salatstealer | 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85

Analysis

max time kernel
16s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT11).bat
Size 4KB
Sample261030-afyvtstyfw
SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
MD5 81d21053303452399da6b09313cac0b3
SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
TLSH
T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 3 IoCs

resource	yara_rule
behavioral15/files/0x000c00000001c5da-3841.dat	family_salatstealer
behavioral15/files/0x000c00000001c5da-3840.dat	family_salatstealer
behavioral15/files/0x000c00000001c5db-3845.dat	family_salatstealer

Executes dropped EXE 1 IoCs

pid	Process
2000	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4572	certutil.exe
5704	certutil.exe
2936	certutil.exe
3180	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5108	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1376	5108	cmd.exe	90
PID 5108 wrote to memory of 3180	5108	cmd.exe	91
PID 5108 wrote to memory of 2000	5108	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT11).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1376
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Users\Admin\AppData\Roaming\SetCompress\agent_rtkhBNmb.exe
    C:\Users\Admin\AppData\Roaming\SetCompress\agent_rtkhBNmb.exe
    3⤵
    PID:2864
  - - C:\Program Files (x86)\Adobe\SecurityHealthService.exe
      "C:\Program Files (x86)\Adobe\SecurityHealthService.exe"
      4⤵
      PID:4960
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:3324
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:1000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthService.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthService.exe" -
        5⤵
        
        PID:6032
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:4308
- - C:\Users\Admin\AppData\Roaming\RevokeSelect\agent_eajKEYQw.exe
    C:\Users\Admin\AppData\Roaming\RevokeSelect\agent_eajKEYQw.exe
    3⤵
    PID:3088
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5704
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:1548
- - C:\Users\Admin\AppData\Roaming\SetCompress\agent_xDrVjTqE.exe
    C:\Users\Admin\AppData\Roaming\SetCompress\agent_xDrVjTqE.exe
    3⤵
    PID:2216
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:428
- - C:\Users\Admin\AppData\Roaming\ExportUnpublish\agent_CagZZBDK.exe
    C:\Users\Admin\AppData\Roaming\ExportUnpublish\agent_CagZZBDK.exe
    3⤵
    PID:908
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthService.exe

Path C:\Program Files (x86)\Adobe\SecurityHealthService.exe
Size 3.5MB
SHA256 6c618463c0d91f05792efaf5671fe6afdb22d7ca5e819d0b4e0b5e11e0732a00
MD5 24f9f8b05d849c53871215e8d891287c
SHA1 c73284648633a634d4d5b4057203ddb0c38e8b9b
SHA512 81aac85f5736ffde301cf6d873fa4711b90a8c525ab1c6481bb41a4c975e2f7249533bb48f1b3c17537e802025311f661cd128d3677d84d214c250b1c1ebab93
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fa:icVUcTedI6C9e9MF
TLSH
T165F5C564EEEBC1F5FD035C30115BB23F6A3526098738DEEBDB941E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthService.exe

Path C:\Program Files (x86)\Adobe\SecurityHealthService.exe
Size 3.1MB
SHA256 e40e91bfce2b6115d1e9cdc51430ffad2f746316f2513fc70b2ec0b5b3dbee64
MD5 ba520637553bc9385d77647e25ef700d
SHA1 3072fc9b0b5a8906a5f15002212d0f11bf9ab48b
SHA512 993df72a1dc15e456f0f2de72baa1e9a3957597ea56e481e61ce09f6df26970d52ae8013422be2e11f302cdfa7ce120303952953fd24134aec444b670b89fdcb
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4W:icVUcTedI6C9e9Mz
TLSH
T198E5C564EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthService.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthService.exe
Size 2.3MB
SHA256 b58f088f2250366069921d15868e4ad8a1ca6d0c423d317e4b17e02072d32043
MD5 d3cf240b4bb1f5ef4e4f6dd9eb43e833
SHA1 715efa2305d30e8cd31a6a01ff5b59453422f6f9
SHA512 7770ab436514022da0d8739996baa960522186f7a653a5306f4db5a05b70abd15b7280c699f43008c796b426855e7c663e23a4f3634fe9bcfeb510cd45a53f80
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVel:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTy
TLSH
T169B5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthService.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthService.exe
Size 2.6MB
SHA256 cac7f7f75c366096242836c8150bcd355e1bfee0a097dd009e57580bb232c22c
MD5 5d341ef41e937f951b87a423aedb5971
SHA1 dd2d276a1562ab6e0225b50d01452df6dd8f0375
SHA512 b3720d85da6d316cec128bf7f882b416bb0ead41f620751e2b05522a3c4d2cf737dc5a7d4cf98e35b5e74689d6700bf4687bd1ed0e33df7b9e6f1ac9458f1371
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRJ:icVUcTedI6C9e9J
TLSH
T1FFC5C664EEEFC1F5ED435C30115BB23F6B3522098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.1MB
SHA256 1ff8dbc6b02128ed8f46670717aabd568383762ebb5ea6f5c76e1dab5bce366e
MD5 c06e82573b7c9ac23c9fcd3d29b6229e
SHA1 ea405133e1d8f1dddf16e72e3bda74a0b46a4d0d
SHA512 5d9e3bab6800ea6dc653a32ad668608397b76d9645b7e8b6c71465324246401a4a1bcac221cf72c40320614ab68617eed61424645743f361e122aa5ef8b2c33c
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvT:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9B
TLSH
T1FAC6BF03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 6.7MB
SHA256 743b61738cab4d21f6dcbc118da11391293b5a21fe5cfdc5993f2ec59ef80a9d
MD5 2fab0e3c07a5dc5d787eb20d054ae08b
SHA1 748da4e72955e790f08dd30d3ab365d14ef26198
SHA512 06c5e49b12ce4162790c0bd4d4923f64a686821c4fafe79191013852b87de3be16c268e26a566eb0049fb6824533533d9abf8642eaa08c4f6d80dece608827a2
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eNX8t:06GtcbPy/lwHVSavaeNn6dJj
TLSH
T1A5666C03EC5555E9C0AED2718A729263BB717C884B3163D32B90F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.9MB
SHA256 ab6ec3f0d445254ffb15f055a4e06785f66a26cbad5ee61f3a808ce604f2f435
MD5 0c869dc497b4be088e4cde6afa6ddcca
SHA1 5218554fe2fb554a1e6f9e536129568661956d4b
SHA512 7319ab01d934db473c6a0f58011ea8a9aa0fa9e4c0004b17cf7cf4db971706855a75db4391a1bedafc12f2bbf9bbf90bd7335dd2abad58661578a14a98173383
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaX:06GtcbPy/lwHVSd
TLSH
T162160817ACA544E8C0EEC5758B6296237EA17C49073433D36FA0B6211F76FE0ADB9718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 139045ec81569a5cd577f2efebb72c13d527115424a7854232c2fdc72b0e1f14
MD5 000a94f8adbc68066fffaede6cb2cd17
SHA1 8eea6eecd440d9ad147896beb074628fd693e856
SHA512 6580e5067636b3c668e1e527a0d57c1c94f5bb6acb1d069bb8c65342fc89ac2da182498bb5cad24ac7ba92710b8e0638e62ac54405d878445911ec5468893c53
SSDEEP 384:/satpnDA3eQAKCSf02H0fkucCBvhX/QLJxTkv44pYbfmJFKJC8eZNlJtEzTjGLhS:/LdWIWvRucmvKLJxoYVJC7PJt63qdg99
TLSH
T1C492E1086C7F0D437EB3153CA4DF91C497A181BCED91A23209F2D36291D36BD977A149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 1.4MB
SHA256 46a5712f76f9c59d50179f6a42c3b4af2263bfb5c35757776a24d16f89264b3a
MD5 07feaf8f0b18a46babe48ae9c1bbcae5
SHA1 55606fa8577782e7dfa6b39cd204b9c570262388
SHA512 637dac7496fc53bb8f000e2f191457b43c8fabac88cda083883b9217cdb6a20a7e7e79cb5717c7b51df841d370262d1cac893f24c73860c3b237691ebb613281
SSDEEP 24576:6BHZ5d3W2NWWI7Sbbp7ZWcPHoUccqwFKCSWxQ6QuhV1rzW/n8HSYVPIxAuP:gd/mM3ccqdfW/1G/88
TLSH
T1B365F0711AC77D3F0A751E18C10DBBD4ECBA255F8467F28CEEE100B922A9E814F1A5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 d8ded46d9f215c92e5937354e46f537f520d9d2c8c53891ecaf090848616aa24
MD5 34bce70cb9b0643cd3d7c008dfaa4228
SHA1 965ec6eaa7d022e9ba1101b5abafc274bcb519f3
SHA512 1aeb597ba075b239e5114f0c858f5beb4d27fbaa9911db94667192516c96d082d87e9edc5c9b879ace481ba9ef060b7931f0e02225dd27cbce03bfccd1aa97d6
SSDEEP 384:6g2TQd34WIz8IhK26aNbDJEYssYzSNS9mD0OI5K8tlQLhhYv6a/T:72sdGL426sJEYssYGNSAD0vELh87T
TLSH
T13672E77A079770BC34AC7E9A75121D0C5D5D672E093A0307A7C834BEB32C5D98E25E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 3.4MB
SHA256 ea7f28197616290976481aead87657605faa9279b77c615fdc722c73aa020a15
MD5 e33eea9f48036f87e67318083935fe5b
SHA1 1bd5e5be3d27b8a705639f15c9778dec142d643d
SHA512 0cd76752491e3e5a8c8991cd0baf765a878a043adea583ed1870de9dd9b7e179ee2cbaf17925cdc2203e98c81e72b8d0edefb7bedaf8f0d52fabe36b489e278b
SSDEEP 24576:65NXn0lA5rd6N1vJvKzEMZeuDl68e3d5PbqXkDfQQKiRiTJ9qlS+CRPhwg7AevHX:65N304rSRCBe3rVBNRoz/YJKjj
TLSH
T1F5F57C364243FDBD3FAA5D85E4042E865C4DB60B21A4C29AFB4D34BE52AE5748D7CC38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 98da91450c15ca2772e113c168b8c5667b4545b912503a5bb099d29f823acc47
MD5 b980045e76c4cf67e3e213204e22eba3
SHA1 0a595623d81bf8a223c19941a1100fe0350347c2
SHA512 8e1bd62cebf0cf1328aa84572d617725654ebca5885a1c81acea4b9d28353e8d6bacbb4bdd3a55daf44ef18066b66d6c2d7517e170f1610d1972e8cb31abc49e
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmalEDhQjl1vsli:SJH9XuutQyGMNroE3O8tHEi/maleqUli
TLSH
T12A926D744AE33CFD3E8C7C5061201DAC5EAC6F8754694209ABC838F693D85ACCE5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_v1ghkipk.cms.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1ghkipk.cms.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_CagZZBDK.exe

Path C:\Users\Admin\AppData\Roaming\ExportUnpublish\agent_CagZZBDK.exe
Size 3.4MB
SHA256 33e81e198169fa821b1ca918683ec6cea740e9f5b789b065e907320054755d05
MD5 489699be7ba96fae21be5729cd3ced39
SHA1 7fbe81021fd41b3fa2aef1cb5c5167110d668a0f
SHA512 0a6a0e011a2356484875d38b3f58bee0394a0429e533109b1821d9186f7528d372568841381288d1b14d359c5b5c66a36b99aa76cf1fc3990d3214ad3bcdef48
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7a:icVUcTedI6C9e9M9
TLSH
T167F5C564EEEFC1F5ED035C30115BB23F6A3526098738DEEBDB941E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_CagZZBDK.exe

Path C:\Users\Admin\AppData\Roaming\ExportUnpublish\agent_CagZZBDK.exe
Size 3.5MB
SHA256 47462ae14b0c71e3b355e6b1039f5b41347a2f135119661184207bbc78a2e179
MD5 5ee3aefc7e0cea904f01542f716688cb
SHA1 e487714adc65f54e36314f0f6b1f8cb0a11d8df5
SHA512 b519ea66d403b9930de5b3691d11a3ba2dcf87c82c2bfe57d7353c88234940c1f93eec47fc19559ffab5ecde65b5108125b4a3c8c3316015035fe4d513fb8718
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7ft:icVUcTedI6C9e9Me
TLSH
T10906D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_eajKEYQw.exe

Path C:\Users\Admin\AppData\Roaming\RevokeSelect\agent_eajKEYQw.exe
Size 8.9MB
SHA256 62949a5d03057348db4f12c313da76b8dd42a7b36345fd171d76fdf95cfdf3db
MD5 7c878b9aec48a6421c03610be68a374c
SHA1 74626d07b5b06b34fef8158957312e79d12c3ef2
SHA512 3a185ba0acb0b965d4f384359fc6d05fb341e0a3c4801e1dde5ef47e81f2dfa55af039189cb17dd8ba2c1958085162ffe62673239ff6d66906819e5996697031
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfQ:icVUcTedI6C9e9MQR7t+chQL
TLSH
T147962821EADB91F5E8035C31116BB23F67315E048728DBE7EB543E17E87B6A21C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_eajKEYQw.exe

Path C:\Users\Admin\AppData\Roaming\RevokeSelect\agent_eajKEYQw.exe
Size 8.9MB
SHA256 5232f61e2d8200f9496df9b45f5c50d2a20f420a4a3253ff1f6263b1fec485f0
MD5 6c4fb26cf1363b1dea92b80e0c674f6f
SHA1 6c6db9f8a157c292d22a5da0980340fde247c415
SHA512 e79a7f24d2ca2282c7c77e382359577074809aa2b32e413843b7e47da597389e9cebc9e27b0f9fd1b168323f85bd305fb89171531bed3663fa68d3e1156c9606
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfW:icVUcTedI6C9e9MQR7t+chQx
TLSH
T1E3962821EADB91F5E9034C31116BB23F67315E048728DBE7EB543E17E87B6A21C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_eajKEYQw.exe

Path C:\Users\Admin\AppData\Roaming\RevokeSelect\agent_eajKEYQw.exe
Size 10.1MB
SHA256 7ec7d6fd67884a1aafa293d258a93e594ac03d481ade4e29c07aa98ebc04caa8
MD5 25e2af5a9bc1c077fc02dc179e1c05c4
SHA1 4843229bceec5a859a806777ff71240bf62961b2
SHA512 da71a2c5ded4f07021d8d282919dbee479290bdcdf696b1681faf9b31d548f69fab108c349fb16c9e1c395ce13793793169ffb9c19f72c5f755b6f20b6c3ed00
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfX:icVUcTedI6C9e9MQR7t+chQa4e
TLSH
T1A9B64921EADB90F6ED035831116BB23F27315D048728DBEBEB547E16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_rtkhBNmb.exe

Path C:\Users\Admin\AppData\Roaming\SetCompress\agent_rtkhBNmb.exe
Size 10.4MB
SHA256 80868c463c628a6e939bc1adbf26dd36db9c4cf892f4fb7436ca9574c6965fb8
MD5 05ab0635e7cc03d759e0c6332e52340a
SHA1 c36667afe0bebdcbd4a6511e131c4303762b3008
SHA512 6433cf40b03a2c11747d89a26098aa686403952417c14e3b16b7b847ca0b755a6c25d6a19880fd2e3fad2d438de4b8cc2d21001404a0d645e3142d399987870b
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFf2:icVUcTedI6C9e9MQR7t+chQa43
TLSH
T116B64A21EEDB90F6ED035831516BB23F27305D048728DBDBEB546E26F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_rtkhBNmb.exe

Path C:\Users\Admin\AppData\Roaming\SetCompress\agent_rtkhBNmb.exe
Size 11.3MB
SHA256 43502df033d9cf1a5d2fa10b8661b7c6600a7f81afaf7bd42e23515d98fb5c1a
MD5 3584e12165be3ab86440cb995e1a68f5
SHA1 64879dfeab8ddacc2e0888baeaebebd967efb942
SHA512 60a07214868d6a6248a6114228c2d0ee78d6e2d575505a42abab7b0ec0a4a8e9f3318ed6ad49d9c66c8e8a35530e4a29c21fb128a1265b83b87843acf776f255
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfy:icVUcTedI6C9e9MQR7t+chQa4NG20CB
TLSH
T1CDC65A10FEDB95F2E9035831416BB27F27315D048B28DB9BEB547A2AF87B6A11C76304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_xDrVjTqE.exe

Path C:\Users\Admin\AppData\Roaming\SetCompress\agent_xDrVjTqE.exe
Size 3.9MB
SHA256 ca6e4869d0b52ab8cf36b9e8918b0ee3be3a468ee602290f4cafa66595492d4e
MD5 f2cdb9f0fa3bee72d601ca9d171fd35a
SHA1 b9da26263c15ea76169fd5b6200b10d028853ace
SHA512 3c3c2a46e3335a48a7e52329d8355a5b80fcdc68b6183a7714af1a03b67c7fa8ee48162c0b4c8b9cfe9ee609f01714e50b3312e7689ec087f992b40f53f78d0c
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272It:icVUcTedI6C9e9MQR7tt
TLSH
T1AB16D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_xDrVjTqE.exe

Path C:\Users\Admin\AppData\Roaming\SetCompress\agent_xDrVjTqE.exe
Size 3.8MB
SHA256 1a956414d47f9489ca01faf1ddce57373db38f9135e5346efb91d35bf29a95b9
MD5 a0246b0903b88c755f6c2c415fc7ca48
SHA1 5abf60a319f3461351fb6a04510c8ae547b266af
SHA512 9d9f4348c7cdb0b5221717bd525333c945def71977bf382d55adc0344dbca7678e0d1876ee435e2863b9c6935cf0442ee732bda256db3a130b389772eb469efd
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272I6:icVUcTedI6C9e9MQR7t6
TLSH
T11106D564EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-7323-0x00000000074C0000-0x0000000007563000-memory.dmp

Download

memory/3324-7316-0x0000000007220000-0x0000000007268000-memory.dmp

Download

memory/3324-7304-0x0000000005390000-0x00000000059DA000-memory.dmp

Download

memory/3324-7329-0x0000000008880000-0x0000000008E3A000-memory.dmp

Download

memory/3324-7328-0x0000000007B10000-0x0000000007B32000-memory.dmp

Download

memory/3324-7308-0x0000000005260000-0x0000000005282000-memory.dmp

Download

memory/3324-7313-0x0000000005B30000-0x0000000005E8B000-memory.dmp

Download

memory/3324-7309-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Download

memory/3324-7310-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/3324-7314-0x0000000006040000-0x000000000605E000-memory.dmp

Download

memory/3324-7315-0x0000000006090000-0x00000000060DC000-memory.dmp

Download

memory/3324-7303-0x0000000002800000-0x0000000002836000-memory.dmp

Download

memory/3324-7318-0x0000000070100000-0x000000007014C000-memory.dmp

Download

memory/3324-7322-0x00000000074A0000-0x00000000074C0000-memory.dmp

Download

memory/3324-7327-0x0000000007710000-0x00000000077A6000-memory.dmp

Download

memory/3324-7317-0x0000000007460000-0x0000000007496000-memory.dmp

Download

memory/3324-7319-0x0000000070350000-0x00000000706AB000-memory.dmp

Download

memory/3324-7325-0x0000000007600000-0x000000000761A000-memory.dmp

Download

memory/3324-7324-0x0000000007C40000-0x00000000082BC000-memory.dmp

Download

memory/3324-7326-0x0000000007660000-0x000000000766A000-memory.dmp

Download

memory/4872-7284-0x00007FFE79FD0000-0x00007FFE7A2D2000-memory.dmp

Download

memory/4872-7286-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4872-7288-0x00007FFE79FD0000-0x00007FFE7A2D2000-memory.dmp

Download

memory/4872-7285-0x0000000100400000-0x000000010043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads