gomorat | 927048cfd3cdea496d5428e24005f7fa69c7570c5dee833fc12aa73e98b26ba7

Analysis

max time kernel
19s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clanhelper.exe
Size 23.0MB
Sample261027-3cvm8av16q
SHA256 927048cfd3cdea496d5428e24005f7fa69c7570c5dee833fc12aa73e98b26ba7
MD5 333e35c4ce1288bb1d4b32c4df6a340a
SHA1 7167504ae98358fc24cc9efaa81db156cb6b7ef0
SHA512 7ee7507aad3475dc6dee5f52bee976a1a8572ed203881b1af686ac90f1d5910f620c930d60bff7a64b185e221e977e636125f97596f75a36469627ed9cc58396
SSDEEP 393216:51AlyjPZE34JatgKibuf7EEUmAMR8Kwzy9dHa1MxbUByXQp6orVBjD:5CM+ODKoEUmlsz+dHa1GbvQ9n3
TLSH
T1843733685BC58554EBA3207CC9554111DB707BA29B02F7DF334082610A13BE9EA7FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code costura discovery execution gomorat packer persistence privilege_escalation pyinstaller rat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20811

Mutex

@junk_code

Attributes

antivirtual
false
certificate
a6xyahzwffyn0
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
0myuvc3vuwzqdv1
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
7yoa2b5nda4nsvg
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClanHelper.exe	clanhelper.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x0rzt3xvvkym95v22.exe	clanhelper.exe

Executes dropped EXE 3 IoCs

pid	Process
3332	ClanHelper.exe
4540	ClanHelper.exe
1124	x0rzt3xvvkym95v22.exe

Loads dropped DLL 18 IoCs

pid	Process
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe
4540	ClanHelper.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
1	api.ipify.org
2	api.ipify.org
10	api.ipify.org

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/5480-601-0x0000020BCBD80000-0x0000020BCBDF8000-memory.dmp	costura

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c559-9.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4188	cmd.exe
2616	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	x0rzt3xvvkym95v22.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	x0rzt3xvvkym95v22.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5576	schtasks.exe
988	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	x0rzt3xvvkym95v22.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3332	4824	clanhelper.exe	89
PID 3332 wrote to memory of 4540	3332	ClanHelper.exe	90
PID 4824 wrote to memory of 1124	4824	clanhelper.exe	91

C:\Users\Admin\AppData\Local\Temp\clanhelper.exe
"C:\Users\Admin\AppData\Local\Temp\clanhelper.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\ClanHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\ClanHelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\ClanHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\ClanHelper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4540
- C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\x0rzt3xvvkym95v22.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\x0rzt3xvvkym95v22.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" 471|k65uYzl+WBZ/PR/gv8yAwbCR8MRj9OfkmjM6mIiR79h0E1bXX3DjSl2tI6T9vyXkWindowsControl472|3yUvBscD9xGMLyed3BHSlLaR+XL/fUiOn2eSXpS0CsY=C:\Program Files\junkSearch.exe" enable=yes & exit
    3⤵
    PID:3976
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2616
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4188
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:988
- - C:\Program Files\junkSearch.exe
    "C:\Program Files\junkSearch.exe"
    3⤵
    PID:5480
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      PID:1780

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4160
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1888

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4796

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3468

C:\Windows\System32\userinit.exe
C:\Windows\System32\userinit.exe
1⤵
PID:1452
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4636

C:\Program Files\junkSearch.exe
"C:\Program Files\junkSearch.exe"
1⤵
PID:5660

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4496

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

start2.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
Size 3KB
SHA256 ba0c031add7b8aff7d3389c1cc07b144e3b91877bff5c3102fd266fa5b407f2d
MD5 2bdc93c6058a47ee674525f962a70de5
SHA1 5c25f663d6d1c37f42a8c4a774a3f4fc4bcda51b
SHA512 db026cb49fce5179a9c7fd329db2feeb57cf06af8ca068133df4a3fc1e1b4116a2248799532cd2b9d0f084c6f89abbd82b921f89844ae9d9424fc52a1923ed97
TLSH
T12C713B064D7A37380ABCA9C44BDBBAC76953A10CB44E612273312E64F70E6A3156CDD7
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SV87K2N5\microsoftwindows.client[1].xml
Size 96B
SHA256 a3f7e8a7b29dc88b19516ac0839b609229ba6bd4c3a96f86b9424b9478132de8
MD5 3a5b7723b9d919037fce3add1e4211d0
SHA1 7c9d6b329afeffd0f1ebc5eac2cc5724e9657a6c
SHA512 02052307c7297bd184f33e4bca47fb3a05a1bc919c32c58b77b9ab059e6b83ad3b7373000346a1c7411cf205b53a73c623662b05f58b818b676c5b1b88be534e
TLSH
T157B0125135484D2C564449F53F0D60F032ED00865205B57A74E4BC05BD86D0BD421CE1
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_bz2.pyd
Size 84KB
SHA256 37cbaeff9be4494f682eafe4adb642178f9c7277d4cda9ec343cfc06849a263b
MD5 e3035138d1373e96e169e4c446b18e76
SHA1 101cd23556bc0a8c4728460c4bf0bd15fa0f3d7e
SHA512 935bafffde5f9e90f866533c863087fdca6df0e176906aad2c7fef4325df2eeb4ae2bc4eaa24096425679c2196feef48c0061392fd5b7a13d5957d37f93f4c47
SSDEEP 1536:8ssutY90GtePwhFjKjBSnLYK9EJG8jKMi+gIP3VQyjKdLi92t+fIzoG4Zbu:btw0GtePwbuByY2SxuMi+gIP3V2t/EC
TLSH
T109835C52AB7416BAF22B917816B043A3F730BB65172057EFB2C485552F13FD1AE303A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_ctypes.pyd
Size 139KB
SHA256 746cf693e04ceb5f5468cbd7d1cbd535403693e421dad0d34ff77a25b171bc20
MD5 d9613a6cc7eeab428957c666ecdcb8b3
SHA1 ed9ac7f748a1000ba886490f3477d97602f4f4d2
SHA512 c70af6817bd4053a251364d436470e4f18d6637fd8684a3a9ab0e8da060f7f5aad06b1ab90d35ed7f8ccb4cbc4b755361d7b8e56357dc8e2e7c7bb688be643a4
SSDEEP 3072:a+oHacqjRXPAuvs2FisZiY70m6FrpOEOq57ze3zxOE8pN3z3xYZjEcIPGP+JE:5nY6i6QreM7zOgT3kjEk
TLSH
T141E35B4B739800A6DB638178C5B39A47EBB1F4516B2053CF0164C99A2F637E2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_hashlib.pyd
Size 71KB
SHA256 7ef6760838a5496b47ec3f5a463672e27e23cb9477d20fcde3abf1f41cb3a62f
MD5 fd912ae98419075e627f70a2919a6127
SHA1 05ff86214ceb758cdff3c7dcacb512bca4579ce8
SHA512 2ef23e80a70049f7ee3f5b2f1742d16dfbfff445df5e27d827ef89ad671ba9855beef4d3cc23de336580c885184fd3be32082d0fbd1b05e4b70452acd3f7f684
SSDEEP 1536:GYa6mLMlYAiZkT303dFtFt1ABIL06YIPDIWyjKdLi9YfIERxO1:wMWAxIFtFt1AqL06YIPDIDJ
TLSH
T1EB636C56964800A1E96381B4C9E34F87E936F662271097DF63A8C18D2F237DBE37A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_lzma.pyd
Size 167KB
SHA256 cfe42690aac2065f94d9e7df8cf53c523fdce787b9cb1593abe0190ae1d5891b
MD5 008e6abc565ed25cfadbdf61cf81dc3e
SHA1 6288e84fa1436348cf615550283ccedc5ef0dd25
SHA512 401f346436ef67a980e8e8dcd8e4d303374129000a174fe027d535775ba45cc0fba7f4ef1fc24b1d7a82fa7076d7bf91e4f6a0753c04e466d7e64910818e1ad3
SSDEEP 3072:3sRr+8GAgJ6wLtOGq8YQpsrL0znf19mNoDx5PExmP+gIPI1Ug:3sRr+MgJ6wB67Q0qtYODvE4Wk
TLSH
T12BF32991B258F0D6F3328C34CA964F63E6F97805432092DB018D977D6A2FBE59A76313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_socket.pyd
Size 86KB
SHA256 a8a469df1c4fadfad6a72d379e1af7591e552c9c24aba0ca3dfd8e2ba8bfdb91
MD5 2466924026b846b9dd3049a55405972f
SHA1 e5144b9c4e33355b36b80c010c877aa3f4fb66f5
SHA512 a23ae0c389785b480c02fa91c71743a7f4f267c8740b3edbd5a7fd628ee558460cf47067df4cd755fe294e85e0a8bb32483cad9c3101cd6cc0e6b330b09e33eb
SSDEEP 1536:ZTFMxL96MDsyiuK7Oc4M0ypYHiXA+6Xwwzckrf4PcktcIPGwfHyjKdLi9kfIE14:TelsGK6c4HypYHiXAzXwwz1D4EktcIPo
TLSH
T1ED835901A6A041F6EB729175C2638E63FF74B4C11394A7DF1466C65A1F333C2BE3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_ssl.pyd
Size 192KB
SHA256 6ed057907738947eef7e78076d3b2b137b7d1b8c925d19b1b04b520614d23a7a
MD5 b31776fb765e479449ad081053669bc5
SHA1 97e15b46d2040e144c299ad449c34251a37c881b
SHA512 6f9b64fbbf87d8bc47d69dde2e45e20f4a87d8280aba1541858c9eda4d36743933c548c8e90d029179b6e091cca2fc0ab5e8c04f716c809daf5976bbd0ab40db
SSDEEP 3072:Ugci4V8O3dTrGPMLfIh7ifsjjK6pGs5kL2L+1kTPzXClity1Q5MFe82Iu5tyFjU1:Mi4VNt3ACIh7ifsjjsFp682GA
TLSH
T1EB145947B1945AB7D912E5F9C6234543FBB4F004331297DF48C6D9A20E03787AE7AAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_tkinter.pyd
Size 69KB
SHA256 042bc50f00c42fb307ec00ec95cb7fd7d25bcb7119c30621d363099cad9df9d1
MD5 3fd1f13f0c9b1e5db15c728a4d6d7ede
SHA1 ed7c80a742361fa3e0a92d387013af4a8ced7dae
SHA512 c4b7828257380f0714c5e0e0f0d900c1bc45e7487b7ba116dd7661c2294427abca5f734e4905158df16e83dab7d2174ed4206ed213c3862a7784fcb0c3c91cd9
SSDEEP 1536:ZhyLLAFL5ujO0C6sWRMFW233gfj4cL2YIPDSbyjKdLi9iofIE/s:ZYLqLUg6sJ9Afj4cL2YIPDSXpd
TLSH
T12F636C4A7364009AEE63957CC9729E57F675F5520B2082DF01A0D35A2F333F3A7BA618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\_zstd.pyd
Size 494KB
SHA256 229e2029d167490a4fc95def7ca1670aee358a732cae13285478e74b8ce2f1d1
MD5 4823a9040f63d6cc4cc158d01001f590
SHA1 c88639308123386222924839700f5221a07f351b
SHA512 c4235f15f7d2a060f016a734e32a6e71995618e60fabf689538995028e9d45e026b70b62427d61914c458b7d24c1927d38115ae87d5f3b2f6605ed54b3aba882
SSDEEP 12288:j8c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEg5BCl9VEHS:j8DMn0tWRkBFuYHDtS
TLSH
