salatstealer | 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7

Analysis

max time kernel
33s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT12).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
MD5 707e7f6492429b89d52a665cb47d2e1f
SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
TLSH
T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral17/files/0x000700000001b859-4635.dat	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
4828	Setup-bTbvWlUQiXYpayRj.exe
800	agent_CwiDiLyh.exe
3868	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4232	certutil.exe
2784	certutil.exe
5684	certutil.exe
2400	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1612	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_CwiDiLyh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_CwiDiLyh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_CwiDiLyh.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4596	1612	cmd.exe	90
PID 1612 wrote to memory of 4232	1612	cmd.exe	91
PID 1612 wrote to memory of 4828	1612	cmd.exe	92
PID 4828 wrote to memory of 800	4828	Setup-bTbvWlUQiXYpayRj.exe	93
PID 1612 wrote to memory of 2784	1612	cmd.exe	94
PID 1612 wrote to memory of 3868	1612	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT12).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4596
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Roaming\Mozilla\agent_CwiDiLyh.exe
    C:\Users\Admin\AppData\Roaming\Mozilla\agent_CwiDiLyh.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:800
  - - C:\Program Files (x86)\Windows Media Player\wininit.exe
      "C:\Program Files (x86)\Windows Media Player\wininit.exe"
      4⤵
      PID:6012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:6084
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:2572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -
        5⤵
        
        PID:1180
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:3868
- - C:\Users\Admin\AppData\Roaming\RemoveInvoke\agent_ttiaKiFV.exe
    C:\Users\Admin\AppData\Roaming\RemoveInvoke\agent_ttiaKiFV.exe
    3⤵
    PID:5716
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5684
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:96
- - C:\Users\Admin\AppData\Roaming\InstallRequest\agent_ENcjkewM.exe
    C:\Users\Admin\AppData\Roaming\InstallRequest\agent_ENcjkewM.exe
    3⤵
    PID:1416
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:1164
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_xxxIIOkd.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_xxxIIOkd.exe
    3⤵
    PID:5028
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=3 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wininit.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe
Size 2.5MB
SHA256 07d87e2d24d9f1d37cf9dd46816ea438914d005cf3e9e59adcf1852209b35082
MD5 c6c23d3e21857834eb84531474a7e612
SHA1 a2f87b23874bff340bb9c8c436e2efed00f4d0f3
SHA512 00d617a9c7adbd2e8e080f6a5b4bcd2ef1c9f03fc0cb410c97a2c59d727f273a7d754ebc20ec582223ba8af1ea3a533e3b4406035499ef21f55480e7f2075160
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR2:icVUcTedI6C9e92
TLSH
T199C5B660EEEFC1F5ED435C30115BB23F6B3526098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe
Size 2.6MB
SHA256 a976f74b3a8458654f1fa8f18c417bc4b019556e0b3044d53df67b8cc6adf048
MD5 98f4792818d8bf858690096dfe674994
SHA1 87013ae3d194d79b96718b110078e4377f0bea2c
SHA512 41852a3b40d026e5c9832461365403e525a3ce51e6db9c66cddbd29d39f968310dd582cde913c2930408a05a03ddaed1b3f4ef5864e10fea936853e20f056bf5
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAD:icVUcTedI6C9e9o
TLSH
T162D5C664EEEFC1F5ED435C30115BB23F6B3522098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe

Path C:\Program Files (x86)\Windows Media Player\wininit.exe
Size 6.2MB
SHA256 64128a0d5d9d4f8eefd32f82f620c3e2249a481924c516c8962165c1f4c00750
MD5 199485e5e2a8d66a44b6f260a90b62cb
SHA1 87e8f6133a47e120919dcefa6380a08c53b76329
SHA512 b5836b07ea6d381f8548f7c8c48fc9f29b949dfb92e1ecc9b573b6b8fd2b264f8e2e9124e2446fff12a580471d00442a641a464ff0c726345cb5e01b39d998c8
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfm:icVUcTedI6C9e9MQR7t+cK
TLSH
T12C56D520EEDB91F1ED035C31215BB33F6B351A058738DAE7EB903E06E57B6A21876605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe

Path C:\Program Files (x86)\Windows Media Player\wininit.exe
Size 5.6MB
SHA256 cf4cc2e5290679c8603686f03e834df6fcecef7035597c3e08d4cbcac5bb9aed
MD5 9e8ed134fa23c159ef8f120caf22e3cb
SHA1 a59e8e0b59f6d1e1ca7d27126650841784e1f388
SHA512 cdbcf80fef5ae5c9668ade7abcd7af716d2b6c1685089c3961d613bd4f6ec959455cb86037c51ba609b1331e079723e14ca8af3c451dabff8ea804809261e3a1
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgb3:icVUcTedI6C9e9MQR7t+cx
TLSH
T18646E624EEEBD1F5ED035C30215BB33F6B3516098738DAE7DB901E02E56B6A21C76606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 4.3MB
SHA256 1e02041ea5ef645c263f672b557d59ee74faa6324422522ca32d3933a9b3f310
MD5 ac15f4befc1823196dc95a04a5fa05dd
SHA1 cfca92393cc64e6095cd4d943be55b4d8832761d
SHA512 85e3ba1c31222163d2ee2d6b5f10c898d641dcc55c2ad5fa6653b9448c07f60171736b2afc23a06477eecebc2139ef5440cbe9594b645dbf40fa989217f7ceb6
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSwz:06GtcbPy/lwHVSd
TLSH
T1AA261913ECA554E8C0EEC1758A729613BEA17C49073433D36BA0B6215F76FE0ADB9718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 56KB
SHA256 12caf351425d37d3c8318b615d4524b4d7d72fff3a0e301726990cadd43bc750
MD5 3437fa0d40f70966d9d1efaf07f94a92
SHA1 6d15d28a8f942202b2bb9bf0ce8d2a2e8e89042e
SHA512 36ddacdf2902211098eae7292ec5266dbf92a66da168694b8798ad930932397336a4e11a8cefa3935b4213185c049211585a299c2f7072105b6729c27a20e90e
SSDEEP 1536:CKekcWHB2KavSjdbT/+B0fVNBBaCP6PbWDWwel0QIQUopa9u3XAc6Qs4Sk0CsN:CKekFavydv+azKJl0CM
TLSH
T10F43F83106D730BC39EC7D4628524D8C7DBD2349692A070B53C935BE73BA4E9CE3992A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.1MB
SHA256 c712636ae078a343bc4c243ed12f59d883081014ec17e2e77c31bfbacd300c2b
MD5 dd7f02aec6ee1d213616d11563b8c8a5
SHA1 712ca63344202aa9a5d119244e56ac51ceeda680
SHA512 bdb28de17c223ff6e82ee0e5ba428ad085fec55a6b28b88e18139b777d0eef99960c90c70faea101fc4b6b8e72942754da358ea64a78acc71e4a58150057e817
SSDEEP 49152:R8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRCj:H
TLSH
T1CCE6BF320683BDBD3FAD3D45E0012E495D9D7A1B11A89359FB8930BA63ED5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 11.1MB
SHA256 0c9c86b7a273e90f5ba626f0087f840c6b47bc68003f5f79d26c05e84e45657f
MD5 35f32a9fb74fa41d0cc70a0e8609464d
SHA1 27ecc3773d44c45279fbee546945924e6933cd2c
SHA512 e72097aa47d2977422b8619e8079469c3bfa803c811cfbd278d279f236a9854ea1779e8ffcf3c27592cbd515df94c8ea3e6a5c6229b5ab67d1a31bf9047ee9e5
SSDEEP 49152:NSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSyD:a
TLSH
T10DC6D0720243FDEE2F6A0D84D0043A415C9DBA5B62A4D299FF8D35FA62EE524DD3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 04322310b7a6a6d4cc9dfca5e23aacec6ce397c4b5e265eccf7047790f7907e0
MD5 61f7c12ff2890de9835a6d4415f07ef5
SHA1 6d6e3be52bab4fa31bf35cbdcbdc66c749bdadd2
SHA512 459b6edd523684afc5c9dc93a8e54ed345cef0685ee676d02656034fa395795a89ffb96d0790b20864b5f42ec0648b1bb7f23802cbb130a6e966ced3d1f11194
SSDEEP 384:xdg46tvqnjy2u+xqhT3E5vEVZzGOg7qEk7r88NGQaKTAW:bg46JqraU5vEVZzsG3k8NGNKTn
TLSH
T1BE722A7906BF707436AC3DC43DB20D8D4D9C8B0884724BA76BC429F5F09D6AD4A1696A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vqgth2lp.guy.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vqgth2lp.guy.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_xxxIIOkd.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_xxxIIOkd.exe
Size 2.5MB
SHA256 581b6d56eff0e7cd5a3aff67b921caf645b5597c905beccc28b4276914c60769
MD5 aeb382f0bfd1e4158809856f1f30f8ef
SHA1 c5a5bfd36aad8d0f2254497388154c49ee937fc2
SHA512 89dbcec4e9673944dfb99e7de1e130b6bdd550207bb5c7eb63a026c21a35c10fadebfcd79cbba6631b1e98ca523a688919ea5a870c2c3b158d13f915bdd50d1a
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRc:icVUcTedI6C9e9c
TLSH
T1CBC5C660EEEFC1F5ED435C30115BB23F6B3526098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_xxxIIOkd.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\agent_xxxIIOkd.exe
Size 2.5MB
SHA256 778dc7e3fbab39878ad9fe721178eb06c6e5d8fb1f5edfc05f5c12542c45cd99
MD5 fc014ac536eba564f6edc668820ee5e6
SHA1 f3b80bcedb5f11f84f102cd3dcfce12b14e0c6b6
SHA512 cb0ee1991387d9221ce8d59bc85927ba67bbe76bf74ef1b0fbce94221f68d50b8394aeec3b5a2aa5b65fcd41f78ad4c13dfde197cc0e6cf7affb4e1bdef055fa
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR0:icVUcTedI6C9e90
TLSH
T13CC5C660EEEFC1F5ED435C30115BB23F6B3526098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ENcjkewM.exe

Path C:\Users\Admin\AppData\Roaming\InstallRequest\agent_ENcjkewM.exe
Size 3.5MB
SHA256 8ff7576db414ad7543e92e14497f7f5fac8b5e6daf3aa67fdfb87f86b2bb4fda
MD5 a3c41edcfb3e81de638fbc5ec2685e2c
SHA1 df0d9ffe80902591841f34124c171e9361f16312
SHA512 e7e58388048762dc803295d69da3b9e32267ef31a8cc51dffb1ad94a5581b6c4deb856367ebc6ea270e1117ca3e681dd21a25faf76c5ff54dd73fbdd2453e120
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7f5:icVUcTedI6C9e9MG
TLSH
T10806D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ENcjkewM.exe

Path C:\Users\Admin\AppData\Roaming\InstallRequest\agent_ENcjkewM.exe
Size 3.4MB
SHA256 6860e46874874a7c53360b491c65651f9ff5abdd1fac27a824f47b54b56e99cd
MD5 5f512a70c98ee1d1cd10adc31d0e9478
SHA1 8b6694ae01602a7e30f1dcb889753bf5164579a1
SHA512 aacb0553a1275bd80dcb6255a71f0ddf1d3e88d6c42f88f70c79819794a08bcfa482b6941d1f528e4748f0531b92169ae997c7314a8098769f2400b03afa7665
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7K:icVUcTedI6C9e9MN
TLSH
T113F5C564EEEFD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_CwiDiLyh.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\agent_CwiDiLyh.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2684-10433-0x00007FFDA0070000-0x00007FFDA0372000-memory.dmp

Download

memory/2684-10434-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2684-10437-0x00007FFDA0070000-0x00007FFDA0372000-memory.dmp

Download

memory/2684-10435-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/6084-10447-0x0000000005BB0000-0x00000000061FA000-memory.dmp

Download

memory/6084-10449-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/6084-10453-0x0000000006210000-0x000000000656B000-memory.dmp

Download

memory/6084-10456-0x0000000006660000-0x000000000667E000-memory.dmp

Download

memory/6084-10457-0x0000000006BC0000-0x0000000006C0C000-memory.dmp

Download

memory/6084-10450-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Download

memory/6084-10448-0x00000000058A0000-0x00000000058C2000-memory.dmp

Download

memory/6084-10461-0x0000000007630000-0x0000000007678000-memory.dmp

Download

memory/6084-10463-0x000000006FEC0000-0x000000006FF0C000-memory.dmp

Download

memory/6084-10468-0x0000000007AF0000-0x0000000007B93000-memory.dmp

Download

memory/6084-10467-0x0000000007AD0000-0x0000000007AF0000-memory.dmp

Download

memory/6084-10446-0x0000000002E20000-0x0000000002E56000-memory.dmp

Download

memory/6084-10464-0x0000000070020000-0x000000007037B000-memory.dmp

Download

memory/6084-10470-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Download

memory/6084-10471-0x0000000007C70000-0x0000000007C7A000-memory.dmp

Download

memory/6084-10469-0x0000000008260000-0x00000000088DC000-memory.dmp

Download

memory/6084-10462-0x0000000007A90000-0x0000000007AC6000-memory.dmp

Download

memory/6084-10472-0x0000000007D20000-0x0000000007DB6000-memory.dmp

Download

memory/6084-10473-0x0000000008120000-0x0000000008142000-memory.dmp

Download

memory/6084-10474-0x0000000008EA0000-0x000000000945A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads