salatstealer | 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05

Analysis

max time kernel
28s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT3).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
MD5 aa4abe5d986341f92ed5529c58002d5c
SHA1 1d369c8ccbadfdf69d47f27aef30159b7f022243
SHA512 6a67fd0193098890cdba4c0c6a51114eb7f10158d57f078c516a7a303bbff516ef73c7c478c9103d29c7d39b7168f7c26e4980c6389c4639d21583ec5fa86681
TLSH
T1AA719E93E00DDE07F4CD6C3EF84FA6B5201788872CD6C851539B49E8C84EDBA6D4B085
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral20/files/0x00080000000243f2-4604.dat	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
1636	Setup-bTbvWlUQiXYpayRj.exe
5060	agent_mWMdNyQa.exe
1188	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4472	certutil.exe
4880	certutil.exe
3512	certutil.exe
1548	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3116	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_mWMdNyQa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_mWMdNyQa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_mWMdNyQa.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1468	3116	cmd.exe	83
PID 3116 wrote to memory of 4472	3116	cmd.exe	90
PID 3116 wrote to memory of 1636	3116	cmd.exe	91
PID 1636 wrote to memory of 5060	1636	Setup-bTbvWlUQiXYpayRj.exe	93
PID 3116 wrote to memory of 4880	3116	cmd.exe	94
PID 3116 wrote to memory of 1188	3116	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT3).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1468
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Roaming\UnprotectReceive\agent_mWMdNyQa.exe
    C:\Users\Admin\AppData\Roaming\UnprotectReceive\agent_mWMdNyQa.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5060
  - - C:\Program Files (x86)\MSBuild\SearchApp.exe
      "C:\Program Files (x86)\MSBuild\SearchApp.exe"
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:2624
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:1960
    - - C:\Program Files\Google\Chrome\Application\SearchApp.exe
        
        "C:\Program Files\Google\Chrome\Application\SearchApp.exe" -
        5⤵
        
        PID:4508
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4880
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Users\Admin\AppData\Roaming\RequestLimit\agent_tbwHuaYj.exe
    C:\Users\Admin\AppData\Roaming\RequestLimit\agent_tbwHuaYj.exe
    3⤵
    PID:4952
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2452
- - C:\Users\Admin\AppData\Roaming\SearchUnlock\agent_qqLrafwm.exe
    C:\Users\Admin\AppData\Roaming\SearchUnlock\agent_qqLrafwm.exe
    3⤵
    PID:4608
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1548
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2308
- - C:\Users\Admin\AppData\Roaming\StartOut\agent_esoAnnWZ.exe
    C:\Users\Admin\AppData\Roaming\StartOut\agent_esoAnnWZ.exe
    3⤵
    PID:5072
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  PID:2184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchApp.exe

Path C:\Program Files (x86)\MSBuild\SearchApp.exe
Size 7.3MB
SHA256 3364075419375a9c8a1a584cdfe50b0da27ccf11631f7b0e2d931db9df592b6d
MD5 897abf472afba31aac60dfe0a3f8e72f
SHA1 9f614c6fd738906c8f3ff410dbdf6b0460091726
SHA512 ae95c6dcb3b15af13c1476775f7def42b9253c2a294d0b2486443975c5d5f51c0170e67b320d980add3329c64ace9f23cd9faf3afde3eed9a1ad4147b35872d2
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfO:icVUcTedI6C9e9MQR7t+cS
TLSH
T1B6760721EADB91F5EC035C31116BB33F67351E048728DAE7EB943E03E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchApp.exe

Path C:\Program Files (x86)\MSBuild\SearchApp.exe
Size 5.9MB
SHA256 5c3615b5f34239cdfcc8956a746a6e7ddc415f86d236ae271914a46462fcf9c5
MD5 ed50d474bc6da17e557e6840b187a302
SHA1 b1343d110a945ce0d4ad5dcaaed7eede68526c46
SHA512 068545192145ce659ec794c57df2441a6f24e3ab27e2a605bc0867e50cc958e859d77ffb0b9d896f3b2dafcbd765d6be0c1d312392e52bea4a7f351b5bb41f5e
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFo:icVUcTedI6C9e9MQR7t+cc
TLSH
T11F56B420EEDBD1F5ED035C30215BB33F6A351A098738DAE7DB903E06E57B6A21876605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchApp.exe

Path C:\Program Files\Google\Chrome\Application\SearchApp.exe
Size 1.5MB
SHA256 d6180c12bebb57e2e3776a13f117f902d18ad906e477113f732c955d245469d5
MD5 db193318ac6f6c42db6cb2803e664b34
SHA1 bcf8d6c20aab88fc26759bf1828130e38e95cba8
SHA512 5441c7ce37f12cbb67155fa8a1d17010fc37227cfb8bd955d312c9f769c8a459ce9ca4c9d8171d6e017b2d3206438bf8d20fa918f56e4a544011763c9b11680e
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeQ:TjycqCUjvnTGmp2TedLD
TLSH
T1E075A665EEEFC1F0ED435C30615BB23F6A3522098B38DDEBDB942D02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchApp.exe

Path C:\Program Files\Google\Chrome\Application\SearchApp.exe
Size 1.7MB
SHA256 a1a0174a91e0fd5fc2d2183be202ada854580364c4e531c0da48ae358f2a31d8
MD5 867cae22816f269fe0817a733e2ed840
SHA1 a67fd71ed5dbf9b0d17d9b307c98bebea1ccc629
SHA512 7d43e7cdaf294c450290476dbd0dbd6f27623b09bb28e3954429ed59ce11188e310df8eeb07ca6e6ba08a805949edfadc29d75fff370d913cca8ee7f4bbc9a65
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVea:TjycqCUjvnTGmp2TedLKtI
TLSH
T18485A564EEEFC1F4ED435C30615BB23F6A3522098B38DEEBDB941D02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.0MB
SHA256 d64271a3f125f3f5b366000bb9a96a28763c04870132edec5ea7632cd3d1c530
MD5 6aee94e3c736b30e45a34ccc0e449e73
SHA1 64963523b34f82ebadd640a429478e8fad402822
SHA512 8547dd7f315d7257ee28d84b1263e4cd233e16faf9e5ab852c30af92c081a6d2edf7798d95fcd80f3071f8009fe4156189f0e4159f6c444fa021975b75879315
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViE:06GtcbPy/lwHVSn
TLSH
T1C5E5E757ECB950E8C0EED575C662E617BE613849433833E76FA19A201F1AFE0A1BD710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5329989d7c1e7ce3f4ef6f1fdbb6c89ade256ac0938b6e3f692a4cf0e3c165fe
MD5 c00cf29117fccdf1a757752671155279
SHA1 06f8c409b92c9858e8db2c29e0ddaad44ccebdcc
SHA512 5ad094e2911874d28d95507fd1a483babae915d0484aaed5ecc533e1f2011bbcc706597552589321d615d5ad6368c71afc2a465287d9e7b5e5c664d902cb01c4
SSDEEP 384:tVfgeJPT3+gnwFnw5rI3jNITxhV/9ZwZYqQ/E3CfVIvb9Rgr5bdVe7:nfxJ73+gwRw5c3R8TxGCdIvb05M
TLSH
T11072C73A026B75BC38AD4C03A103060D1E5E7A1E217FDB5A76C4357EB7A90E48E59F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 11.9MB
SHA256 e480068b1794a2cd87df627114191fb065ffd5854f676548167652fd42decee4
MD5 f904118c8948173f8ca9c3ed9f95b991
SHA1 5ff515d3263fa9a5a106dfbb7dbc1e614d292273
SHA512 38e83e89f957d73cbce30147b7120fa7620346ec239e88d9f8b05da77c06cbe77e719e0097bd11a59ae1abf2fa583fb37ad89ff4cd307af789344b677db4618d
SSDEEP 49152:BN304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfM3:l
TLSH
T1C3C6D0720243FDEE2F6A1D44D0083E815C9D7A5B52A4D299FF8D34BA22EE564DE3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 9f6b5cdb7dc919f22cdd3abf340225dbc89f9602200237de18172462a582ec9a
MD5 b0aa3927111c4a109cbc80f5925b13a0
SHA1 b5fa90dba5caaf75fe0e496c5152c3d13018271a
SHA512 ef6e6c3e8a92829fc132d3fa7778fda84d86e244f72daff3e026575ca35a81711b09fddc8167a4801821494c595832aa43731cc11fa78fde7e8f9f86642ae831
SSDEEP 384:zUrsrFGiW7vNj8R79M3QHM9um97f6EVZQnwC/GZs6t:zHIiWbl6M3UCZgWsm
TLSH
T122725CBBB712DDB91F4054E668CA04D55C6CBF0340F591A8230E49E5229BF792AEB4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 9.1MB
SHA256 b2fdf2bcc221eda4c85d504a5b8ad2a1fef1a59e2648641a2d61676da3bd6882
MD5 20b0f0d84f33c2230f21989840673c11
SHA1 daf1e46dd18d2067fe31a9330aa693e026ade860
SHA512 d8500db51e44bba48454dab0e10e38ecea752d4f1afea64d291552f728171fb14d5a1a17cd1e7f2cde02cc9e478d4b700324944e939834cb4e24a17c4df8090f
SSDEEP 49152:1jPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSycLXypwutu0okH4MmQY:n
TLSH
T1A6A6F1721643FDDA5F790D45D0093A815C9C796B5294E2E8FF8E31AB31EA610EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 3.0MB
SHA256 2e9d5db764cd967fede93185cce49dd06becf41c085efd69b54fbff221ae8a2c
MD5 2cdfa4c6803a4205f45178d129d6798c
SHA1 5c0351bb35794423fa36030123600f1d6cac820e
SHA512 11d8eb5c8cd1f8cb90daf9cbf72c2f79ac0ef3969a2dc56866f66514adb2f4eab29c5f0bbd16a44363c7b28fd1fbd515a1583e387aaa5f760da5db5455b9080d
SSDEEP 49152:0Qup5k/XqC0+lHPBdwrvOpIkd/mM3ccqdfW/1G/8I:w
TLSH
T175E5237159CB7C6F0A746D28E00EBFD5EDA9290F840AF38C9EE614B72156EC25F06970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5943092a651dff44a46113011e6008bf346f6b7bc4c8aca3231bd43ffd869617
MD5 a35222d65d11ee8382a52e037da76064
SHA1 cdf5c93959feae8793dd0743c683ff1aaf96a6dd
SHA512 0cf094040a70c476b07619a0ff36cc5126d058a58a5c37d4bfc63a2f35f3beb87c62944d0a5609b186718251ee86adcb994d12161fde5021a140c74dd3c2cae3
SSDEEP 384:MoGtQXwI4P2pExKnO7NQSUKZPc1uz9ZAeACPU421PK:a4wObO7GAZ01Och4mPK
TLSH
T10A72CFEB2C971D91F4B0952B935BC067F071A17B361B5C2B4A01BEA35F82B03A4F3526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_syjpnxnk.2cm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syjpnxnk.2cm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_qqLrafwm.exe

Path C:\Users\Admin\AppData\Roaming\SearchUnlock\agent_qqLrafwm.exe
Size 6.9MB
SHA256 cc6df0f15c143bb8b7ea47fec6991d0946251d46dbe9b1afb51347db2fe670a7
MD5 abd3e545063ec1074606509baac331c2
SHA1 061de5f46aa2c45649fa29ccecc41f32ee86831c
SHA512 3a10cd0d2020ff26985f3f37fd8bfc9584ee37629d236a4a4d59521e875c7084c024013010014377ff8e417bd4275ce87df26dcd98169035c28b599d18f63350
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfw:icVUcTedI6C9e9MQR7t+ck
TLSH
T1FC76F620EEDB91F1EC035C31116BB33F67351E058728DAE7EB943E06E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_qqLrafwm.exe

Path C:\Users\Admin\AppData\Roaming\SearchUnlock\agent_qqLrafwm.exe
Size 7.2MB
SHA256 137fff00cd3e50c272b0e9d8c1fdc60df21aaa4487560b00273e612bcce51cf0
MD5 7da6ed3a961dbcff11afb4763537ddb0
SHA1 f6045f229fb3dfca75502e6f24e5e0771b718921
SHA512 d7b1e5131d32a285d038801102c1863fe5a80648c5fae4b976b31629074f0a5402322556a861c68bb20bd96049b5e93494b8352a0c290f3268e79e97c9b59959
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfL:icVUcTedI6C9e9MQR7t+c3
TLSH
T1C4760720EADB91F5EC035C31116BB33F67351E048728DAE7EB943E07E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_esoAnnWZ.exe