T1E2B49E43F25943ECD437C4B4CA5A9613FBB6B84A2214525793A5DFA83F03B31DB2A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\base_library.zip
Size 1.4MB
SHA256 73440c5a9e011a5ed826912a782720fee3ae4689bcb6ba8f07601a9db4db3c45
MD5 86f6f54a0c84f6f084b0b01d89131ab7
SHA1 c12d315858019dad283e7f95ade09bf0c1fcac88
SHA512 917d5a62ab57a69f545ff5d892564ed5008d261fbb3155979b9c538600a82a7acb667f5443ff32800aadbe216cd3ffe62e32044325c6a91c2448fc49c5be7938
SSDEEP 24576:MxeGXP2m25ap5cote9z8V7sx7QF7xJpFwC2Zx6:Mcse9z8V7sO5rpFJR
TLSH
T10F653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\libcrypto-3.dll
Size 5.7MB
SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
MD5 b306c000f2b892736f0e66d265c61876
SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
TLSH
T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\libssl-3.dll
Size 1.2MB
SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
TLSH
T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtommath.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\libtommath.dll
Size 93KB
SHA256 1e6070bbc991be96feb82d6dce7aa84d9bfe644b71f7e599b9b89ff0249dd076
MD5 d211f7ad1fbd82097d6cc905c55a78bc
SHA1 b9eb8f26717d255482cca171625f513bafc83fd9
SHA512 46d63c52ce8f0667c651906d673665cf7f21158b350fed35221c2b73accce1f7eec48053cb1a9a37a30afaccfdf1c0641e1d35ef3aede33d52f46fd3cf94d81b
SSDEEP 1536:E3RaimSoWEBrh2as3iwaOasKuWoSvMD9NNDyjKdLi9mNfIzo/9:aqWEBkL3iwvrD9NNm4
TLSH
T1D1936B4BF6C620FFC45AD5B2C3069313A672B9638B26AADF12016E651D16FD06F3F214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\python315.dll
Size 7.5MB
SHA256 ca4f7b4823ca187f4a6483fba9f21804390a183b783ee2bf9b5ab75d98f62c3b
MD5 3a9d7ffd3b407879f13fee566e523e62
SHA1 8e4b7dd597608f8e421995fd980452eb199731be
SHA512 de27b06ca9ad246bd10f9d6921f7bd4ea53558fc889f59111ad9a7072302f055ca8f9ed55b7dba5b850d3e5fe47de8c35d9eadb422a29c8590966511d4bd1444
SSDEEP 98304:3RFyy6m+gxchUIywFr8dyGL2MOa5FuEhv5HDMiEp0+J:3RFr6thUIyw18dyNMOOyiF+J
TLSH
T1D5867B3A73A511A4D87BC036C5434647EBB1BC10AB20D2CB52547A9A2F337E35BFA725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\tcl90.dll
Size 3.2MB
SHA256 6f2e8b20574a5e34856831bf3b9d12156de1df6287a92def69205e13396e3cc6
MD5 5a2a788fe473908f5586187e0f22d65c
SHA1 96ebceb1ad8bd67316b8edba70d6f9035687536e
SHA512 2a9b0372a528a63d01fcf214b8bff229fc8c6761ca237d7eab4459372d0772fc12cf1c526728bde97cfbd94aa0e78cbaa34d9e315e50b1c33bc1874d161e44a3
SSDEEP 49152:pLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugl:tWrPOVNFFvsJnNKfXAqRGYYM
TLSH
T16BF5AE46EBA40068D5B7C27CC61ADD4BDFB274581364AADB14E05B612F73FD2237A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl9tk90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\tcl9tk90.dll
Size 2.1MB
SHA256 79f039ba6c719024a882f93bfd54630eb16c3ff5db53a66424dabb4166ccaa03
MD5 e24d8d50d809bc0b656de92a8650d7f3
SHA1 17c117e439e325b48d7fe372e1580b609561e4c8
SHA512 0c4217f0bea0a8a397b515eb7f923ceca525c173a9bcbd91c44ba326b10a0f969d65af105dda5a353d6cc6e5f9d146229bd766ea9b1368ba29d45f788512f706
SSDEEP 49152:k/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6k:is7+8JToVH+MG
TLSH
T152A55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d042\zlib1.dll
Size 114KB
SHA256 0be8513f1860df4fcf9895247ec36365b814c4fc5eb9fcf205c10218ce21fa74
MD5 05d20a1b7c9e889d0d5389798a08b9c5
SHA1 07149aae5db5695a0f4b582e74c02ac3c94f235b
SHA512 2645dff5426b7aae5a62b82de219e453a8303ea3c26b1cb13ee626e9e244136f6f1e85d792b8ad47605545d9c07436c84fd2c27f531b86b80a146ce97416ea63
SSDEEP 1536:8eKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fBef:LNGH+X34najvon8PVh2FXws+ZGme
TLSH
T11EB39E87799620AED5B7C230D6E65B22F67538400B2C5BF74285D3A42F02BD06F797E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClanHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\ClanHelper.exe
Size 12.5MB
SHA256 e5127aae294540e8f44384a3840bdbfca6da9380283f6b7b5d3559356e604500
MD5 65f6860a4631abaf872b8079f27af5bb
SHA1 27adc98ce7602dba1befd0b7f07da1677d37ad21
SHA512 c35f3d7c0a69729357cf788556b9bed44d86e133f38142e6b343ab7d02d0e0eb26015ccf202b4faf67bc5f462c62fda48eefcb2f252928d9c6660db952338a54
SSDEEP 196608:Xs1AGwtyjp7qejDFE3XIJatglMo3buWxu7tqNNI8lZfE9Ay9yW6tOuMRPDDsBKCU:81AlyjPZE34JatgKibuf7EEUmAMR8K
TLSH
T1B5D633E8E38445E1D8B7E23C95A6D965FB72FD2503E085EB02E006542F67BD18A3CB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x0rzt3xvvkym95v22.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_9c04d190\x0rzt3xvvkym95v22.exe
Size 522KB
SHA256 d442c074f34ed1b6f2a15696caa0ba53c7bb156b7f2040a4c02040c0b94c6602
MD5 edc87967a726908b3a74f3aef3284a1d
SHA1 4fbb85f8c6e807cf686f0a5d31286f3f1986e708
SHA512 9ad8968090621b17ae009766b2ae08d12f4089d599879d2cebe2bba50de8fb2935db2f92670ef8e116dec981a028ef89e7ed4e2a2baf04c4dc98557522e51eac
SSDEEP 12288:vPgo9OFBBWAGaxU/lq76j/HA45kqoTRv:NoqDjvx5u
TLSH
T17CB470181FD58910FB96287CD5450151DB746BB2EE02F3DB3600C2654912BEEEA2FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2098e080cf7ac4.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5a2098e080cf7ac4.automaticDestinations-ms
Size 2KB
SHA256 4e1704f987eef0d458282d45137ffa31265c2cc21236c398f5afc59b3c8a785e
MD5 d19fe709669ffa05716fbedd8400c4c4
SHA1 cf97f8d5dc8f99ea12dbc1b51c9afe2c22cd2afd
SHA512 a1dc8471f26ac5127fd82d114aef2b1a3961ddff490b0fd35eaf4c423981852b2df1deaf440748d4357311b97f5903b2dea6b5219e270e9e2a738fb10ee6b94d
TLSH
T13551921533E8E569E0A09F364DB2C445E7317D52AD05F50F72D5738F8CBA280E4B8356
MD5 SHA1 SHA512 TLSH

Submit Download

junk.dll

Path C:\Windows\junk.dll
Size 58KB
SHA256 bd02435863c792fd6247bcc1242b12dca250a7db42cb8aa3e41170880881dadc
MD5 88d445b30fc32e4a1b6fe53db49f5ff6
SHA1 87366e344396404b30f931c630abca7d4e6119f1
SHA512 479f7de0792a1d9956ec9cf690c472abbef9405893465c0ac28874e94dc4120e5654a46e1ecb25ad0b3a80d139867e56084b7fa4907afe6e6622e2209d0e2382
SSDEEP 768:mtNeUfJUebok/W3WJh+K7zCFLzjm3dJOFet+e9aP:sffJtnDMz2OFet+eAP
TLSH
T16B4381E1BFD55DC7EE40633C23E99222277DF9E486424B1B64386A311B13FD039E964A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-269-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-90-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-81-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-51-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-82-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-91-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-92-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-94-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-93-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-95-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-96-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-97-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-343-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-315-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-52-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-50-0x000002A4EAD10000-0x000002A4EAD98000-memory.dmp

Download

memory/1124-114-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1124-313-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/1452-357-0x00000292A9290000-0x00000292A9291000-memory.dmp

Download

memory/1452-356-0x00000292A9290000-0x00000292A9291000-memory.dmp

Download

memory/1452-350-0x00000292A9260000-0x00000292A9261000-memory.dmp

Download

memory/1452-351-0x00000292A9260000-0x00000292A9261000-memory.dmp

Download

memory/1452-352-0x00000292A9270000-0x00000292A9271000-memory.dmp

Download

memory/1452-353-0x00000292A9270000-0x00000292A9271000-memory.dmp

Download

memory/1452-603-0x00007FFED1000000-0x00007FFED1016000-memory.dmp

Download

memory/1452-354-0x00000292A9280000-0x00000292A9281000-memory.dmp

Download

memory/1452-598-0x00007FFED1000000-0x00007FFED1016000-memory.dmp

Download

memory/1452-358-0x00000292A92A0000-0x00000292A92A1000-memory.dmp

Download

memory/1452-355-0x00000292A9280000-0x00000292A9281000-memory.dmp

Download

memory/1452-359-0x00000292A92A0000-0x00000292A92A1000-memory.dmp

Download

memory/1452-361-0x00000292A92B0000-0x00000292A92B1000-memory.dmp

Download

memory/1452-360-0x00000292A92B0000-0x00000292A92B1000-memory.dmp

Download

memory/1780-428-0x00007FFED1000000-0x00007FFED1016000-memory.dmp

Download

memory/1888-342-0x000000000DD60000-0x000000000E5DB000-memory.dmp

Download

memory/3468-140-0x000001C183960000-0x000001C183980000-memory.dmp

Download

memory/3468-180-0x000001C194210000-0x000001C194230000-memory.dmp

Download

memory/3468-150-0x000001C183CD0000-0x000001C183CF0000-memory.dmp

Download

memory/3468-134-0x000001C1801E0000-0x000001C1802E0000-memory.dmp

Download

memory/3468-141-0x000001C193EB0000-0x000001C193FB0000-memory.dmp

Download

memory/3920-437-0x0000020F82A10000-0x0000020F82A30000-memory.dmp

Download

memory/3920-456-0x0000020F82DB0000-0x0000020F82DD0000-memory.dmp

Download

memory/3920-470-0x0000020F94290000-0x0000020F942B0000-memory.dmp

Download

memory/3920-424-0x0000020F801E0000-0x0000020F802E0000-memory.dmp

Download

memory/3920-438-0x0000020F82E50000-0x0000020F82F50000-memory.dmp

Download

memory/3920-423-0x0000020F801E0000-0x0000020F802E0000-memory.dmp

Download

memory/4636-599-0x00007FFED1000000-0x00007FFED1016000-memory.dmp

Download

memory/4636-600-0x000000000E6E0000-0x000000000EF5B000-memory.dmp

Download

memory/4824-27-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/4824-44-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/4824-2-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/4824-13-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/4824-1-0x0000000000B20000-0x000000000182C000-memory.dmp

Download

memory/4824-0-0x00007FFEB9D0F000-0x00007FFEB9D10000-memory.dmp

Download

memory/4824-113-0x00007FFEB9B80000-0x00007FFEBA524000-memory.dmp

Download

memory/5480-601-0x0000020BCBD80000-0x0000020BCBDF8000-memory.dmp

Download

memory/5660-597-0x00007FFED1000000-0x00007FFED1016000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads