salatstealer | 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe

Analysis

max time kernel
18s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT6).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
MD5 e6973238d03286140e2469f9616c9edc
SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
TLSH
T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 2 IoCs

resource	yara_rule
behavioral27/files/0x000d00000001c50a-3839.dat	family_salatstealer
behavioral27/files/0x000d00000001c50a-3840.dat	family_salatstealer

Executes dropped EXE 1 IoCs

pid	Process
2392	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3160	certutil.exe
5408	certutil.exe
236	certutil.exe
5976	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4100	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 6096	4100	cmd.exe	90
PID 4100 wrote to memory of 236	4100	cmd.exe	91
PID 4100 wrote to memory of 2392	4100	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT6).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6096
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:236
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:2392
- - C:\Users\Admin\AppData\Roaming\PublishComplete\agent_iomCqPKM.exe
    C:\Users\Admin\AppData\Roaming\PublishComplete\agent_iomCqPKM.exe
    3⤵
    PID:4888
  - - C:\Program Files (x86)\Internet Explorer\csrss.exe
      "C:\Program Files (x86)\Internet Explorer\csrss.exe"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:2852
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
        5⤵
        
        PID:5892
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5976
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:5612
- - C:\Users\Admin\AppData\Roaming\JoinUpdate\agent_PDGwYjFx.exe
    C:\Users\Admin\AppData\Roaming\JoinUpdate\agent_PDGwYjFx.exe
    3⤵
    PID:5652
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:1152
- - C:\Users\Admin\AppData\Roaming\JoinEdit\agent_qqdBpAwe.exe
    C:\Users\Admin\AppData\Roaming\JoinEdit\agent_qqdBpAwe.exe
    3⤵
    PID:2340
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5408
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:4620
- - C:\Users\Admin\AppData\Roaming\PublishComplete\agent_DGROisxI.exe
    C:\Users\Admin\AppData\Roaming\PublishComplete\agent_DGROisxI.exe
    3⤵
    PID:4496
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\Internet Explorer\csrss.exe
Size 3.4MB
SHA256 2a5d69aa27bc293b0baf9c76b2a3e778d1203b096bf4eaf8e458ac46638e01a7
MD5 7f74060de013e1b91ffb6da02a97b140
SHA1 835c794d0d3b7fb839bf62976f08eaaa17fa588a
SHA512 66e3717deef726cc4900cd26a22970f6a38877cf92e3fbc6d9ac6982512c608abde97343c6e7852d609fe0c22b54f45c4546f7387b51d965d768d3750e708bfa
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7j:icVUcTedI6C9e9ME
TLSH
T1AFF5C564EEEFD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Program Files (x86)\Internet Explorer\csrss.exe
Size 2.7MB
SHA256 e077d129cfb65936d5e0f59e3f9ff712fa41a6b13a148c9c02975986009aa128
MD5 2242bed8f9897ac68de42e44e1fb534e
SHA1 ec7f1d086d7d82a6c9e1b078a1aa944b5992835d
SHA512 4db21c3e906a1033632f7d65a1914b02d166e1a4559a1f136ce50e526008f8f995d8993b0bccdbb0b9f4a242ff6422ff646646bdb2253b0c4764995d113b5a78
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJv:icVUcTedI6C9e98
TLSH
T13FD5C660EEEFC1F5ED435C30115BB23F6A3526098738DEEBDB941E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
Size 2.6MB
SHA256 ded1dcb744e4fe184159b040f8dfeba0e39ce8689789fae3e203a8c05c9da75f
MD5 e3bc3913ea01ba32b38c2488ef03cea6
SHA1 a19f07cb01c1f57adf06764a888261670382458b
SHA512 8b7d7e4dce13102d94918ff0b6ba811d4a7623ae4951cf0027869b7eeafedf83a32e910ef59747688b9183e3bbefd46808270abed2ebe62e6da08410e5f9315d
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRP:icVUcTedI6C9e9P
TLSH
T130C5C664EEEFC1F5ED435C30115BB23F6B3522098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
Size 2.0MB
SHA256 6e8822b0e83e98cf48a94dad163f505e9e5c288827e6ab940392277c180379b8
MD5 b3caf13407341570b067539473183b55
SHA1 9d18f53561eac1b05f6a431797c12203fad22ad4
SHA512 3252184efecfca9771c775bfeb87320183b71ee79e26395950706c80f0a9701e32984cb42f7357fee88abbf10b572ff4e9b42846d4b10e5efc4cf558aaabfa6c
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeJ:TjycqCUjvnTGmp2TedLKtJ8CRV9J
TLSH
T157A5B664EEEFC1F5ED435C30115BB23F6A3522098B38DEEBDB941E02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 9.6MB
SHA256 6f2a62e4fd60582424eb590315ff44ea692cfaaad9feecf37090bb227bafaf76
MD5 12f1b4a64ceed14cdb08df07402c9621
SHA1 faac77549db3d6da5d3b5b73018b6d1565e8f121
SHA512 307dc7b3d205865243c8dbc453ea1cf628a5414fefbcc7eb1309c2247a42def85b44a800162c7abd1de30f41fb1d728374c0e4c87762689fe3048e03439d6066
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwd3:0bsPPSavMjysmCV3IhGjkJPna
TLSH
T178A6AE03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 4.7MB
SHA256 2fd29734bfaf8b8f7635b52fead80d486009c405d0106e9d5a238ddf17480c8c
MD5 3b53ae3793f00bbf0742eb7f34540b88
SHA1 5d655b2e3cf3221c54063111ce14eda7058db52b
SHA512 9e09e8c860fe9f34b7470f9790f34441975f367edce14d7b59447d474dac13df661d804eb94920a1d9ad0ade42a7ff82ff526cc83944f41892403f126e006f64
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8f:06GtcbPy/lwHVSaf
TLSH
T106363A13ECA554E8C0EED2758A629613BE617C89073133D36BA0F6211F76FE0AD79718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.2MB
SHA256 2892e7f29d67b5b0c826373452f45afdfcb5a7120954dd33902276d130cce268
MD5 7a4b1dc995cdcbb7077419641416b5f3
SHA1 dce93ff7dac2631c143d7ed582cc81c52ca96d9b
SHA512 c422371aa36f1d304de6d6a41e4832a9a6e91c2312f23aa8ae0078dc9759fa77b3db3dd282f12afeaaf5284ba3bf4f9c1b246e8a5bc191c92b7b4f706ce33599
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViR:06GtcbPy/lwHVSe
TLSH
T18DE5E757E8A950E8C0FEC575C722E623BEA13849433433D76FA19A201F5AFE0A5BD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 24KB
SHA256 49514ba257d1c2ad922a01d5aab06c32ec7155f71eb20da83cdebbacf04a6ab2
MD5 6dfdb65edc4e240e6aaa481204226ced
SHA1 818d474b1399fddeb6749f8db75ad535f44649ed
SHA512 9ed1201e5fe64f7b7c9391b9bab01d90e57f645f3efe47425dd9a41f4a2c90448c0d5fb3d01a292f3e475faa8397beec9cb8ac4f3d295b92b0e78ba12f47bd77
SSDEEP 384:zyaOz9rxxxh0OCFBTqbrz/mpjFa+6qZo5TdpeQZ4TuETA+mSbPXv:bC9rluBTMelFaCZo5TeWEc7Sj/
TLSH
T101B2E1D96FAB2FC48C40BC4D7636747298924DADC040F427C20EBE6883EEDB34895D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 3.7MB
SHA256 ca677889dcc31ac9906fdfbabbf7f52958b0e765e31293429dec5ecf97067935
MD5 3a0fc4d3573a7f9bab7f1ed1e0c4e910
SHA1 5e8620ecc28f1847dd98521ff9729ce541f452a8
SHA512 cddc7ec714cf1f4bb1bff85970588c862073979208af4a7d53a3a49b025960743078816b3e4d35bcca8f3f7079e8e32c146d27345dd71ea3cbc9c7ee6a116820
SSDEEP 49152:Owutu0okH4MmQup5k/XqC0+lHPBdwrvOpIkd/mM3ccqdfW/1G/88:T
TLSH
T1080622715AC73D3F0A742D18D10EBBD5EDBA1A4F8457F28CEEE104B5229AE810F1A5B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 98da91450c15ca2772e113c168b8c5667b4545b912503a5bb099d29f823acc47
MD5 b980045e76c4cf67e3e213204e22eba3
SHA1 0a595623d81bf8a223c19941a1100fe0350347c2
SHA512 8e1bd62cebf0cf1328aa84572d617725654ebca5885a1c81acea4b9d28353e8d6bacbb4bdd3a55daf44ef18066b66d6c2d7517e170f1610d1972e8cb31abc49e
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmalEDhQjl1vsli:SJH9XuutQyGMNroE3O8tHEi/maleqUli
TLSH
T12A926D744AE33CFD3E8C7C5061201DAC5EAC6F8754694209ABC838F693D85ACCE5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_k2llhqru.afg.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2llhqru.afg.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_qqdBpAwe.exe

Path C:\Users\Admin\AppData\Roaming\JoinEdit\agent_qqdBpAwe.exe
Size 3.4MB
SHA256 ac9b87583e18af0dd6ba5ed5f6d19cbe78ddf5953e2dd56dc8f27ec83215d83b
MD5 1c8ca4c06f04e16e3c76c46a642f4320
SHA1 0346e7aaf41a1ef922e32f03addebe6c06ecedf7
SHA512 8c799780878ec97fe72b5e7d8557285ba9d2dfdbc54c0720f65af5e424085509f53d5b04d59a68e19c5a9a07925a67c96dec01b4c1b478097e10630a805e57a1
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7W:icVUcTedI6C9e9MB
TLSH
T1E6F5C564EEEFC1F5ED035C30115BB23F6A3526098738DEEBDB941E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_qqdBpAwe.exe

Path C:\Users\Admin\AppData\Roaming\JoinEdit\agent_qqdBpAwe.exe
Size 3.0MB
SHA256 4a63c13ba9be7077fd6e4e00bd78f5a8ba1d8245b5d64799889d31de3cf45c09
MD5 298358de41a00e43a957e8963b62b5f4
SHA1 9c05157fdb522242c63e30b577bd11515e85151a
SHA512 5ec557d88882eb19caeb90c948c9e90358495c6c7771a01803986ecf817ebb8ae42e3d0baa5f0b373ed6c9918e1677e89caf61e670b8a3c372b7897923a337c5
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy+:icVUcTedI6C9e9M+
TLSH
T163E5C664EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_PDGwYjFx.exe

Path C:\Users\Admin\AppData\Roaming\JoinUpdate\agent_PDGwYjFx.exe
Size 7.9MB
SHA256 71ac569dc1b72e4b8b2b171f73fad119ddf5e894f629e8f196f92a41fbe11fd9
MD5 7722689e73a8614b683cc51d981f9573
SHA1 20e88e9fbbd6ac0facbc0f1a85d4943685253efe
SHA512 fbbcc1d9562961ba143a1ea9bf6e59f67f49d8eccf3a5e03c143dbdfa17ba199eeacaa6b52e8e28252f18cf01f28f442ee4ad37c400ae4a43050f90632f2a12b
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfl:icVUcTedI6C9e9MQR7t+cR
TLSH
T167860821EADB91F5FC035C31115BB23F67351E048728EAE7DB543E43E47BAA218BA605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_PDGwYjFx.exe

Path C:\Users\Admin\AppData\Roaming\JoinUpdate\agent_PDGwYjFx.exe
Size 7.8MB
SHA256 2eced2c2c20b34a1ede7fdccf7c26bb1e15ef85cbbdddb94a2c1b185f641a997
MD5 4299d70fa603acbe2bdb77cfe15e88b5
SHA1 dd26b4f4215f79f9c7a69b90f81d9c552c817a3b
SHA512 0d4d2e746a3dcc49b603d34376e558725322a09393bcbbcb8c457eabd257b2055adb4b3940d4e0a1d43f4de5200c7c7362c283fc470bb9d52b0b0b8b5bb28bea
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFf3:icVUcTedI6C9e9MQR7t+cz
TLSH
T187860721EADB91F5FC035C31115BB23F67351E048728EAE7DB543E43E47BAA218BA605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_PDGwYjFx.exe

Path C:\Users\Admin\AppData\Roaming\JoinUpdate\agent_PDGwYjFx.exe
Size 8.3MB
SHA256 28e5f15acad9084163aacf4c81e04e895c929b8c2f638bc10014a79ef168db3b
MD5 0bde9eb031a0ffc8d5b91df4a93d3186
SHA1 fe9f1875863ff5785051581dc282e32632c9daf6
SHA512 02c598b930262d74aecd4ad3f3472f611ca61fad32dacf828464644b7ae7af7e69be3983140bc5ece3aba38db8beb50e34bacb34e39ba386e457ba65896c5d01
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfC:icVUcTedI6C9e9MQR7t+chg
TLSH
T18D961821EADB91F5E8035C31115BB33F67311E048728DAE7EB543E17E87B6A21CBA605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_DGROisxI.exe

Path C:\Users\Admin\AppData\Roaming\PublishComplete\agent_DGROisxI.exe
Size 2.6MB
SHA256 4837a9b4599e479f7176727989b0661a969e8832b68842b20e51c5c35157ad6c
MD5 54edd9604a97e8be414ce2ef567d82a5
SHA1 6b6e655e7d19de5d35eb43036468dc655942fb72
SHA512 c6d557cd391f85b72b0c6e1766e53d1b41cc2d81b9fdf9ef5559eb6dcfd53b58039882842518fc0fc479914c64add5fd7117915a0bf77048642421cf4d604039
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRo:icVUcTedI6C9e9o
TLSH
T1CAC5C664EEEFC1F5ED435C30115BB23F6B3522098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_DGROisxI.exe

Path C:\Users\Admin\AppData\Roaming\PublishComplete\agent_DGROisxI.exe
Size 2.9MB
SHA256 40cffbab2988cd3db15bcb83a422d4d1d314f390dbc8a6b9e881354989d26bbc
MD5 aecb054f158d61827d3ccefa821ba359
SHA1 42e92a31f3dd49f61cb1ef4e9f7b972f21929c68
SHA512 14a725cc86cdaaf6036edd12133e17ab54dd4cc83443f05f953a8f868729b6bcb756bd503c314757596551dde5ca67e96e735c48ef80e6c77238ec8068d6d403
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIS:icVUcTedI6C9e9o
TLSH
T12BE5C660EEDFC1F5ED435C30116BB23F6A3526098738DEEBDB941E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_iomCqPKM.exe

Path C:\Users\Admin\AppData\Roaming\PublishComplete\agent_iomCqPKM.exe
Size 11.0MB
SHA256 02db7c39e4bb1037ff8f98435306f2eaffc4faccef9d5f1a58bf0fbf8840a292
MD5 835fddeb1d3af9a16fb7891c54dfbf36
SHA1 02c858c3ca469e246c535cdcede11b12a5f37a65
SHA512 956d205660b88e314eb6363ac496f9478cba164cee204b0fd1d35cd5bac5f11f1df042b27141868eb0ebbdd3c7632a3441885b788f429bfe73a649fae3ea3268
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfQ:icVUcTedI6C9e9MQR7t+chQa4NG20s
TLSH
T1DFC65A10FEDB95F2E9035831416BB23F27315D048B28DB9BEB547A2AF87B6911C7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_iomCqPKM.exe

Path C:\Users\Admin\AppData\Roaming\PublishComplete\agent_iomCqPKM.exe
Size 9.7MB
SHA256 a82ad6e456bb3e51f6170ac14acaef9b3ad96f46b97e5df796474ca8fddd09ae
MD5 5fc47e5ac1dd4e159f16e09d78a5fb45
SHA1 18b0fe5709b40beb706efa144c3079429cc6431d
SHA512 d056ef72923b48bb1f158801a0be180af028d9b577e4c76f282e963d8544610a8d20475a137909ce81c3d1089a4cac196611b94b43f91c5dbc2396bad1ad5a5a
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfw:icVUcTedI6C9e9MQR7t+chQa4F
TLSH
T167A63921EADB91F6ED035C31116BB23F27315D048728DBEBEB543A16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-4828-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/2852-4831-0x0000000006140000-0x000000000649B000-memory.dmp

Download

memory/2852-4825-0x0000000005950000-0x0000000005F9A000-memory.dmp

Download

memory/2852-4827-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/2852-4852-0x0000000008E80000-0x000000000943A000-memory.dmp

Download

memory/2852-4826-0x0000000005830000-0x0000000005852000-memory.dmp

Download

memory/2852-4839-0x0000000006BE0000-0x0000000006C28000-memory.dmp

Download

memory/2852-4834-0x0000000006620000-0x000000000663E000-memory.dmp

Download

memory/2852-4835-0x0000000006680000-0x00000000066CC000-memory.dmp

Download

memory/2852-4851-0x00000000080E0000-0x0000000008102000-memory.dmp

Download

memory/2852-4824-0x0000000002DF0000-0x0000000002E26000-memory.dmp

Download

memory/2852-4847-0x0000000008240000-0x00000000088BC000-memory.dmp

Download

memory/2852-4842-0x0000000070A80000-0x0000000070DDB000-memory.dmp

Download

memory/2852-4846-0x0000000007AB0000-0x0000000007B53000-memory.dmp

Download

memory/2852-4845-0x0000000007A90000-0x0000000007AB0000-memory.dmp

Download

memory/2852-4850-0x0000000007D00000-0x0000000007D96000-memory.dmp

Download

memory/2852-4841-0x00000000707D0000-0x000000007081C000-memory.dmp

Download

memory/2852-4840-0x0000000007A50000-0x0000000007A86000-memory.dmp

Download

memory/2852-4848-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Download

memory/2852-4849-0x0000000007C50000-0x0000000007C5A000-memory.dmp

Download

memory/4724-4811-0x00007FFC6D4F0000-0x00007FFC6D7F2000-memory.dmp

Download

memory/4724-4809-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4724-4807-0x00007FFC6D4F0000-0x00007FFC6D7F2000-memory.dmp

Download

memory/4724-4808-0x0000000100400000-0x000000010043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads