ratonrat | 2e7a6cb0a10e6ef1e85e3c2d111c59fb62eba801084b9ca090a465accfb15034

Analysis

user interaction
yes
max time kernel
148s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpooferCryp.exe
Size 1.3MB
Sample261024-wtjhysds3p
SHA256 2e7a6cb0a10e6ef1e85e3c2d111c59fb62eba801084b9ca090a465accfb15034
MD5 787bd4789576214c546a86196a064783
SHA1 98d980dcb5ce3e5867f37340910fed5b33d63d15
SHA512 6d28ab816ac6f6c3021e5eddc398642083866b7106b87e8506e6a517c237b7483fe31b7791a7d75be884ea460f2245ee91db513238d93e8b695a3a22a7e882ba
SSDEEP 24576:UKqUXSrtv94TP0lRRkxYcxMNnyFoBOkA6s4JbBN:4dsclR0BxMsaRw4JbBN
TLSH
T1D555E05C37F88A18F2BF4BF4A9B0545A17B1FD539C52D76C18A664EE04B2F44EA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

itzzcatzzz-38270.portmap.host:38270

Mutex

IG5pxUE61pDacViaxP0eit6

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
password
t.me/junk_code
process_critical
true
raw
https://pastee.dev/p/ksru1Lsf#RwQxtaTnsXu2VniHu3dmzs3N0yGwLB5t
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2252-1-0x00000278DACA0000-0x00000278DADF2000-memory.dmp	family_ratonrat
behavioral2/files/0x000d00000001c4e0-60.dat	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe
6088	powershell.exe
4788	powershell.exe
6088	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3548	SpooferCryp.exe
5548	SpooferCryp.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2672	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpooferCryp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpooferCryp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpooferCryp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpooferCryp.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4600	timeout.exe
3704	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2840	schtasks.exe
2052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
6088	powershell.exe
6088	powershell.exe
6088	powershell.exe
5548	SpooferCryp.exe
5548	SpooferCryp.exe
3548	SpooferCryp.exe
3548	SpooferCryp.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	SpooferCryp.exe
Token: SeDebugPrivilege	3548	SpooferCryp.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4788	powershell.exe
Token: SeSecurityPrivilege	4788	powershell.exe
Token: SeTakeOwnershipPrivilege	4788	powershell.exe
Token: SeLoadDriverPrivilege	4788	powershell.exe
Token: SeSystemProfilePrivilege	4788	powershell.exe
Token: SeSystemtimePrivilege	4788	powershell.exe
Token: SeProfSingleProcessPrivilege	4788	powershell.exe
Token: SeIncBasePriorityPrivilege	4788	powershell.exe
Token: SeCreatePagefilePrivilege	4788	powershell.exe
Token: SeBackupPrivilege	4788	powershell.exe
Token: SeRestorePrivilege	4788	powershell.exe
Token: SeShutdownPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeSystemEnvironmentPrivilege	4788	powershell.exe
Token: SeRemoteShutdownPrivilege	4788	powershell.exe
Token: SeUndockPrivilege	4788	powershell.exe
Token: SeManageVolumePrivilege	4788	powershell.exe
Token: 33	4788	powershell.exe
Token: 34	4788	powershell.exe
Token: 35	4788	powershell.exe
Token: 36	4788	powershell.exe
Token: SeDebugPrivilege	5548	SpooferCryp.exe
Token: SeDebugPrivilege	5548	SpooferCryp.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeIncreaseQuotaPrivilege	6088	powershell.exe
Token: SeSecurityPrivilege	6088	powershell.exe
Token: SeTakeOwnershipPrivilege	6088	powershell.exe
Token: SeLoadDriverPrivilege	6088	powershell.exe
Token: SeSystemProfilePrivilege	6088	powershell.exe
Token: SeSystemtimePrivilege	6088	powershell.exe
Token: SeProfSingleProcessPrivilege	6088	powershell.exe
Token: SeIncBasePriorityPrivilege	6088	powershell.exe
Token: SeCreatePagefilePrivilege	6088	powershell.exe
Token: SeBackupPrivilege	6088	powershell.exe
Token: SeRestorePrivilege	6088	powershell.exe
Token: SeShutdownPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeSystemEnvironmentPrivilege	6088	powershell.exe
Token: SeRemoteShutdownPrivilege	6088	powershell.exe
Token: SeUndockPrivilege	6088	powershell.exe
Token: SeManageVolumePrivilege	6088	powershell.exe
Token: 33	6088	powershell.exe
Token: 34	6088	powershell.exe
Token: 35	6088	powershell.exe
Token: 36	6088	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2672	2252	SpooferCryp.exe	89
PID 2672 wrote to memory of 804	2672	cmd.exe	91
PID 2672 wrote to memory of 4600	2672	cmd.exe	92
PID 2672 wrote to memory of 3548	2672	cmd.exe	93
PID 2672 wrote to memory of 3704	2672	cmd.exe	94
PID 3548 wrote to memory of 4788	3548	SpooferCryp.exe	95
PID 3548 wrote to memory of 2052	3548	SpooferCryp.exe	98
PID 5548 wrote to memory of 6088	5548	SpooferCryp.exe	102
PID 5548 wrote to memory of 2840	5548	SpooferCryp.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SpooferCryp.exe
"C:\Users\Admin\AppData\Local\Temp\SpooferCryp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_oeSD6ycHRgC2Bd0LqgMkT6kGBqxSgp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:804
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4600
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "SpooferCryp" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2052
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3704

C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SpooferCryp" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe\"" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\stuff.dll
Size 11KB
SHA256 db4f07306bbddcc664051ee53db6f37f343f01bab6da7276cf1b600adcdfdf72
MD5 eb03b793d6b1097db7140fb35b180d1a
SHA1 a0217992399a54f32eb7b2bbfdfc9386bbf9bab9
SHA512 0a720886062f2edd6b21c3127c1f7c5c13f343072f80abb20ea25e5862c8e1d69a8de972b889f17da68ef692458ce1c46be38da97bc88255e6614414e9519b26
SSDEEP 192:MMHv3q/MgUd1q1BKX80YzCjD/WxM078iZW6LvEXzKSf5V0ux/qM8Z:Mwv51q1ymQoM078eW6AXzKsVrxtG
TLSH
T1E232181D5704D22FDABD0B3CB8A297652732F695A513EB8F2CC8A4BD695B3A406013E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zwnim3mn.mvd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zwnim3mn.mvd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SpooferCryp.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\SpooferCryp.exe
Size 1.3MB
SHA256 2e7a6cb0a10e6ef1e85e3c2d111c59fb62eba801084b9ca090a465accfb15034
MD5 787bd4789576214c546a86196a064783
SHA1 98d980dcb5ce3e5867f37340910fed5b33d63d15
SHA512 6d28ab816ac6f6c3021e5eddc398642083866b7106b87e8506e6a517c237b7483fe31b7791a7d75be884ea460f2245ee91db513238d93e8b695a3a22a7e882ba
SSDEEP 24576:UKqUXSrtv94TP0lRRkxYcxMNnyFoBOkA6s4JbBN:4dsclR0BxMsaRw4JbBN
TLSH
T1D555E05C37F88A18F2BF4BF4A9B0545A17B1FD539C52D76C18A664EE04B2F44EA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_oeSD6ycHRgC2Bd0LqgMkT6kGBqxSgp.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_oeSD6ycHRgC2Bd0LqgMkT6kGBqxSgp.bat
Size 546B
SHA256 e0affa28708953519434bae598ea4ff03cfd4d14741ffc833b1efe65b0f1f859
MD5 b5932e26c24bedcaf4fef9380f4eeb60
SHA1 46dabed7a6e30205a181e8f4563802176a785fb3
SHA512 44323d8cfae8c8928d5b7259de3e5f83d149e26d7bf905e7f44020bd7eec45307db0dec615814a3d9acae3da0e7fc47d7ca0bf1b5f09c84ffa64a9cb3fd11231
TLSH
T198F0591232AE435904E450370EBF318DC0E5885B7FCC7A41BB34C91A179601BA6C37C6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2252-28-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/2252-0-0x00007FFE508EF000-0x00007FFE508F0000-memory.dmp

Download

memory/2252-1-0x00000278DACA0000-0x00000278DADF2000-memory.dmp

Download

memory/2252-57-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/2252-54-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/2252-48-0x00000278DCD90000-0x00000278DCD9A000-memory.dmp

Download

memory/2252-59-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/2252-24-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/2252-23-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/3548-82-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/3548-84-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/3548-83-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/3548-123-0x000002B5FAA90000-0x000002B5FAA9E000-memory.dmp

Download

memory/3548-90-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/3548-118-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4788-99-0x000001883A1F0000-0x000001883A20E000-memory.dmp

Download

memory/4788-101-0x0000018839FC0000-0x0000018839FCA000-memory.dmp

Download

memory/4788-100-0x000001883A210000-0x000001883A2C2000-memory.dmp

Download

memory/4788-91-0x0000018839E00000-0x0000018839E22000-memory.dmp

Download

memory/5548-119-0x000001A12CF60000-0x000001A12CF6A000-memory.dmp

Download

memory/5548-120-0x000001A12D560000-0x000001A12D614000-memory.dmp

Download

memory/5548-121-0x000001A12D730000-0x000001A12D762000-memory.dmp

Download

memory/5548-122-0x000001A12D710000-0x000001A12D72A000-memory.dmp

Download