__init__.py

• SHA256 9ca4b5149f3ae4d6e0e25a26b608bd7ac8e55fc37bf3dcd30af4e24ca6411d48
• MD5 0636458394b00074ca8f2fa2b39d595a
• SHA1 3ac051844e39bcc39b176c7712146baa4da86ce0
• SHA512 e9c38af7bcc777701934d0cb0fb93c16ce787cfe61d8bebbedb0c01ff3ebc839b55935f5b8739442a8e47ba4f98d3c2bab1cec90b8b8d2a4b5923c32e7a3caf3
• MD5 SHA1 SHA512

command.py

• SHA256 bad1ef73cadf67860a13c1d8b7ed06ff874d2e85363441c4d20f5b0dfb895bb3
• MD5 18f44e2869774491354e8247adc93e77
• SHA1 9c15d9daeed9dd9eb0996fa9b34772bb0d8f6029
• SHA512 4423a44c1a79d400df13014d8fb111b7ec889becdcb90f79fd981202b184038542fbbaa72e1ed1df00851ccf802be7ef21e7136d1e2939a6ed93a1a5b44022a7
• TLSH
  T16631DF1A8EFD7515037B823E15666080CBC213230710453BBAFCDE501F38051E2B46BD
• MD5 SHA1 SHA512 TLSH

config.py

• SHA256 40a7d29c690f45c51548817fd1db91904dcc538cd6ebe6c881493583e089a325
• MD5 c2121a31ed276bff618fe1c967bb5827
• SHA1 4cf1bfbeff23ff767857da2ef73d2898014f992e
• SHA512 96088df911fe71e71219faa086f105c4090df76d405b9abe750e3d70913cbcd2c1241b78a28830e50a9a8de9ac5591a1cb4b759d853cc0279d323510e0f8a870
• TLSH
  T1F111F0813CE1E0B58D1694E8B6A43053233E74830F481554B99C0FC83F2C6AB6FE128A
• MD5 SHA1 SHA512 TLSH

connection.py

• SHA256 081652a4e08df102feefca60d30eaaf39c8053626aaddd3fda25e5c9f36f7a35
• MD5 002a203b53372277dca704dca16df6e8
• SHA1 9a13a5989b2410f157f67864e1df899695a07001
• SHA512 450055f9d755876e9bbda2ba61a7c7225693c4a03d02af919654b7922db1c1c007a551af2a909d52c5ada904d025c6381e99b5d028a8e7836d86deb2fc95e0ad
• SSDEEP 96:9ODXoEKNgnH0nj6nh49R7AbPYtFQUCMdPVp+ZPiWrVRVbRdh:9hEKqnH0nj6nh49RYipCMnpeaWB79dh
• TLSH
  T18FC13548AA795427C323CACD9D23D010A71A748B1B08687DFE4CC7749F2CA61A2F57CE
• MD5 SHA1 SHA512 SSDEEP TLSH

constants.py

• SHA256 3660377c0ef66303321f97e8721325186f6ba98e67c671e4dd8864b092d3e349
• MD5 cbd89df06b4ea05c585dfdd89b39fcd8
• SHA1 7cf889b2ac4b664afc87e90afa8091d71c995bfc
• SHA512 0a432025486312c6d1c4b8abcf580fd97b91d85d89c7d32bdbee5f175572b0bba3b32a18c1c906d9e4ffadc39326cb2c5a79b7329e5dc2777eecb812a2ed320b
• SSDEEP 192:lhASlaEBSJUzbUWbQJD6WgTWIpdr2IMpGfp:lLbBM4IWO69TpbM8R
• TLSH
  T12E028037DE5A0D4B0674A682D89A05C0FA08D7FF077A1C17393A492C5F3EA3612E29B5
• MD5 SHA1 SHA512 SSDEEP TLSH

extproc.py

• SHA256 15b66ef677b6dadb4bee16c6ce5f393cf5de8139a58db5ef371dee7bb1c19e67
• MD5 45e6a0f2cf2dd1b8f7a98bc6ebf93c09
• SHA1 8409b6ce2082f78f0629b74bf7be6b2035550c40
• SHA512 c4f3aa8ba2b2c910890739ef1cdcf5b04ba14c209aede57eafb785144b028d33f525f6798d39cc919dd94fb0291ade71b6031cbd5d78680e32916dd2750963e3
• SSDEEP 192:kQDBGyiXIH14g+5KQOihzb4afdmYsaJbVFJQ+oEfKbTLvjdSV1M/xKnAI:kQVO/5QXSmEiHHdSV1cxKnAI
• TLSH
  T14562A74A9D0C2625E2D3DBD9DD429485B239F9AB76003834B6EC47445F80178D1FABFD
• MD5 SHA1 SHA512 SSDEEP TLSH

fileops.py

• SHA256 1f6a71e1fe7a4b2c883e567dc32defbfc577230b7a3af8f9cf6849916bbbbee0
• MD5 f5d1a85dd5a9e333bd7f9fae11204ade
• SHA1 c4b3c80e630efce587bd10d6024c5b64c5c80f22
• SHA512 58bf6491c98ac1ac93ef7134b0f114f151555998ef1da444e902384666cb39adf407ab0465a073da2ceecc8a02f6a583c07a1415924ada59ae2b4adf8b43a123
• SSDEEP 96:Z3S9sJqX6EcBREmaO7E0q6YU9JN7Ek6YUM:Z0fGRE+7YAD7TD
• TLSH
  T15EA1E5298C406401C7B3F2EC897189562572ACBB5A056D23BE9C4AAC7F84631F5E73DF
• MD5 SHA1 SHA512 SSDEEP TLSH

grabber_user.py

• SHA256 15ea9f3dd4aa76ef274be05b0290c8c0efb96883c31804fb04b030643c6963db
• MD5 d81e17db226c7d362aa041ce6ae488e3
• SHA1 412ec297c0e8bb665877d0c932f017136d18934c
• SHA512 2f8b49e89ad1247ed3bc4353922f4b5c67454e457a55abdb3dfde24cddbd9f66c2634f070db37cd3724267b6e35c1ec0b9965bf1f95b8368cb741342c12ab4dc
• SSDEEP 96:AhuVBqHDWJv/WGel4RukdD07Zyj4B1cQEc5UJnpW5vJZm+JDNZznoIsN:AQtKmzhyZycB1LEdpknGIC
• TLSH
  T1C122BDA2AC1D842240B2FB9C7DA2D8D0D11953E32B22152376FD4B859FB46B0C2B55BF
• MD5 SHA1 SHA512 SSDEEP TLSH

handler.py

• SHA256 4ee74f4699976b35ed1431859d9ac99a5c6ce76e9f0118470faea95dcb2f22f8
• MD5 09241bb6289508a7813a23730ac12a6b
• SHA1 7d1c7df897ac5c1c375c039a307e9835d8db7e86
• SHA512 3d374fe2b8a701965d1d4e93d4b31e785c760868a4c2619137deaaa28ed75b0158f4d43445781bba4e400b065104013f16cdbb8fed920342b3ee48eb78664f6c
• SSDEEP 96:Zx3PrcnsI8Pdfn5i0aZ4dA7kVXZS7D2tMJOYqNGxFU:ZxfIsIodBiFGdA7k7SdOGK
• TLSH
  T1E2F1FC11AC2C1C5BC293D19AB02670C19126A7974B043C37BBEC47785F9C8B6A2F739E
• MD5 SHA1 SHA512 SSDEEP TLSH

hardware.py

• SHA256 b458578cf0b4fa63495288e79723b2ad394fd88b8be68cfe1e60ffaa3a56dd36
• MD5 d7e12008462e74f933117b90b67c2e0e
• SHA1 fdd35cd6e9232fcea7c5c861cd57e7e450cf546a
• SHA512 7befeb40c4e81cf4bbb5a213a57160506f9bae95c2a3f36acb87f8203e6ecb4d6169d72f553fbe5f345c0a0f6f9a0b2bda7f99e684aaf0de3f582e403f9cbb4a
• TLSH
  T17D512151DF2A990543B1C19D94A2C226EB4847035E1B897FB9FCC3692F7C0229274BFE
• MD5 SHA1 SHA512 TLSH

helper.py

• SHA256 0034ebae5801aebd30b9b8a650efb970ff4a55b27601e66488b48002f4b2b666
• MD5 8a12bfbc8af06f7dd3ae27fa88f924a2
• SHA1 452eb8623676523d566f10c50bfb4554119a6a46
• SHA512 9494df8a3b202be204ee2578fe68fb2dc5f869c9fa26dc41e9af7319531aa676fe32d0aa1ac810dc3406f6fbd1d5b78ca047b22b1f15be483018aa0ce2c78557
• SSDEEP 192:/T1Z/5CiDVLyg7k/usNJz7+bwXj/1oa+z/7oLEXgMKZxH1Ti3Xk0LVdZ8La1Xa9P:/jdZsNJzSoEwxVi3pXt4
• TLSH
  T1349264A15D1EA801C073DE1D5882E197F717274BAA1E4D03BFBC8A885F75121C6F4EBA
• MD5 SHA1 SHA512 SSDEEP TLSH

idle.py

• SHA256 fbcd2de2b160a4eea64681f30798a182edf657244e479622eef0f0effe49852e
• MD5 f50b91a99dffcd27c944b2da947eb9aa
• SHA1 b45a8cf0b86fb2173233e23cb15a9c4d9fd2793a
• SHA512 52a6995cb83feb4d2c8fb4f39a35b08b088ff732e39b597779398f62c8e1f725bb4932c0a374293924f6e2f8331b5dd4b73f1e967e872d9504d0220a2330204a
• TLSH
  T16FF024655C2ED00403B1420DAA8AD989FA407713BD381E0EBFBD42F62F7667C836C711
• MD5 SHA1 SHA512 TLSH

idle_report.py

• SHA256 21ffd6055e27ac5f5829a8afc5999517f9f6e9797cc6cc6e6bbfc7a54656fd8f
• MD5 72e5d8822c7e1da447975a722d9cf8f1
• SHA1 8be937ad1a7c2d8af5b922effaf0d0446400b762
• SHA512 5f127e7d70a196a3e55367ab0324ccc0341d5c0c61c51f07be7dc8e5f02ff653c5b1b264410df5ff5278b39ac23d89e5b76ad1f1b3851208720d6ed922064c2a
• TLSH
  T1633127210D2DAC415DB24C9DA46F6AD8F363434B2B181E13FCBE87944F7A9D09699129
• MD5 SHA1 SHA512 TLSH

launcher.py

• SHA256 08dde1364e711f6febfec22620605824607a2d9bc03beac9e1bb326b520b64c2
• MD5 95dd9c3fd139fe9c8dd440bf5990b49c
• SHA1 201646ed344784efecc433daee2b6640ffd91b3b
• SHA512 fb2c77472dbe48e9c268bd8297667c8776e40b167f80d4a7d4314bfb9949b6d0c5a13bf357678acba15f212b4847dc7e5c9468952be4b4e8090020dbbed1bb70
• TLSH
  T1D701D30294081DD08693C9951534E2F043731C8B1F49AD39B5ECC3171FC95358AFB8F5
• MD5 SHA1 SHA512 TLSH

launcher.vbs

• SHA256 c5f774c9c447909cac48abc29aed0bbccbcc9caa5b4986a6d8b1a4872f3f3a16
• MD5 8a16bd46c514e6946fe4000bf2a6dbb6
• SHA1 4c87cda9bd0c8854257550404189db7d4d2cdc89
• SHA512 c913364da408b2752a54b99f7793ea83ca23f13ee36be4922649d809235a8684b40b5de02bed94b29fe2a794fe6621709c15b6b05a18434918b6e20686522734
• TLSH
  T1C1F0DC48EC38C5384807675A00FECC4FC7290459066084F959BCC4A8C31C36C7DAB2C9
• MD5 SHA1 SHA512 TLSH

main.py

• SHA256 abc5506e628c3bee834fa18784c3f5dc5217aa65f369c0b78e7e3ff6a5da1bc9
• MD5 3054903556a568fa93e4a70d426ae8dd
• SHA1 1fea33734a7d86b92bfeef90adc123e9704b4654
• SHA512 b67bf0f628adcb97d5cddc8a77d478a3ae792897a2825eb53a263bd160e85ae4972d0ef8064d3e4e8b442e2b9444a11f5c9c184bd0916aaf1d1e036b8a250281
• TLSH
  T1F971EE128D2BD00A8C70F7DE18BBE369E31AC1775E090E07F9ACCB295F79064476855E
• MD5 SHA1 SHA512 TLSH

main_agent.py

• SHA256 75b34478fc34cdaf1338df73e935785068ccb9558a0bc4d7fc90150fc6dfc129
• MD5 643efdf942f9ced9095ed7eb5510df34
• SHA1 749971fe228e3d2c78ee33b6ec6fb2ef35ff48ac
• SHA512 a1bf8835cec74dd30eeb323b4d7239f560b619349954aa1cf07c6cd5bcab38e712bb8f7091e614ec25378dcb80f04cd79c39b11a7281de536cce51e2272b1c06
• SSDEEP 96:gKB6BxESNGFT5oHhSRqpjZ8p9c3R/SxQEjTuk3G2eWCwognA:O8Sc7RqXSKpV
• TLSH
  T1F3D1FE542C4D245AC2A3C8267657E0424323A64796083DB2FAEC43A81F7C6B575F73AE
• MD5 SHA1 SHA512 SSDEEP TLSH

message.py

• SHA256 9f8e062d63019e14bd995c5acc649f9af9ce06bb57373b08d9345633ff7945f3
• MD5 1c83e7481417bf4123e4ab7a102d81c6
• SHA1 aa84b47d93e01bbfbdee040e70c1b3c8386dc6ec
• SHA512 682464097467647982353131833a8bb6f351910873211771a8389f1203ca992539e3eae55e652933e32830bad539dd94edc03ad931051dbc770535d9dd17bc09
• TLSH
  T125510C53AC7AA0468173A40E5E3FF5D9E3035213662082877FACD7247F790EAE1592CE
• MD5 SHA1 SHA512 TLSH

profileproc.py

• SHA256 4e74f9aeeaf2a2b45f331e8a9cb59a2d43de1c9ee4ac485351f2e2e6caa2fc94
• MD5 37124bcaac0f978c083f4c0403a5232e
• SHA1 ab4bd905b1e7bca4c82b8193c233ab53768f474f
• SHA512 d1eb65c31adf1337e4af2cd9c1cee67e33962033bc1994e402912acdc7b007d60b6cb70ddae6ac2384ed7be75e59b42bc39060c83becdc09e255aa801044db36
• SSDEEP 192:vWyECeINbSC62oFJRQ1tTqehThAE8ICsUT0:zt3Upg
• TLSH
  T1651222A52C6E5803D2B3D2AD6827C890F21A5B4399129A13F5FC53446F72430C6F8AFF
• MD5 SHA1 SHA512 SSDEEP TLSH

progress.vbs

• SHA256 e05897532deb42d776d3fb718de304bea9454dbc6fe1c463c32346abfa439419
• MD5 d6a096f26e9341494705f015643f5979
• SHA1 1cefe27e3a1f86cfbf480400af4126fa2070660a
• SHA512 112f56dac0ff66e4a8ddb86e9a11f8837f567bdffe33092586794ba808c1ef1a2b72c44b77891cb9cbc3449879e39df92d00f4563e310566d643ef4ff9679c16
• SSDEEP 384:ZJ0ZJelJ6kJYJXJP4IJVJrJ3JsC0FeFbf6dOcTl0FXwCprjwGTPdFN3Ksl:ZJ0ZJelJ6kJYJXJP4IJVJrJ3JXbf6dO/
• TLSH
  T15142ED1ABC05CB7493461B2B1A3B881E7F504B2375178A18F99ECC60BF197D8CEA54B7
• MD5 SHA1 SHA512 SSDEEP TLSH

runtime.py

• SHA256 8fecc0435fe3ab3dfe844f8f4ab2962a936d4257a63966f487995f6f599d5b4f
• MD5 db830f0736e0982454b9a916d2afbdab
• SHA1 747036b245f4b775ab4dd9b869a10a869fdaf3fb
• SHA512 201b0d2eee9a4dd69aba9d5fd25d2c5f3df9508e9a28512c777c901183e49a0076e19e836be47b29c44f977135bafe5db9465f6e773d1df60dfef755e5d6d116
• TLSH
  T16AE09B25ED22D40C8832FAFB4073531AB86CD5A7CC1C2E1BAA548B3C4F049D88AF603D
• MD5 SHA1 SHA512 TLSH

secrets.py

• SHA256 ce5cf18d535e683cfa6105a7c538a1d776b33f83d00aad7481d2b69a7b5165db
• MD5 3abb157e20d940a8e7032cb40e6f7913
• SHA1 e7e11d391ba88fa00054ea097ba12d79c7eea321
• SHA512 edb3ee85eaf3d451476c3e16be0666aa3e26dfad8ed5e96f4ef6a97685dd29a61064d6850c641564a24515137309179ecaa74f69c4ba6369f9827cb2151a5fda
• TLSH
  T189F0C08250D548F48742B56860E34C865B0C3A790F088F653DC883612F144F7E8FB250
• MD5 SHA1 SHA512 TLSH

service.py

• SHA256 0feeb924a22e255a42052055709ddea616ab90299f2890c7bdaa0fb80d0a34a3
• MD5 dc0cab7552381df473b2ca531e235673
• SHA1 0d84d827d323a882bb47102b8140fc29deebe7b0
• SHA512 31a3f30836bb4759394550ddc32c317fdd5a221d3b577f942f72365f23a03a0588dfc8c880c7070978c286b9fd17ca066f5805357bb3ee2d88aa0517aa147ad8
• TLSH
  T1F421C8001928102697538C881A33944143257A875E169899FB9D9332EF74BB5E6DB7CF
• MD5 SHA1 SHA512 TLSH

setup.bat

• SHA256 7d53ecdf4fc9e32143b2027bf3368ca85eb082d1bb46ff8fe0ec4f0df05f36f7
• MD5 c90f2ba5c742cc04a90586cdca9c7aa3
• SHA1 bab58a1ca774d985a823f3ef27ba29a67b78946f
• SHA512 c7999f5e70ddbbccac18027d18baf73be75f64400a8c7042a7b07b3c40778cae6575990ccf87e82dc68261e843b8fc8a7273dbc382b6c8f123075aa8090218b7
• TLSH
  T1841150521B58367C8A74016C23880508EB07D3A62BD0A3DF3436C0971FAA69FC5F3DD8
• MD5 SHA1 SHA512 TLSH

setup.py

• SHA256 bdbdaca481b8073b1bd30f6bc1791467c713f99c996eda81902ba1c1df86b8cc
• MD5 3106e9c7e14a25adfaa9ae756a0f976d
• SHA1 db21f5e9ee5f9c3b113faba1f64ddba47dc02b7a
• SHA512 da02ff48f08b77c2d399271671724fb4608c86c11f78d7a5aedce0d143e852477ffdee161457515d7ff8732f863dcb0c744a8fda3db49aa4437d60fe87095490
• SSDEEP 192:664xwjbKoWZyAQQ83p0iLL65RJYN/6/vz8yySSQxiP8jRmQ3fv0xWRYb4GO9SbIL:6bxkwdY4DMU9FQhC
• TLSH
  T1075242938D0AE4108672CB6D1E91C4D4E71DB3ABD7260C837FFC86A89FB01158263E6D
• MD5 SHA1 SHA512 SSDEEP TLSH

showext.py

• SHA256 46e0e0ac645d61a72409bca3d05f8f9db268c2dffa5d72415f74644ef035c4a4
• MD5 2f90627c670353e01ee1579e13e59e7e
• SHA1 ed38b3244ce13fb9121b578e031205ab954a3510
• SHA512 eaf3c8fadad89d06090dfcd4e7e13a19afafea16614e3644f5e53524814d2aace343bad93ae411443c1d933463e0e367f4c6e6f8b467a5e2a6624586436f8e53
• SSDEEP 384:mD86tGitkApW2yoQRdzQxo3L5S8u+LsCRsc8aBsxJG/+Wj3pDLu:mD86TtrUpfL5Sj+Lshc8aBsfGXpfu
• TLSH
  T19CC273529D297126827AC41CEE43E152FB259313A6123913BEECDA643FF0167C1B7B8D
• MD5 SHA1 SHA512 SSDEEP TLSH

state.py

• SHA256 bd38fab4c3316b7c979e9fc5a3f52f3a84ca86a5b86b306fcef28ea796572a0c
• MD5 09cc9e55ba07291a7d6b954539d6c161
• SHA1 33d2a069460b1d0f0c39ba848f6a737cdbd5a2c9
• SHA512 bca9d6b7b73f12cb4d2bc77feb51fa0b3590cbbcb5a876d7913642cec901fb4b889ffb1babc676a20a9e255aa2ea910050f99c7f22a8b41b62a7802a42d42ce3
• TLSH
  T187113A137C1F1099C5B29D3E261EE061F79F0317AF165E5371ACC6646F384A068BC6BA
• MD5 SHA1 SHA512 TLSH

utils.py

• SHA256 0b1ffa41ad424dca791bf08dad5d63bf53ea8a31590e1071dcf37790dca3fc3c
• MD5 8ff5875dd043f685eb3c07e0a6571301
• SHA1 48c55691446121d2e5b547cf25e073211daa3684
• SHA512 acdcd58a5a639887d172162ae60cbc5205d890a7c11d50c048bb8d918a629071588987fa8841122c86e696f7cb7f4ce053a5a65678e629ebf4f35e649f36b008
• TLSH
  T1594133C39CAF951682B5E6AC3A949480F00C5FB397593A12B9744C056F653B2C3F05FE
• MD5 SHA1 SHA512 TLSH

videodriver.vbs

• SHA256 2f9dc9b159e231e6dcb83230dd3447c5a75cf02fa6d9fb2fb7554e945f9fca29
• MD5 791ef30927110b8f0060663c56850f39
• SHA1 7242b5d06a29c05cda4cccc7581eecf845b4f522
• SHA512 5f6e1de69a24cf529b2c91178fb8e7756441af2013a3bb192eacca01004efb816872f745090d6ef01c7a881040fab542391b10e22f7006b304b81f590c4a30e6
• SSDEEP 96:BcfNKjt0QrmcYuhz4Mwzxz8geaBZjCOnUiRWj:F0QzN4jxDrXmNim
• TLSH
  T113B130AFB9627738A3177AF86DAB400F17904413464958A4BB4C53E40F286BBF361BDD
• MD5 SHA1 SHA512 SSDEEP TLSH

windows_registry.py

• SHA256 b890c4a1202cb0852f045e55488592c7194580c4679a62e5c0e5dd4c2a5ae954
• MD5 24f4d978a419f1b69edf466531684a73
• SHA1 64f3e3d45ecf6f4fba36c54530d1d08948365fc3
• SHA512 857e166e3066fffdafcfb2680aa3af5e3bcc8ae75c47c6e0bfa3e7ec169223420f5a6e2dbdd6c3d088cf6485530b759d7c5f1477072f9fdd21db47dcd376369e
• TLSH
  T12B219EA9EF5F692143B1835870C28473DBD81B83571A0C72F0AC46B03F2D86AC4759B7
• MD5 SHA1 SHA512 TLSH

zip_archive.py

• SHA256 e7375a1677d66100d4f6f52dd99bf6c6ad0f921de7069caa48de607c519ebf20
• MD5 fbfa620bd6c11ccaf19e469dee7929dc
• SHA1 1597f2e45da19d77287591eeddb07357d2c0dea1
• SHA512 bd61774c1f5ad93085bd454fd4cdce5072f6ee7bd1f8cedaa0a4c7c875cce19a828f12bb8ce2f926e15977e9e319b9f9eb097a0231fce71d488b5828b7a3cd85
• TLSH
  T1D35123AA4C18011093C3DF686FB59DC81A14FDF3AB0225B9F4DC7A085F48CA591E66F7
• MD5 SHA1 SHA512 TLSH