salatstealer | 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864

Analysis

max time kernel
23s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT10).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
MD5 9a77b713dc626138ec7421f560716a28
SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
TLSH
T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral13/files/0x000e00000001c4a6-6007.dat	family_salatstealer

Executes dropped EXE 1 IoCs

pid	Process
3720	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5364	certutil.exe
3368	certutil.exe
3556	certutil.exe
5628	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1356	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 5676	1356	cmd.exe	91
PID 1356 wrote to memory of 5364	1356	cmd.exe	92
PID 1356 wrote to memory of 3720	1356	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT10).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5676
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5364
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:3720
- - C:\Users\Admin\AppData\Roaming\UninstallUnblock\agent_wLVcEfeP.exe
    C:\Users\Admin\AppData\Roaming\UninstallUnblock\agent_wLVcEfeP.exe
    3⤵
    PID:3308
  - - C:\Users\Admin\AppData\Local\Packages\SecurityHealthSystray.exe
      C:\Users\Admin\AppData\Local\Packages\SecurityHealthSystray.exe
      4⤵
      PID:2288
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:4780
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:5344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe" -
        5⤵
        
        PID:3128
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:5240
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_qsPZRmMf.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_qsPZRmMf.exe
    3⤵
    PID:4892
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:1524
- - C:\Users\Admin\AppData\Roaming\OpenSkip\agent_WzyWGAEC.exe
    C:\Users\Admin\AppData\Roaming\OpenSkip\agent_WzyWGAEC.exe
    3⤵
    PID:4628
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5628
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:3796
- - C:\Users\Admin\AppData\Roaming\Mozilla\agent_mrLCLviI.exe
    C:\Users\Admin\AppData\Roaming\Mozilla\agent_mrLCLviI.exe
    3⤵
    PID:1780
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=none --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe
Size 2.5MB
SHA256 fc3cf4e418416937674df4c937f9e015297cb94063ce783733fb96672cfda8c6
MD5 febce97dc779495a61124c16abd3fe08
SHA1 b867f700dcb6764f169c76220f294b8559305494
SHA512 a4836a5807c4c2f2ad4b4deae3c6e688c96e7229f77670efb1339812ecebc6da9e053b0614add23e0bbd7f1ebf78e71932532ff7886ea347a7b02959e6289368
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR6:icVUcTedI6C9e96
TLSH
T1F9C5B660EEEFC1F5ED435C30115BB23F6B3526098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe
Size 3.3MB
SHA256 e29b3865cc19137c915cacc61956a765c55f045a66873158f02a0f98e57debd4
MD5 964ccde85d1fa31bf426e33d830c48d2
SHA1 5dcc6734fc435bd6de133041409d76daca23e3d4
SHA512 14c1364a7e76e80df5a34e631154c46414aa4e435da960e772be37cecb7a6db18dc87ae1a96cb1b73f8faee8d4b969e5294be1d03f57e1fc0b2e3bf276d23649
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd73:icVUcTedI6C9e9MA
TLSH
T144F5D564EEEFD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Local\Packages\SecurityHealthSystray.exe
Size 3.0MB
SHA256 061daec14c4e86b2bb775e52862647162e4fb2baa9576a92d75b3f53f0b48e03
MD5 1a7d8aacd7df5fe04a4c37d9342a273b
SHA1 cc0c8ccc0eacc62a799fc7fa2fe5ae971c56a705
SHA512 78b5329485cccea75802783767d1ffb0564bd13d385e2f44eedd962cd3f00d6939469fec494625697d28668af48e9b825847831820b302ad16087f7c1ed54046
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIO:icVUcTedI6C9e94
TLSH
T13BE5C664EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Local\Packages\SecurityHealthSystray.exe
Size 3.4MB
SHA256 06085e4a6b8526d3a24697632fea765272cb2995e1e06920ffcfffaae477d48d
MD5 6b37b92c72b460ae39975b722f811b77
SHA1 b192956868b2919ed8ba8a3c9f2de8f8c85e68fa
SHA512 8eb5df23cb8cb4e8d06fb8f88c3ed04dfc1c1db551b4b37898710de233cfc7f36a4ab49d6056a9d4ce128f0a398256198c8a35d4549ddfc712df7f118a05df31
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7r:icVUcTedI6C9e9Mk
TLSH
T1B0F5C564EEEBD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 5.1MB
SHA256 e10200bbaaca36ff876abbfa80754a23de3b0f5e17c9a8ec9b4d5009a53fa713
MD5 31ae04c2e0a5b95e1b6a5af1f26ef049
SHA1 6fbddebc2d2dd9e716689235bd5dcc0a2db2af90
SHA512 b84585be395c6bef679c6d79bf9670d52575eaad7822ac1b48067e950bb78fb5743655644b60a9458702920c44dd90889fa07423f68aa2f1980da6fbe65efbd6
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eQ:06GtcbPy/lwHVSavaeQ
TLSH
T158464A13ECA555E8C0AED2358A729213BF617C88073123D76BA0F6252F76FD0AD79718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.8MB
SHA256 b98ab70ed4f58a1a38af27425a4d006120c45fafe3fe44d86b258da186061a7d
MD5 2344016b2a093d9cf7fde6a73474ed63
SHA1 ae3c40831673d699ff4bad1e183914b730d33028
SHA512 a443f8a010c2cc2757f1ce5d7a5dd72862ffd9cfd8a20fabddb1d3dbfc0bc89a2f7b2e49379b6eb29a55aa8d9bbcc8b4c63f3075e4d198ab35a05da002d69969
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaW:06GtcbPy/lwHVSQ
TLSH
T14F06F817ACA540E8C0AEC5758B6396237EA17C49073433D36FA0B6211F7AFE06DB9758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 947f43dd61655337e6c8e554d70b9c3644a6bf6333b41124fc4255afd2757248
MD5 d56a7df1d8a8164841df7df316e0f9a7
SHA1 d060e849db291bd11a00f530e53b9b661e1a87d3
SHA512 d0128a07a0539668a48dd0861c65c094b34441f3cafe8d6a042061b457f69f269daac549ea83aef44c35f4a7b4628b7673a85dd31760ba56f34710351b7deead
SSDEEP 384:zW96O3hKoTkCSRCkOqQi98bcgiYjkQz2f4k8+cVcJ2b1ayIU9T:zm3hKoAgUw2f43+cVhx9F
TLSH
T17F92D67A5B056D813F50625BD54940C0FD8CF7EE72E463F23B0F28AC20ADAB95E79194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 8.5MB
SHA256 c5190fbc4da0ffa5ff23ac27532a8789be2afabd42ea3cc2800e35a66353387a
MD5 067d63bfd1c4a1ceb59fac38635e5240
SHA1 3261b1611260180fd12e429cea0924859c95e42f
SHA512 a27f567687369dbd1cb4fb749472f1bc11c6c12ed5963493ec2c3c0b1e80f060886abfff2fe8c05e4d70f099dde0be996dbd7f69d02c8c37b925e1c370d3cfd4
SSDEEP 49152:gnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSycLXypwutu0okH4MmQupp:i
TLSH
T1E196E1721647FDDE5B7A0E44C0093B815DAC7DAB4258E298FEC971A771EA500EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 42f46054bcdeef04288d7fe6219ff4736821ebf73e32d3a9942a8273818e3f4a
MD5 21521c5582de4c0307a55b505c93aea1
SHA1 24199e9f184bce0d0150d6d1dc1561a52d798546
SHA512 53f2e78d7eef6490455e223b3de2943e30825f44067ebc5d6e565767efb16479b83322223e6d9ce59327c8aab65891f084765a70cc512da43d0fe754d1cb416f
SSDEEP 192:6uS8S8z07cziIr8dHnlgSlAtkO9n9iFyxQVUUjVJCBf8JSbjPmG:47cziIr8dHAviF2PWZgHt
TLSH
T14172A7724DC3EC4A1FA25D48F58CBEC17F9EA743A280CD39AA053C6590994589FEC5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 4.9MB
SHA256 4e9591c7792168a7caf9ec3fcbcaf9d07bcef9ece105df827db4ec229e4d502b
MD5 80f3d85e3ca5196f70c838855b8c179c
SHA1 91645a1c9e6a9b80f93db9fdc582a70ee0ffc388
SHA512 daa89953a84e59f96575467c6dd1d2597dc1267c9caf642e49d231869e0f18efab0e888c88835de538de0a1a1bab8df5cec360ae1871b063cac9656925f9095d
SSDEEP 49152:PBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKe:m
TLSH
T16936AE731603FDDA1FAA4D45D00839816C5CB96B12A4D2E4FF4E359B70EA624EE7C8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mygyenc2.r2c.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mygyenc2.r2c.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_qsPZRmMf.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_qsPZRmMf.exe
Size 5.3MB
SHA256 bb78fbcf8d31e064f971a470d54d5674328b1e77b75ead6a8fb49b42f47a2f8e
MD5 9c0d74024c7331e0d8ba8d9f71f90cff
SHA1 0e98815c0ec6cd83948191bbe3f22a2cb6b3bdfd
SHA512 a801a07f463c3e0ad1369008e76d9efb84d5efe700c2c94a8058bd64c152a02d6cb6ad650658b452a5b2f027c04076eee9fdef9e8d2784d9713001657fb58601
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOW:icVUcTedI6C9e9MQR7t+cF
TLSH
T15D46E624EEEBD1F5ED035C30216BB33F6B3516098738DEE7DB901E02E55B6A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_qsPZRmMf.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_qsPZRmMf.exe
Size 4.8MB
SHA256 c50920a76776e084c9c1c35b968c0655e17081f64d170a51d7cf72b646fa87b8
MD5 4aab7a0c96ae5efe08019fcccee25747
SHA1 19d6a6bf274f5110e189a78f4bea98d795994a9b
SHA512 d1664bfaab9ee5dec80c6dab40b293c8c3f835ce1b5249ff55777b5a9251ecdb4afb5d84bec5c82468d61512732012cfc153b5aab65fa58cdba2da8ab8be4133
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+b:icVUcTedI6C9e9MQR7t+b
TLSH
T18436E664EEEBD1F5FD035C30215BB23F6A3516098738DEE7DB901E02E56B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_qsPZRmMf.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_qsPZRmMf.exe
Size 4.6MB
SHA256 9e603fb576d5748b2af4ff8df33ab364067279ad0aa7b5dd4319db6012110a83
MD5 f34ed447a58dc08cab7cb9e85bc364c5
SHA1 0967e5c40ab878ad154c159d25a0223ad0bc0f9a
SHA512 fbdb3d28581d0e6b6ab80d663a4d991e4f1609a109bcaf3f5d25ae6809c986918c99dcf683d8ece21475814f4326ca173e77a1e2a7469903f73f99a8c8b480a1
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV5:icVUcTedI6C9e9MQR7t5
TLSH
T1A826F664EEEBD1F5FD035C30215BB23F6A3516098738DEEBDB901E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_mrLCLviI.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\agent_mrLCLviI.exe
Size 3.4MB
SHA256 5320641eaba9aec85a512d1c66fc2aac1a0515fc539be424f4ce974faa11d4ab
MD5 adc6e4f3a78363ce1443388d3a9c6d80
SHA1 6bd8a28cb77cf811319a179d3fecea7b1ec65200
SHA512 bb6c4c7b1939df49b2b8b662e70c8e758cb749781a66b0bff4d618c03c3306ea3a1aa82ae67af343573d1431483b7fa9adf8166c3effd10a5caf2b32d2c3ba35
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7b:icVUcTedI6C9e9MM
TLSH
T14EF5C564EEEFC1F5FD035C30115BB23F6A3526098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_mrLCLviI.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\agent_mrLCLviI.exe
Size 3.2MB
SHA256 91f5882cc2bc3ffb6cfe8ac6bc31fe47251c2e0849a947b32380fbb5064b7f45
MD5 c915514d60d1ccc1d29da05ededac889
SHA1 d539631fc76bf3ef427a3f549085d19c3c11f51d
SHA512 13b913bf0cc9e69568168362e718a5948594cd10ecaac16fa9961f5a621cbea2b739419fc69cdf425e479d01728d11f9f465a1895d526443bfba50664c2b6604
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4DdV:icVUcTedI6C9e9My
TLSH
T10AF5D664EEEFC1F5FD435C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_WzyWGAEC.exe

Path C:\Users\Admin\AppData\Roaming\OpenSkip\agent_WzyWGAEC.exe
Size 3.5MB
SHA256 e6cb9552e328e00730aade56e920519b7726de7bc0a0bb50840893397a0c50fb
MD5 62ddf64b2fb89c101d406e1d6ac60069
SHA1 09100be5f30825dafc9476c65c203a9b83e8a403
SHA512 1ab1dc3b8716a2197ca970f1dc6a73c5deac21f10c14216b2380d24e1fadf40356d85aef024f6e8c4b7203d6c77b61bd2ff59ffb518c7dce98adffc2d46c86da
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd74:icVUcTedI6C9e9M/
TLSH
T143F5C564EEEFC1F5ED035C30115BB23F6A3526098738DEEBDB941E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_WzyWGAEC.exe

Path C:\Users\Admin\AppData\Roaming\OpenSkip\agent_WzyWGAEC.exe
Size 3.6MB
SHA256 3db1b5445d18e660252d2123f94331d899b8f5c52c0241e1f1b46604b147e54a
MD5 ca54dde5337e91f05fafd8c2d3a8215d
SHA1 747a19a0f6f278c9676c8fa472e036af44baa140
SHA512 12b46ad6eef0228101327fe4d7246d3048ef094cfc84874e89deb665fb035dcdf9f102b2475f428b91ee075d6cd2858f63af41bfa3773fb3d18dc2ca4c936b2d
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW2v:icVUcTedI6C9e9MQRv
TLSH
T19D06D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_wLVcEfeP.exe

Path C:\Users\Admin\AppData\Roaming\UninstallUnblock\agent_wLVcEfeP.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-8607-0x00007FFC54820000-0x00007FFC54B22000-memory.dmp

Download

memory/3280-8611-0x00007FFC54820000-0x00007FFC54B22000-memory.dmp

Download

memory/3280-8608-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3280-8609-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4780-8636-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/4780-8650-0x0000000007880000-0x0000000007923000-memory.dmp

Download

memory/4780-8640-0x0000000005FF0000-0x000000000634B000-memory.dmp

Download

memory/4780-8637-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/4780-8641-0x00000000063E0000-0x00000000063FE000-memory.dmp

Download

memory/4780-8642-0x0000000006450000-0x000000000649C000-memory.dmp

Download

memory/4780-8631-0x00000000059A0000-0x0000000005FEA000-memory.dmp

Download

memory/4780-8643-0x00000000069B0000-0x00000000069F8000-memory.dmp

Download

memory/4780-8645-0x0000000070310000-0x000000007035C000-memory.dmp

Download

memory/4780-8635-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/4780-8649-0x0000000007860000-0x0000000007880000-memory.dmp

Download

memory/4780-8630-0x0000000002B80000-0x0000000002BB6000-memory.dmp

Download

memory/4780-8646-0x0000000070560000-0x00000000708BB000-memory.dmp

Download

memory/4780-8644-0x0000000007820000-0x0000000007856000-memory.dmp

Download

memory/4780-8653-0x0000000007A20000-0x0000000007A2A000-memory.dmp

Download

memory/4780-8652-0x00000000079C0000-0x00000000079DA000-memory.dmp

Download

memory/4780-8654-0x0000000007AD0000-0x0000000007B66000-memory.dmp

Download

memory/4780-8651-0x0000000008000000-0x000000000867C000-memory.dmp

Download

memory/4780-8655-0x0000000007ED0000-0x0000000007EF2000-memory.dmp

Download

memory/4780-8656-0x0000000008C40000-0x00000000091FA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads