salatstealer | bdc6af65b3c5c5d2519e0a2798f9445a522806ded006a3c8c0134e481dbb5692

Analysis

max time kernel
151s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/DiscordFix.exe
Size 11.3MB
Sample261030-afv4yahs2q
SHA256 bdc6af65b3c5c5d2519e0a2798f9445a522806ded006a3c8c0134e481dbb5692
MD5 cede917005058b4c75682694354b3c46
SHA1 6d7a8909520bd5df04c39438063cde734d31ddba
SHA512 985e5d83d61c0f7848503941fa89a37eef45617061ba6127839aa0a18e4cc1cda32c9ac3792c03123ede0a90924025ec0afb6e384dead3fc7acb0fa98b0dc482
SSDEEP 196608:tPftGlpclSD4sHtmNLHI5PtCca/S5FcnTRwxhTSOP21iCgf6N:tHQpMTsHtmlHIqca65eTRwPSOmiC+q
TLSH
T1C1C6AE03ECA515E5C0ADD6318A639622BB617C895B3123D72B90F3252F77BD0BEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00160000000115bb-2.dat	family_salatstealer

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
19	1624	powershell.exe
20	1624	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	1624	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Mozilla\dllhost.exe	agent_AYRYiHCT.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Mozilla\dllhost.exe	dllhost.exe

Executes dropped EXE 7 IoCs

pid	Process
4896	agent_AYRYiHCT.exe
4248	dllhost.exe
1936	dllhost.exe
1244	123.exe
4512	Staem.exe
1876	Staem.exe
2496	jkzwflxwxyyf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\SteamWorker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Staem.exe"	Staem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\SteamWorker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Staem.exe"	Staem.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
20	raw.githubusercontent.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1464	powercfg.exe
5168	powercfg.exe
4868	powercfg.exe
5004	powercfg.exe
2712	powercfg.exe
4592	powercfg.exe
2116	powercfg.exe
2112	powercfg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 set thread context of 5700	2496	jkzwflxwxyyf.exe	125

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5700-73-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5700-74-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/5700-72-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\1b86d2fc-f71f-96e6-e4cc-2fdc1519fcf7	agent_AYRYiHCT.exe
File opened for modification	C:\Program Files (x86)\Windows NT\fontdrvhost.exe	agent_AYRYiHCT.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe	dllhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\1b86d2fc-f71f-96e6-e4cc-2fdc1519fcf7	agent_AYRYiHCT.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\dwm.exe	agent_AYRYiHCT.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1864	sc.exe
5640	sc.exe
4716	sc.exe
2376	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_AYRYiHCT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_AYRYiHCT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_AYRYiHCT.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	agent_AYRYiHCT.exe
4896	agent_AYRYiHCT.exe
4896	agent_AYRYiHCT.exe
4896	agent_AYRYiHCT.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
1624	powershell.exe
1624	powershell.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
1624	powershell.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4248	dllhost.exe
4512	Staem.exe
4512	Staem.exe
1244	123.exe
1244	123.exe
1244	123.exe
1244	123.exe
1244	123.exe
1876	Staem.exe
1876	Staem.exe
1244	123.exe
1244	123.exe
1244	123.exe
4512	Staem.exe
4512	Staem.exe
2496	jkzwflxwxyyf.exe
2496	jkzwflxwxyyf.exe
2496	jkzwflxwxyyf.exe
2496	jkzwflxwxyyf.exe
2496	jkzwflxwxyyf.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	dllhost.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe
Token: 36	1624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe
Token: 36	1624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4512	Staem.exe
1876	Staem.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4896	1092	DiscordFix.exe	90
PID 4896 wrote to memory of 4248	4896	agent_AYRYiHCT.exe	93
PID 4248 wrote to memory of 1624	4248	dllhost.exe	94
PID 4248 wrote to memory of 1936	4248	dllhost.exe	96
PID 1624 wrote to memory of 1244	1624	powershell.exe	99
PID 1624 wrote to memory of 4512	1624	powershell.exe	100
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5760	2496	jkzwflxwxyyf.exe	124
PID 2496 wrote to memory of 5700	2496	jkzwflxwxyyf.exe	125
PID 2496 wrote to memory of 5700	2496	jkzwflxwxyyf.exe	125
PID 2496 wrote to memory of 5700	2496	jkzwflxwxyyf.exe	125

C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\DiscordFix.exe
"C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\DiscordFix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Roaming\ReceiveComplete\agent_AYRYiHCT.exe
  C:\Users\Admin\AppData\Roaming\ReceiveComplete\agent_AYRYiHCT.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Local\Mozilla\dllhost.exe
    C:\Users\Admin\AppData\Local\Mozilla\dllhost.exe
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Badlisted process makes network request
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\123.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1244
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:1464
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:2112
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:2116
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:4592
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "HRMYUBXU"
        6⤵
        Launches sc.exe
        
        PID:2376
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "HRMYUBXU" binpath= "C:\ProgramData\guvcbwwwriko\jkzwflxwxyyf.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:4716
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:5640
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "HRMYUBXU"
        6⤵
        Launches sc.exe
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Staem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Staem.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\Staem.exe
C:\Users\Admin\AppData\Local\Temp\Staem.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1876

C:\ProgramData\guvcbwwwriko\jkzwflxwxyyf.exe
C:\ProgramData\guvcbwwwriko\jkzwflxwxyyf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2712
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5004
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4868
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5168
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5760
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

123.exe

Path C:\Users\Admin\AppData\Local\Temp\123.exe
Size 2.5MB
SHA256 f4884d33d4b854f5c257198d5c4a8a8a07303bba85d82b4bdbb59d4280dea386
MD5 0dc9fdceaac22cf73b67996c09f948f1
SHA1 049d73151e80e08eb659d6cdfcf5f4ec2b4ca856
SHA512 b63d65c2bb3d965956ed207d9d505e0ef8f1ea18ff1ea219345d9707e52c289c8d4563a74cccbecaa8749eeecd70af0b4ac1d6dea69992b44c2f4b8c1111470e
SSDEEP 49152:VfCw9JOeZ4ida2+G5Gds83KSQfW/1qckLdx5:VfCQlyid3+G5Gy86SQfW/1qcSdx5
TLSH
T114C53346A200E6FDD89551782C4A2E5B384F6283D3EDA1F36FF0C138A1546DE65B8CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staem.exe

Path C:\Users\Admin\AppData\Local\Temp\Staem.exe
Size 1.3MB
SHA256 799caef85e443f4ce857587de247f28b90f5bc5173be676be34072db6cb02601
MD5 ccbf63d0e43fe52b6248ec521a3ea9ff
SHA1 67c2b8f8bafa5e802154f434ff3096ff076aa29d
SHA512 1e933b8884d33eb7e9980da8e7ce6a00e1a8db65c46a6b7ca48be65661f4bb06579198de3e7de803eafcd708af1fda9f7509e5f1bea399359d5aa0596f67277b
SSDEEP 24576:cs54fAy404EW0x8vs/oKz0EGCr+I/MfceLicIfFih39Ewb/onfvsdo9:cXAy4p0SsgW0nI/n4h39Ewb/onQo9
TLSH
T11955AE4673A406E4D1B7D23986969F8BE6713C150720A7DB03EC62992F337E14A7F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nqkstfja.xvd.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqkstfja.xvd.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_AYRYiHCT.exe

Path C:\Users\Admin\AppData\Roaming\ReceiveComplete\agent_AYRYiHCT.exe
Size 12.0MB
SHA256 e1c6dea2243dd7a0f862a1eeb7a520d742966f8433f81da185eaea8c2b4c5088
MD5 0b4c14215f0ba5ebbf261ee2557534b1
SHA1 4ca6ebaf90d9662edaa292ec0c7d8d45f47188af
SHA512 222d5ef203af12a34035717e3aa4fca6e28031e4bd9d204b5822ccf52f33d57c9efb22df4093c10904bc0b904c884aa2cb7ca83d7c9d06d76404ceb52efb58a4
SSDEEP 98304:vOPx8QETY4C2uMbZlg6XBJ4S3HVduETO/:m8AQukzdJTRTO/
TLSH
T1F0C65B11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-37-0x0000000007D90000-0x0000000007DAA000-memory.dmp

Download

memory/1624-36-0x00000000083D0000-0x0000000008A4C000-memory.dmp

Download

memory/1624-20-0x0000000006300000-0x000000000665B000-memory.dmp

Download

memory/1624-23-0x0000000006760000-0x000000000677E000-memory.dmp

Download

memory/1624-24-0x0000000006800000-0x000000000684C000-memory.dmp

Download

memory/1624-28-0x0000000006D00000-0x0000000006D48000-memory.dmp

Download

memory/1624-31-0x00000000708D0000-0x0000000070C2B000-memory.dmp

Download

memory/1624-34-0x0000000007C30000-0x0000000007C50000-memory.dmp

Download

memory/1624-35-0x0000000007C50000-0x0000000007CF3000-memory.dmp

Download

memory/1624-16-0x0000000006130000-0x0000000006196000-memory.dmp

Download

memory/1624-30-0x00000000706A0000-0x00000000706EC000-memory.dmp

Download

memory/1624-29-0x0000000007BF0000-0x0000000007C26000-memory.dmp

Download

memory/1624-15-0x0000000005940000-0x0000000005962000-memory.dmp

Download

memory/1624-17-0x00000000061A0000-0x0000000006206000-memory.dmp

Download

memory/1624-38-0x0000000007DF0000-0x0000000007DFA000-memory.dmp

Download

memory/1624-39-0x0000000007EA0000-0x0000000007F36000-memory.dmp

Download

memory/1624-40-0x00000000082A0000-0x00000000082C2000-memory.dmp

Download

memory/1624-41-0x0000000009010000-0x00000000095CA000-memory.dmp

Download

memory/1624-14-0x00000000059B0000-0x0000000005FFA000-memory.dmp

Download

memory/1624-13-0x0000000002EE0000-0x0000000002F16000-memory.dmp

Download

memory/5700-73-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5700-74-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5700-72-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5760-65-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5760-69-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5760-68-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5760-67-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/5760-66-0x0000000140000000-0x000000014000D000-memory.dmp

Download