.exe
Token: SeCreatePagefilePrivilege	2200	msiexec.exe
Token: SeCreatePermanentPrivilege	2200	msiexec.exe
Token: SeBackupPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeShutdownPrivilege	2200	msiexec.exe
Token: SeDebugPrivilege	2200	msiexec.exe
Token: SeAuditPrivilege	2200	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2200	msiexec.exe
Token: SeChangeNotifyPrivilege	2200	msiexec.exe
Token: SeRemoteShutdownPrivilege	2200	msiexec.exe
Token: SeUndockPrivilege	2200	msiexec.exe
Token: SeSyncAgentPrivilege	2200	msiexec.exe
Token: SeEnableDelegationPrivilege	2200	msiexec.exe
Token: SeManageVolumePrivilege	2200	msiexec.exe
Token: SeImpersonatePrivilege	2200	msiexec.exe
Token: SeCreateGlobalPrivilege	2200	msiexec.exe
Token: SeBackupPrivilege	6080	vssvc.exe
Token: SeRestorePrivilege	6080	vssvc.exe
Token: SeAuditPrivilege	6080	vssvc.exe
Token: SeBackupPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe
Token: SeTakeOwnershipPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2200	msiexec.exe
2200	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2200	msiexec.exe
616	msiexec.exe
5460	DispatchMeta.exe
1532	DispatchMeta.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1136	616	msiexec.exe	94
PID 616 wrote to memory of 5460	616	msiexec.exe	96
PID 5460 wrote to memory of 1532	5460	DispatchMeta.exe	98
PID 1532 wrote to memory of 4260	1532	DispatchMeta.exe	99
PID 1532 wrote to memory of 4260	1532	DispatchMeta.exe	99
PID 1532 wrote to memory of 5456	1532	DispatchMeta.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AUHAVKIQ.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Steed\DispatchMeta.exe
  "C:\Users\Admin\AppData\Local\Steed\DispatchMeta.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\ProgramData\broker_cache\DispatchMeta.exe
    C:\ProgramData\broker_cache\DispatchMeta.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\RaModule86.exe
      C:\Users\Admin\AppData\Local\Temp\RaModule86.exe
      4⤵
      Loads dropped DLL
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      PID:4260
  - - C:\Users\Admin\AppData\Roaming\broker_cache\XPFix.exe
      "C:\Users\Admin\AppData\Roaming\broker_cache\XPFix.exe" "C:\Users\Admin\AppData\Roaming\broker_cache\XPFix.exe" /u
      4⤵
      PID:5456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Process Injection

T1055

Defense Evasion

Process Injection

T1055

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59bcdf.rbs

Path C:\Config.Msi\e59bcdf.rbs
Size 12KB
SHA256 dc0249c9f8203d6603ec47ab1e860f88439aa9f465d93e6898acf77c2108ba4f
MD5 c0d07299aee9a81ec5a5ff7b8b1cdc55
SHA1 b2acb904625ef2c661323781800b08d1a2d067d8
SHA512 52775963f2aa27e52f7f011fd71f799c5cdd50a6ec79ae306b056aa4db23a93dff05363d9c62d0fb91a5aee54d17320cdc42cf09fc5a5cf4988e82b8d835bc45
SSDEEP 192:2yWXGcVvZBkXbzeAsi9rCOm0mIX0mG2siJTLpo:2yWWwkLt20B0PiJC
TLSH
T1174274103A44D6DAF9C41F31831B63487767D3BCDA51ABEF420EC86C5B066CCAE8E55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DispatchMeta.exe

Path C:\Users\Admin\AppData\Local\Steed\DispatchMeta.exe
Size 5.1MB
SHA256 b4f2980e0ba4c1e1b303b443a2c45f4a9090c0d745809f84afb1879b70abf195
MD5 0477c2f9171599ca5bc3307fdfba8d89
SHA1 24eb3d47987c5cc97589c6f1685af5cb28001e16
SHA512 903aced62c9209c878d3fcb481ff10ca4f6fc2801dc45ac809fe123945c6ef6b1662d55c9939ba67736a4bcca1583d5c5e1f766c141699a86d33a5359e32651d
SSDEEP 49152:9dTweV4wyDPCfMpbKccEVC3s9bha76kiYmdUBKGTEJwcsNUNcKthjF0OiQ1hlGCj:9dowyDUMNKcRbsmGTEJFhN1XKOih/
TLSH
T1AC468E61BB81C833D0631674CC1BD7E86939BE206E3499577BE53F0C7E392827929297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gutbrais.vgy

Path C:\Users\Admin\AppData\Local\Steed\Gutbrais.vgy
Size 5.8MB
SHA256 4fa746c8afcdb2cdfbae81c0f4f90c9b9a3fc25da16b950c0d225fb4d5a89219
MD5 9f95e3c3ffdbf98bd29ad1963c939272
SHA1 7fa453ee4052bbed385ce1b3d448a9a4f21c3268
SHA512 a0049d0749887c6e1a4e8fcd2740e7a27a8a6ae8449a3466d7654a54140708ddd0779e8fa37521c4f1ba728f6d908edb6daca71fe85421f3303e8621a54b3d5f
SSDEEP 98304:Y0kNTusPnAYJnfAPfGbSA3suI+jpZYuJYGTtIpi+iUMWTBY7G0:lsFJnIn8SAm+PS2+iYY
TLSH
T158563384549E5802EE4301B76BE2F1FA2F015B658D77A3B4C4129F84BA9F3F50A72BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nundcranclaer.gb

Path C:\Users\Admin\AppData\Local\Steed\Nundcranclaer.gb
Size 31KB
SHA256 5541d916871934abecfa8e0e209593296bfde9e95c56fccd6e6ebc11fc915445
MD5 ef81d739af18d2e3a7c3676cdda411e3
SHA1 726c0ec2028f5daec8456b2286c4d7aae9255cc3
SHA512 28d6e9576947cbf69538bbd5e7625b1feddcdfde19cd523e32155d2fad0488fdfa1a8e3a9c6f83c450deb61173ab2f29d791aae062aeec4d22c9b35c0e51c475
SSDEEP 768:3A0OpTSbToEXNbP+XkMnbk9BEhmQP81h4lkq+TS3eXv3Gu9BvkOFSDr:3/8CToEB+rboGsm
TLSH
T1EAE2FB7237AD2E4AF563BD3E85C0F9629D4979732A26D0D4A9910B2FC029D51CF70B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tools.dll

Path C:\Users\Admin\AppData\Local\Steed\Tools.dll
Size 1.2MB
SHA256 42a45009a0eb0525853e5f63cee8068c7966b7b4c3e416fd5d0d6ff7ecd62bec
MD5 bdc8a1d805d8b9778e7dbc6ac571633c
SHA1 ba05e3ca5dccfcfffcdd3fedbf9a7743de19a137
SHA512 04cdde9be464118bacf853e460d04d6f5081a5ccfd94ab49fd0015b1e93f8dd0ca6ec8fa1f1ba6f376c5fc9b67eff6ded0843090fac69854d2f0d563397eb181
SSDEEP 24576:n9boIDeeQytIs9JSan1hr41aS5HhRyPtujlCpqrALc8cK:9Daf2tpQKvcK
TLSH
T106556D63F3918837D1631B788C5B93985929BF112E34AC8B3BE83E4C9F397913925197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Steed\sqlite3.dll
Size 325KB
SHA256 7725aa11ea65e84000b37618f406c906023b6ac5163c676b84d717695973637a
MD5 de3a0fa09d528f8886d20a325a319abf
SHA1 a8a808abb8cb80ead741e93ec43c0dfdc2fa768b
SHA512 72d3b33e2e63df12e0fcab8b6f0230b9bc2c0655fa0abf83a80d3506f0379697f6d4dbf75e365c83fbcb7897d3f7382f91d71ef73f49b0113d2e25980b7ef180
SSDEEP 6144:gWsJHAE3BWzZEAVPrrWxyLqHeuI9I19qnSX7cH0sU/1dWiy3/e:BsdAE3BOLPY5euIqqnC7cUVdC3/e
TLSH
T17E648D839AC3C0F5E9C561B920B7973B8E3946071157DA83DBE8DD914D23221F72E39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A78128F.tmp

Path C:\Users\Admin\AppData\Local\Temp\A78128F.tmp
Size 7.0MB
SHA256 9b973319baaf1fafe529083791251d0f265550f215c6df8f78d14eb861d94368
MD5 62ccfad87d9fb6c63fb450ecee0ffd11
SHA1 3d566a99884bca65de7a7db94c603b49ceb1dde7
SHA512 b0cb6d55fc8f8d21acdb38c3fc580ce0ec1574ebd77c15dee996b5a87131149373c0afacfa39e18732af2c8377e7373e4b00600e837a7bc46169f93cb7010afc
SSDEEP 196608:YdjN3pp7K4okgq7o0IF4o+NAgg6TsPeCtbS9kaiVKIUQFb6YC:YpN3nbLgL0IG1bQ3SmVCQ6b
TLSH
T16B76332B968535C6698C1247F216FF9D3CE9518CC5FB21A8B8384684CBFB709E051DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EB13EE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\EB13EE1.tmp
Size 40B
SHA256 f5164429dc97be8d19ba515fcbefc971d9ff9c77b6d01245767937ffbc8657ba
MD5 bac046aa4a99f12210a896745efc0e42
SHA1 9f1d48db648ed80704e94acce21cd6408577451e
SHA512 177443ad12ddb3f21124c0bd78b25d245714629665337680288c2b98016ff48110700059f4a418de024b5ca2034f2dece33e13d84ed60709572e1907c4c36a3d
MD5 SHA1 SHA512

Submit Download

RaModule86.exe

Path C:\Users\Admin\AppData\Local\Temp\RaModule86.exe
Size 2.2MB
SHA256 65e1a44427ebdb3ce67685746a9ccad8c7334aef0c502e9cbc2c30d5fe9e2652
MD5 5438a4ca8236d30dc63dd73e590b60c6
SHA1 198f8b7fd3cc9545d746b5502cf884a492ccfcb3
SHA512 734dd6868fffe55657bc71b0c693590d1724c0969867eaa2a02dbe4be774bcced2c40872b6860f7da407b4932cdad876ba70101b3da55420f648749415ac9970
SSDEEP 24576:B2Bwe7usFZKNmYBEDLagdjWgrvv8ZGFq/cXf+LdUtjnph/Yd6CvkscLpxjk+sv5j:B2Bwe7rFINmYInYdvgi+sv1jx8390Pn
TLSH
T1A2A58D5B32A001F0C4BB80B5CE5B9903E775749513B0A79721F842A62FA7AB25B3F717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59bce0.msi

Path C:\Windows\Installer\e59bce0.msi
Size 7.8MB
SHA256 da690a0f459e4c2167d0d5794a385bd7707a64e0b7e934b9f7d18b43b7065a81
MD5 2fe8c93bf8b99b55efbfb758ed4c8c42
SHA1 c8091bf9f6a3154e7eef872fd63ecfb64724cd9c
SHA512 7dffb4530af25d29c2cb68fd6ecf82ec41843485c4d1478e25417abf77ec10eaa5787778bde343183c0aca01f6c6a0442f37d33bbe941e0e84f5035b3324e25c
SSDEEP 98304:X7lYSK+Kq8wdseWDp5VhvjnoPsnkpqcIeNzEc1ODTnOeOss46iUPXKgRt5AMWdoV:5WtwdWVV2sF1cITnCsVps/tlGAWqT
TLSH
T1C9863368EA134B9FC9D2B6F2001F98B132617D802699D6D767E37D45EE36240C86F09F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 bcccdf8aaaa7ca6a68c4367fffc45a7fd79f2bd03caf8c5c4ab06fbdbca46de9
MD5 802f7f0f3e728d5df339a3480afcb046
SHA1 a97489347de6176fd09f3058d846ba8225ab71ba
SHA512 79559bdb1340d8cd43b09ecf74793ed4cacf0cc99dedb185c79a886f58b2263e3f536fa495df14c9ec7182240092f9b57d18c8129a861445ecf823214cbfc3df
SSDEEP 24576:hFo3DMPjdoO/vvTL/SwddCFgfr+XG7a+kQ7vtwTVLYzK5qcN8Yh2dEns5O1:PHQ
TLSH
T1E657A22436F92120E7B79E3CB8F06A63493D7D5BAC15DE8D45411B4E0822B71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f46f2903-23bc-4449-a0fe-86b0515c15e8}_OnDiskSnapshotProp

Path \??\Volume{e35bb194-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f46f2903-23bc-4449-a0fe-86b0515c15e8}_OnDiskSnapshotProp
Size 6KB
SHA256 1b62f06b3dc456c52ba9918724508855963f4c276d705ab1ecdc29851d05ccca
MD5 68da15f71e79ae805d227da9af69061e
SHA1 fd98e1c87ef88039aa51c99792d13a3f14edbc8c
SHA512 d5c485682eec9b594a91b00dee3bad217993187ebdf379f97b20103593f6c0f4a3b7904514692f32f733f80e387c4d3345fea8e9eac995d61555feb81779652a
SSDEEP 96:F9hihvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:vIb++uVm
TLSH
T1DFD199185AF54711E2B3AB7128F18557A877B912EF33CB8E0198238E6670910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-65-0x00007FFBDEF40000-0x00007FFBDF1A3000-memory.dmp

Download

memory/1532-69-0x0000000000500000-0x0000000000A2C000-memory.dmp

Download

memory/1532-63-0x0000000003F70000-0x00000000040B8000-memory.dmp

Download

memory/1532-64-0x00000000744C0000-0x00000000745B5000-memory.dmp

Download

memory/1532-79-0x00000000744C0000-0x00000000745B5000-memory.dmp

Download

memory/1532-67-0x00000000744C0000-0x00000000745B5000-memory.dmp

Download

memory/1532-70-0x0000000003F70000-0x00000000040B8000-memory.dmp

Download

memory/4260-98-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-101-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-81-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-116-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-113-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-110-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-90-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-91-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-95-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-107-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/4260-104-0x00007FF79D620000-0x00007FF79DA99000-memory.dmp

Download

memory/5460-57-0x0000000000500000-0x0000000000A2C000-memory.dmp

Download

memory/5460-58-0x0000000004020000-0x0000000004168000-memory.dmp

Download

memory/5460-50-0x0000000004020000-0x0000000004168000-memory.dmp

Download

memory/5460-53-0x00000000744C0000-0x00000000745B5000-memory.dmp

Download

memory/5460-55-0x00007FFBDEF40000-0x00007FFBDF1A3000-memory.dmp

Download