Path C:\Users\Admin\AppData\Roaming\StartOut\agent_esoAnnWZ.exe
Size 2.0MB
SHA256 b4ae081c469f177d46be41eea10afaab94e956b0260ede2653c2fc25bb899a46
MD5 8beb05e9debd524e4dcdef204e62a1a5
SHA1 5983c142615df6a0830c29464fc0cf24a3c1f3a7
SHA512 a13b1c0269de1de8040c4731b48b5052580c330e7274f39204774effef8d9ddcc27f69038207609b4b83db7dc36c437f4a85ede7a9b740e59f2dacb72ef0937a
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVej:TjycqCUjvnTGmp2TedLKtJ8CRV9j
TLSH
T1FEA5B664EEEFC1F5ED435C30115BB23F6A3522098B38DEEBDB941E02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_esoAnnWZ.exe

Path C:\Users\Admin\AppData\Roaming\StartOut\agent_esoAnnWZ.exe
Size 1.9MB
SHA256 67326f9c8b75d39810dd51218bc2cd44cbbcf52626ac5ed2e5dfde2e2af0b331
MD5 a101fa5dfff78770bd851c821770ad33
SHA1 d41f9061a7d6a05629ff7ccb5dd6c25bbe09e930
SHA512 b195b3ec4ceb58043cd24283e76468dfc46a9e0680435c56bf4450c159767cb7bafa6ea4f99400ff40d651945be2965a58ff318bc764354e6551491b319a1354
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVe+:TjycqCUjvnTGmp2TedLKtJ8CRO
TLSH
T1DB95A564EEEFC1F4ED435C30615BB23F6A3522098B38DEEBDB941D02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_mWMdNyQa.exe

Path C:\Users\Admin\AppData\Roaming\UnprotectReceive\agent_mWMdNyQa.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2184-10027-0x00007FFAC0F70000-0x00007FFAC1272000-memory.dmp

Download

memory/2184-10028-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2184-10031-0x00007FFAC0F70000-0x00007FFAC1272000-memory.dmp

Download

memory/2184-10030-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2624-10041-0x00000000055E0000-0x0000000005C08000-memory.dmp

Download

memory/2624-10070-0x0000000007AF0000-0x0000000007B93000-memory.dmp

Download

memory/2624-10044-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Download

memory/2624-10037-0x0000000002BF0000-0x0000000002C26000-memory.dmp

Download

memory/2624-10043-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Download

memory/2624-10052-0x0000000005F20000-0x0000000006274000-memory.dmp

Download

memory/2624-10054-0x0000000006560000-0x00000000065AC000-memory.dmp

Download

memory/2624-10053-0x0000000006520000-0x000000000653E000-memory.dmp

Download

memory/2624-10055-0x0000000006A80000-0x0000000006AC4000-memory.dmp

Download

memory/2624-10056-0x0000000007850000-0x00000000078C6000-memory.dmp

Download

memory/2624-10058-0x00000000078D0000-0x00000000078EA000-memory.dmp

Download

memory/2624-10057-0x0000000007F50000-0x00000000085CA000-memory.dmp

Download

memory/2624-10060-0x0000000070AC0000-0x0000000070B0C000-memory.dmp

Download

memory/2624-10042-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/2624-10069-0x0000000007AD0000-0x0000000007AEE000-memory.dmp

Download

memory/2624-10071-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

Download

memory/2624-10061-0x00000000712D0000-0x0000000071624000-memory.dmp

Download

memory/2624-10072-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Download

memory/2624-10059-0x0000000007A90000-0x0000000007AC2000-memory.dmp

Download

memory/2624-10073-0x0000000007C20000-0x0000000007C31000-memory.dmp

Download

memory/2624-10074-0x0000000007C50000-0x0000000007C5E000-memory.dmp

Download

memory/2624-10075-0x0000000007C60000-0x0000000007C74000-memory.dmp

Download

memory/2624-10076-0x0000000007D60000-0x0000000007D7A000-memory.dmp

Download

memory/2624-10077-0x0000000007C90000-0x0000000007C98000-memory.dmp

Download

memory/2624-10083-0x0000000007D60000-0x0000000007D82000-memory.dmp

Download

memory/2624-10084-0x0000000008B80000-0x0000000009124000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads