salatstealer | 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80

Analysis

max time kernel
33s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT2).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
MD5 802a10c9f71f69ebe61eeae7693ba0e5
SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
TLSH
T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 2 IoCs

resource	yara_rule
behavioral19/files/0x000d00000001c619-6764.dat	family_salatstealer
behavioral19/files/0x0009000000000442-10810.dat	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
4948	Setup-bTbvWlUQiXYpayRj.exe
3120	agent_HgPGSpsj.exe
5548	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5548	certutil.exe
2652	certutil.exe
4132	certutil.exe
5180	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1100	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_HgPGSpsj.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_HgPGSpsj.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_HgPGSpsj.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4940	1100	cmd.exe	90
PID 1100 wrote to memory of 5548	1100	cmd.exe	91
PID 1100 wrote to memory of 4948	1100	cmd.exe	92
PID 4948 wrote to memory of 3120	4948	Setup-bTbvWlUQiXYpayRj.exe	93
PID 1100 wrote to memory of 2652	1100	cmd.exe	94
PID 1100 wrote to memory of 5548	1100	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT2).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4940
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5548
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Roaming\RequestUnprotect\agent_HgPGSpsj.exe
    C:\Users\Admin\AppData\Roaming\RequestUnprotect\agent_HgPGSpsj.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3120
  - - C:\Program Files (x86)\MSBuild\sihost.exe
      "C:\Program Files (x86)\MSBuild\sihost.exe"
      4⤵
      PID:3708
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:1244
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -
        5⤵
        
        PID:4100
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:5548
- - C:\Users\Admin\AppData\Roaming\Sun\agent_xbsEHzuc.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_xbsEHzuc.exe
    3⤵
    PID:2680
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:4808
- - C:\Users\Admin\AppData\Roaming\AssertMove\agent_DCkBHiOc.exe
    C:\Users\Admin\AppData\Roaming\AssertMove\agent_DCkBHiOc.exe
    3⤵
    PID:4476
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:980
- - C:\Users\Admin\AppData\Roaming\DisableClose\agent_YnRaEtLA.exe
    C:\Users\Admin\AppData\Roaming\DisableClose\agent_YnRaEtLA.exe
    3⤵
    PID:5984
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sihost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe
Size 2.1MB
SHA256 162c28f960b5558cbcb9179316808cc3b087ff517b3b48a43783c3e6ec92abbd
MD5 e13b463245a568d269ce6ecee6a98b08
SHA1 da75706dc0db68e3f974292009ed24c9bb1f7507
SHA512 9608b83c79148f336327d6bdd5971d29eb678f055560a005a4fd8c507e1d27ea78b197901fe1374a38186cd889630922636a8d762513ec2f954863583bbe8afa
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeX:TjycqCUjvnTGmp2TedLKtJ8CRV9X
TLSH
T162A5B664EEEFC1F5ED435C30115BB23F6A3522098B38DEEBDB941E02E55B7A21876205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe
Size 2.5MB
SHA256 7d055c41e1791b88d56c0b4346fff8568c07f6a67a1cef06e0d6dcc2db68061f
MD5 7a1814f7db62b267ce9e66599b59ac32
SHA1 54af153f273a920a4e3449f9151dd9fbd892ed71
SHA512 bbf5ec624b8bdacdac3b026a97c51cba5163e5bafb2ea3e987e64ece3bf0d13a0aaacb289b9365f06e44ffb18be72d5aab15e281864e1a4c467a8431549805bf
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRs:icVUcTedI6C9e9s
TLSH
T122C5B664EEEFC1F5ED435C30115BB23F6B3522098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 4.1MB
SHA256 8409eb114f7da8a08601d345c9ed235800dff3e375e332090bd4703433fbdd0b
MD5 f0c180c9d2df1aa06be80b48dc1a9e7a
SHA1 79434885a51a81cd14f0bdaecb427a6576d7d501
SHA512 63ed32054feb93c33cffca52cd46a328de47d2375b5be3b9fd8bab17c2d9b97937410002415596d7e499bc8677601a902633608d2c06f9c7d559d666cf6104c2
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSb:06GtcbPy/lwHVSs
TLSH
T151160813ECA554E8C0EEC1758A729613BEA17C49073433D36BA0B6215F76FE0ADB9718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 839b5f32bd910a636cea9777c544d4f276158dcb40b88918e3f39fdf3241a754
MD5 1903fb201b0c655b9162d81455c5f328
SHA1 75b248bbf2c803594e7bdb2cad93edb9788f0e1e
SHA512 bc288337a144e5b4c65bc0129bd783f1d8882448e0ab08454653294676efe3727edbcd0c6781f820a3af1956c0a952dbcf8d63b3901b9aa32d0538c1ed18c6a3
SSDEEP 192:BN2C16UBAhc3nhRILFqetqM/PTXbYthj9cUIsWGAwwHua8/szO2L2kfh1ML4HKW1:SkAK5MqMHACuWw0OI2k4LaKWxpB6c
TLSH
T1C572F7B50BF3107E34ECBC8679604EAC8E6D1B096C7A030747C475B6F2995A88B29F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.2MB
SHA256 dfde29d9d44c6e3ebfac588bba6e6e9772e3521df278394aeb7e2caba220418f
MD5 6505cd6b6c57c2381674cccaf4cae78b
SHA1 56d9733774c5f946248fe446fa081a648fabada4
SHA512 b3fe94ca8201bd43029c196fc6c99c78ae1620dfe54a6963d1cca984c5f85e2f71fc4b2fcd51958a10c0a531c57f0833c46db398438983f74698147f94972f87
SSDEEP 49152:DV8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC:3
TLSH
T15AE6BE320683BDBD3FAD3D45E0012E495D9D7A0B11A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 12.5MB
SHA256 ee522bf6d2d5f09b0ae2c02fa4da9c46036718a6b3a8bfecf5b7e70b83a7ebd4
MD5 0d9f19ad15fee7542f33fd20ff489bd3
SHA1 f8be5c085de7343cd6702a6699b625d60081fa47
SHA512 b718327db67980bc5cf190951ab3639b17f729b012d7e2b6a46cdd3f46dafa170219fffde9f6cdb33d65d4bfa749d71e9cba47ef74ef910d94ac6917c4d636ed
SSDEEP 49152:GJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKK:k
TLSH
T19CD6CF320243FDFD2F6D2D45E0043E855C9D7A5B12A8D299FF8930BA62EA564DE3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 340KB
SHA256 5e61ae8fb821c07477677af5ee8e946c133507c33a1f0a633e1e49a3391719d7
MD5 fac29630b0a5762fc18575ed90e1b833
SHA1 09cdb36a18aaa310a7c7ddb2c7c6c25e0892a981
SHA512 dbe7d3e56cc588dfe8158e0e94563d4bac6dede3fd9331542de3c24355049c5077b835232ddf47a1fb5f27262e52041a28a0096ce6f1f8a7e12e2449cfda454e
SSDEEP 6144:xSGLxhI5zam2rmjK1IdgnCSeXkkLsJlCra1B3dHEiOfyb:jaxamzMn
TLSH
T1BA743A3507A774BC34BC3D8664121D4C5D5D2B0E567A430763C974BEA3AE8E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 4.4MB
SHA256 4d332958f2ed2b90ac1ba47674ab73262704027c3a28f5fbd0747a02824bee9f
MD5 afdcdaa630baefd4a8b0c591080919ae
SHA1 c7b0d29e980a8eeeb33acdb6af4d358f1e8fd9f5
SHA512 306015cadaaf522cd0dd2668993d1ae36e852780e74c78655936f98ae50d83c970eaba26dd77edfde5e78fe5201ce5917d9d028d420f3dfa748a1a92f9188c94
SSDEEP 24576:35lbwTPUsFl3rRs+7b9Y0zLO9JKreV8eoJewHAtDfmPaxImHKiJt8oz5NXn0lA5N:35l0USsA0V8bHiDvxPdJB5N304rSA
TLSH
T1C6262A3506A778BC39BC7D8674121E4D5D9D2B0F157A430AB7C930BA63AD4E8CE28E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1tphu5ui.fg5.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tphu5ui.fg5.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_DCkBHiOc.exe

Path C:\Users\Admin\AppData\Roaming\AssertMove\agent_DCkBHiOc.exe
Size 3.5MB
SHA256 8ff7576db414ad7543e92e14497f7f5fac8b5e6daf3aa67fdfb87f86b2bb4fda
MD5 a3c41edcfb3e81de638fbc5ec2685e2c
SHA1 df0d9ffe80902591841f34124c171e9361f16312
SHA512 e7e58388048762dc803295d69da3b9e32267ef31a8cc51dffb1ad94a5581b6c4deb856367ebc6ea270e1117ca3e681dd21a25faf76c5ff54dd73fbdd2453e120
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7f5:icVUcTedI6C9e9MG
TLSH
T10806D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_DCkBHiOc.exe

Path C:\Users\Admin\AppData\Roaming\AssertMove\agent_DCkBHiOc.exe
Size 3.2MB
SHA256 03e8cd5e64a69171c3c9becbebac981d8a8fd2598f45e250143fd90fbcfd04e9
MD5 17a2d8746f1818d8454571d37290e330
SHA1 c4b4d50ba57d01b8f9b922f7a44081997b66777b
SHA512 28fac6692ce0ecd3d5d2d825fd2c3781b6386f6bc69d6181742dee15d11d39ef526b6d148af186572f440ad9aca6ba5775aa7a531b4cd667bd63c73d63fc3304
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7S:icVUcTedI6C9e9MZ
TLSH
T1F5F5D564EEEFD1F5ED035C30115BB23F6A3526098738DEEBDB901E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_YnRaEtLA.exe

Path C:\Users\Admin\AppData\Roaming\DisableClose\agent_YnRaEtLA.exe
Size 3.5MB
SHA256 cde9acb8e7931e7492bb58f1a1c8e6157c31ded01ab2dc5922e1ebd71695ac88
MD5 3a3b190d86b0ac6d8373eb7636000bc3
SHA1 ff2d7b6a72e83cb119d6dd9935eaadc3271557da
SHA512 c673be57a09fcfae5cc707367803b4da5897b1a41931f2ddf228f279c3d93b5d31d90ec66fa1b43f045e9f73e58cf84091488150b72edbe3552744062dc3364f
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fG:icVUcTedI6C9e9Md
TLSH
T1A0F5C564EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_YnRaEtLA.exe

Path C:\Users\Admin\AppData\Roaming\DisableClose\agent_YnRaEtLA.exe
Size 3.1MB
SHA256 a03c7da5ecd52a30c084c1664d3c441aa105fe0b3f1a901d56c8f5440fc5c370
MD5 e8d5404b398f42b751dfcf7c7a75124a
SHA1 9f6878b4a0c665292b6af299d0f37e4a8fdd7470
SHA512 be1f757bd08e2b604a04933939dac7341cde9cdd66a5d2b1adf5099e4e3ca4dd4cdca1458be549c91b0424dce5c79f94a335a1a97572b85bbf1fef1cd615a0e0
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIyp:icVUcTedI6C9e9Mp
TLSH
T1B3E5C564EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_HgPGSpsj.exe

Path C:\Users\Admin\AppData\Roaming\RequestUnprotect\agent_HgPGSpsj.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_xbsEHzuc.exe

Path C:\Users\Admin\AppData\Roaming\Sun\agent_xbsEHzuc.exe
Size 11.8MB
SHA256 b8a13e0695b044ceccaeed9f75ea56869a03a13897ff2f784f08e13f4eaae6c8
MD5 855d369283aa33da5cb01ba48b529eca
SHA1 2e1a179910bae8e62519e29ff3a63fdee11b736e
SHA512 00c56bcf530dba59c1d4a08adee97a9d66b15a2313f5ededd1909a5c91e5252300a87d0fd0b94b610dd1250ed8bd4b7f0da831f046f5db5f0981fcc87bca4b0e
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEm:Ac9ZeuQt+IJnAm
TLSH
T1B6C65B11FACB95F1E903583141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-14530-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1036-14534-0x00007FFA19090000-0x00007FFA19392000-memory.dmp

Download

memory/1036-14531-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/1036-14529-0x00007FFA19090000-0x00007FFA19392000-memory.dmp

Download

memory/1244-14553-0x0000000004E50000-0x000000000549A000-memory.dmp

Download

memory/1244-14558-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/1244-14557-0x00000000054A0000-0x00000000054C2000-memory.dmp

Download

memory/1244-14562-0x00000000056E0000-0x0000000005A3B000-memory.dmp

Download

memory/1244-14563-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Download

memory/1244-14564-0x0000000005C70000-0x0000000005CBC000-memory.dmp

Download

memory/1244-14559-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/1244-14565-0x0000000006200000-0x0000000006248000-memory.dmp

Download

memory/1244-14568-0x0000000070EB0000-0x000000007120B000-memory.dmp

Download

memory/1244-14572-0x00000000070E0000-0x0000000007183000-memory.dmp

Download

memory/1244-14571-0x00000000070C0000-0x00000000070E0000-memory.dmp

Download

memory/1244-14552-0x00000000023C0000-0x00000000023F6000-memory.dmp

Download

memory/1244-14574-0x0000000007200000-0x000000000721A000-memory.dmp

Download

memory/1244-14573-0x0000000007840000-0x0000000007EBC000-memory.dmp

Download

memory/1244-14567-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/1244-14575-0x0000000007260000-0x000000000726A000-memory.dmp

Download

memory/1244-14566-0x0000000007080000-0x00000000070B6000-memory.dmp

Download

memory/1244-14576-0x0000000007310000-0x00000000073A6000-memory.dmp

Download

memory/1244-14577-0x00000000076F0000-0x0000000007712000-memory.dmp

Download

memory/1244-14578-0x0000000008480000-0x0000000008A3A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads