salatstealer | 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5

Analysis

max time kernel
32s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT8).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
MD5 a2865133b7b6bc0adcc51acb7d64ae20
SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
TLSH
T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral30/files/0x00070000000244fa-7497.dat	family_salatstealer

Executes dropped EXE 5 IoCs

pid	Process
4348	Setup-bTbvWlUQiXYpayRj.exe
1608	Setup-bTbvWlUQiXYpayRj.exe
3872	agent_NcIhNtXF.exe
4888	agent_mqyumMpq.exe
2688	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3044	certutil.exe
3044	certutil.exe
1804	certutil.exe
3984	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3432	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_NcIhNtXF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_NcIhNtXF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_mqyumMpq.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_NcIhNtXF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_mqyumMpq.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 5036	3432	cmd.exe	85
PID 3432 wrote to memory of 3044	3432	cmd.exe	91
PID 3432 wrote to memory of 4348	3432	cmd.exe	92
PID 3432 wrote to memory of 1804	3432	cmd.exe	95
PID 3432 wrote to memory of 1608	3432	cmd.exe	96
PID 4348 wrote to memory of 3872	4348	Setup-bTbvWlUQiXYpayRj.exe	97
PID 1608 wrote to memory of 4888	1608	Setup-bTbvWlUQiXYpayRj.exe	98
PID 3432 wrote to memory of 3984	3432	cmd.exe	100
PID 3432 wrote to memory of 2688	3432	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT8).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5036
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Users\Admin\AppData\Roaming\Sun\agent_NcIhNtXF.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_NcIhNtXF.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3872
  - - C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe
      "C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe"
      4⤵
      PID:1836
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:4920
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:2240
    - - C:\Program Files\Google\Chrome\Application\fontdrvhost.exe
        
        "C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -
        5⤵
        
        PID:1264
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Users\Admin\AppData\Roaming\MergeReceive\agent_mqyumMpq.exe
    C:\Users\Admin\AppData\Roaming\MergeReceive\agent_mqyumMpq.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4888
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:2688
- - C:\Users\Admin\AppData\Roaming\PopOpen\agent_ChsgrmuG.exe
    C:\Users\Admin\AppData\Roaming\PopOpen\agent_ChsgrmuG.exe
    3⤵
    PID:960
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:3168
- - C:\Users\Admin\AppData\Roaming\Microsoft\agent_AzbnCsOd.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\agent_AzbnCsOd.exe
    3⤵
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
Size 2.2MB
SHA256 f9d242ef39efb6fc4d6e429bdcfc2f1529e1ccf460cef9473865b6404e1cd126
MD5 db7b4eab55cec5ec310ae607391ef9b9
SHA1 86589227869a6d99a85a07dba17b6c9c916432da
SHA512 9addb58cb5a111c8d61e750197e568ed9e3978bc92d28bc186c52cfbaaa3e2f7614936feb11579af489fc83c66291eb461373c502cdaf53ace2230471dbfb545
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeK:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gx
TLSH
T1D9B5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
Size 2.0MB
SHA256 0b1eb8d5fca9663ec06fa967575d4256eb41b908dd79234bc075129c35ff114c
MD5 0f66736bf50308932394eb41787a444d
SHA1 87881f040ee18fcc874a37b0df42419383f21b5e
SHA512 1c69d4f1395a81f35bf6d5e5c96057896b8608de48c4559d1300a7c794194f8f2d051af81cc5b43b28c84e3cc12d4c8a669ae531599285a4111d928e2bad4247
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVe2:TjycqCUjvnTGmp2TedLKtJ8CRV92
TLSH
T128A5B664EEEFC1F5ED435C30115BB23F6A3522098B38DEEBDB941E02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe
Size 6.2MB
SHA256 b84ce617785d0a4f9e6599afa87c6ea1b5da009cfe598339c2a374bb9783dc3f
MD5 bf5db86b2445527863c77ab5ee0dc4c5
SHA1 ea4986eddbf226f192a5467332f13ff03e3e6b64
SHA512 76cebc4166a979648d17c2e8030b25257f6bdb12ba8ae9fd33c9ee307e6f27f89a6d979a6dbd4e0002002a2a1d76a8142ea3cd44125a528ff3ec832348bec697
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfB:icVUcTedI6C9e9MQR7t+cN
TLSH
T18256D520EEDB91F1ED035C31215BB33F6B351A058738DAE7EB903E06E57B6A21876605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe
Size 7.1MB
SHA256 57cbd317d1761e4290f077ef73b55272fe8479d20f068a0d87e093bcadc97d82
MD5 64049f0bb4a0c526f240e7ae89d68782
SHA1 c0fdf37979586f8539446c1314e4f4ead1fe07db
SHA512 933bf3926372baf89799aec4419e444221fd9fcacd09aa632009c4c47c2d885a1ffa7d3a0c0aafb0fa1f6da6bb0ce6359cd4506321bcd5f5c155e45ad038e0bb
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfo:icVUcTedI6C9e9MQR7t+cE
TLSH
T152760620EEDB91F1EC035C31116BB33F67351E058728DAE7EB943E06E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Program Files\Google\Chrome\Application\fontdrvhost.exe
Size 2.1MB
SHA256 6c567606a8ec558af400dca6bd614c023cf1f77c54c273bd60b89161b20c21a7
MD5 e2b080823c40d742d4417f231eb489a2
SHA1 88c591abaaaca14dee7b305df820c230f15cd743
SHA512 619dd8d7ac1b10ac76e064ab1eea86f99091b5aefaf6cd649727884104cbf5320ea2482a66b814163c1c2e20cdc29b30b5049771dcf26cd42351e48e61db44fc
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVe+:TjycqCUjvnTGmp2TedLKtJ8CRV9+
TLSH
T14DA5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\Program Files\Google\Chrome\Application\fontdrvhost.exe
Size 2.1MB
SHA256 c1697ade3a31e2cbf7bce4efef80d0f6a2c229af2b9f3a8038b3f669bf579abf
MD5 4e445ebc5d26be40a7e0b17ed890b701
SHA1 a1f8704796c999f82c935e9c905dee4ab7b5c02a
SHA512 b9b250ba97cccbcb05d94f04a3786797b51390a8fc0fa488cf84b719e3ca440bf6b8a3254938d6d67d6b38c52da777365ad48a192712cb8af32c160ce45ac565
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeJ:TjycqCUjvnTGmp2TedLKtJ8CRV9J
TLSH
T14AA5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 7.6MB
SHA256 d10314ea8ea6bde2d75067935204d03887f29fdf0b5618173cf75806756c9c5b
MD5 c69f8144618ba9c323604b9d7123a515
SHA1 5827da7e5ea3cc2bc21dc0acd64bf37807192d31
SHA512 07aa6bbfd49801b815254144afa8794d76b6918865e608286ef117dc643f988db40efb480185dbb4441f362cf6e25aed870243385b74f745f91213c82cdc7108
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505Px:0bsPPSavMjysmY
TLSH
T19E868D03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 9432cc8f66df479c053150eb2e94cc59cf1767e973376905f7776667821cdbb8
MD5 ad753b81487fbd621eddf7fff62d0de1
SHA1 df0b8f8317728878f7e049d26f141cdf45ca015b
SHA512 ae0010898babfb48cb0e142b44b6f0449bca0071d77b18d292d365055a49aa9885325c0e2005c3823296faa43c8990150f013c27dba8134f93c2547026ed5831
SSDEEP 384:3qbClnFe1ER00R3zLmVGe0Cpl6tcpb7IBWNQJ7/ErR9Gd:abClFe1ER00pmd6KpbQWNQJgt4d
TLSH
T18972F87ACBB72C3A39EC78CD5C808D859D6E0D070AB590D8E78581F2A39C2A445FE771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.3MB
SHA256 2b94e4efa57e5c3e604c908ddadf221e6bc2570f251e365286c1456bee620c0a
MD5 43518380c38461d1da7f4b1f3d244cc1
SHA1 bb99008de3e9b38d9eab1fb1161db99e57536209
SHA512 e3b5b78aa90d6fd8469b4ae31a6793c8c1c47d8c7250bcb51fc0fc7d3509e23e44c0294fb79e1a5b8b1b6dec57569a783b36477ecca9acf765d88ff80643f80c
SSDEEP 49152:60V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvY:x
TLSH
T1B6E6BE320683BDBD3FAD3D45E0012E495D9D7A0B11A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 11.1MB
SHA256 051b3db1158e40122d3f71d143592a35ef8008a080023f4d2ec64cfc429cb41b
MD5 2439724f0c3aa7d7849eb1c63497f637
SHA1 ae1403646de9faede7fbc204cb792d2c130c32f2
SHA512 527ba8e8637630c5b066ecb1ad6e9f15014e238cf8b89d30083ba4c315b9818e3a0868885454fffba0428b00cc112073d9dc4c0e9001f64304c169668bac2966
SSDEEP 49152:pRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSyc7:I
TLSH
T14AC6D0731643FEDE2F660D44D0083A815C9DB95B52A4E298FF8D35EB21EA520EE7C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 869ff12a1228f06a5ec050ad5bc5e2668b5c9ddacfeaf68e8e4fdbf9acd79280
MD5 1fc4066b8a77469771fe9b5a2e9ee11e
SHA1 2d74ea9df12c0a3d9071d2b400f5c438d77f858f
SHA512 2c6a6574217d9b45682602f14314c9461129f82bb4daa42ea295ceada076ff8a62d8c816ff565d94650ad52a7ee10a5d7c5d9b538af1c2dc9606712c05244b0e
SSDEEP 384:kMxLlCeEQxkgzyv5RdLdi7wdH09LM7TwuNYtug7+FGmo/K8eaKuB8wWWLGaXfgC:hlCepFq5D4kU9I7UuNY8ghmgK8e+8wWC
TLSH
T1D8926D2E52903FB46CD4598CECB7383E672D38EB157102DE4F4F68C894A11BC29B499D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 a0ed8721a09f49b6938556af7f858b007ce1399287cfc64d0a65e94b5ed35dea
MD5 ed5f6020d188214ae859b2635db71f16
SHA1 b9d5689578019b0b52cd5634754a1e106a2ae61d
SHA512 af1491936071f0458225281f3adb84a139745e783bf4c5eecf7b4cf12773876ee81af2e24b8df01cb5a1a8b513705065cacaed6c4030ae56f734ab3cc25279f4
SSDEEP 384:g0GgQO6S64646m8ICOlmCnkivf7mTCr0K8F6jtHW:Nfnxxsemqk6f7Ww0K8F6jtHW
TLSH
T1057273371A324D546E49B6B47D8879BBE24CF31609FB034ACE8B3C058DFA5B54E31169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 7.8MB
SHA256 d271c07530eb3b2c5909c550edf05b69aad55652f7ca6863162fc752329f002a
MD5 190ec79f397ac8389f5e29f0b8de6e24
SHA1 63866101dcc32371b158935b931bd19638a49ddf
SHA512 c2c846e0e201aa1eb473e1c8fb5b91d6d1243b39e851d9a3cf0f2f176a003a0525edb9bf6b5f3d0a2c452775bbd0be94723390357df6e81bbf72b6da86c4c5c7
SSDEEP 49152:0NRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSycLXypwutuZ:H
TLSH
T1DC86E0731603FDDA1F994D45D00839816C5CB96B12E4E2E4FF4E75AB60EA624EE3C8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cj1k4les.qh5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cj1k4les.qh5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_AzbnCsOd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\agent_AzbnCsOd.exe
Size 4.5MB
SHA256 4f6816eb55e9ed89a562fce4b140535a3e838988a4d26c7f1239742dd192d099
MD5 9191ccd63328d535988e330dce19a033
SHA1 da46ec2c4bc616f6894f74c642af623b08e97dfc
SHA512 7930b108a03c1cd3830dca9d65a86e955f18e7e565fb48313a36cd0693e8e221b83655acb2968c363e390b0bb464c106bbd45a15830ec76c6f404c12be1252ae
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhVA:icVUcTedI6C9e9MQR7tA
TLSH
T17A26E764EEEFD1F5ED035C30215BB23F6A3516098738DEEBDB901E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_AzbnCsOd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\agent_AzbnCsOd.exe
Size 5.1MB
SHA256 a5c86cd2372b249dae64549a25c09cfca3ad44d1af24e28a5db0f47202609816
MD5 0a12146d738be30ed347bdc07e68a946
SHA1 b75b06a63b70b07c17d525173f42f086b5e4be0c
SHA512 e3f661302151359c29e288ecff80364ff17ec9aae694016ab317e3e6f5d02873fbf828e8268291f54966d6da786d310ed91ff9622f03498c3d36624c45a78a31
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOW:icVUcTedI6C9e9MQR7t+cl
TLSH
T10A36F624EEEBD1F5ED035C30215BB33F6A3516098738DEEBDB901E02E55B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ChsgrmuG.exe

Path C:\Users\Admin\AppData\Roaming\PopOpen\agent_ChsgrmuG.exe
Size 7.4MB
SHA256 811dfdbb037633974b89a6386ac7b08e82a21ee45ccbb258dfc4404255b1478b
MD5 bdaa28148e28b07469fafdb2e26da06c
SHA1 86b0a37acf216704cdbb42b3389c10fb76433310
SHA512 b4b26c3787e236e60da9e019b0cb5d36aa2d2d053e8be14e0c01440d2dbe43a984c6cceed1e67a1c124b7ca159df52c6c49bdc17c44e73502a0705bb4ca15903
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfq:icVUcTedI6C9e9MQR7t+cm
TLSH
T131760721EADB91F5EC035C31116BB33F67351E048728DAE7EB943E07E47B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ChsgrmuG.exe

Path C:\Users\Admin\AppData\Roaming\PopOpen\agent_ChsgrmuG.exe
Size 7.1MB
SHA256 738c4f807610bf59d135ddf70756f345c3ac0e642bb2c726cdd8f625d1352e69
MD5 7d42ca183ac93101e998ba4706c1a060
SHA1 518cc8d1267dc4d466a7c0021aa80b656ac788ac
SHA512 551d66232d423da1aa179847661e541630db44264a726a2d7509dbe6973b1dc6a3fd4e0961292cea0616e18d67a8b99ac70544077610313efc79e8eda4f9cca7
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfi:icVUcTedI6C9e9MQR7t+cu
TLSH
T178760620EEDB91F1EC035C31116BB33F67351E058728DAE7EB943E06E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_NcIhNtXF.exe

Path C:\Users\Admin\AppData\Roaming\Sun\agent_NcIhNtXF.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-12876-0x00007FFB58F90000-0x00007FFB59292000-memory.dmp

Download

memory/896-12873-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/896-12872-0x00007FFB58F90000-0x00007FFB59292000-memory.dmp

Download

memory/896-12875-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4920-12904-0x00000000058E0000-0x0000000005C34000-memory.dmp

Download

memory/4920-12896-0x00000000056D0000-0x0000000005736000-memory.dmp

Download

memory/4920-12894-0x0000000004F40000-0x0000000004F62000-memory.dmp

Download

memory/4920-12889-0x0000000004950000-0x0000000004986000-memory.dmp

Download

memory/4920-12906-0x0000000006060000-0x00000000060AC000-memory.dmp

Download

memory/4920-12905-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Download

memory/4920-12895-0x0000000005660000-0x00000000056C6000-memory.dmp

Download

memory/4920-12893-0x0000000004FC0000-0x00000000055E8000-memory.dmp

Download

memory/4920-12911-0x0000000006530000-0x0000000006574000-memory.dmp

Download

memory/4920-12912-0x00000000072F0000-0x0000000007366000-memory.dmp

Download

memory/4920-12914-0x0000000007370000-0x000000000738A000-memory.dmp

Download

memory/4920-12913-0x00000000079F0000-0x000000000806A000-memory.dmp

Download

memory/4920-12915-0x0000000007530000-0x0000000007562000-memory.dmp

Download

memory/4920-12926-0x0000000007590000-0x0000000007633000-memory.dmp

Download

memory/4920-12925-0x0000000007570000-0x000000000758E000-memory.dmp

Download

memory/4920-12927-0x0000000007690000-0x000000000769A000-memory.dmp

Download

memory/4920-12917-0x0000000070B00000-0x0000000070E54000-memory.dmp

Download

memory/4920-12928-0x0000000007760000-0x00000000077F6000-memory.dmp

Download

memory/4920-12929-0x00000000076C0000-0x00000000076D1000-memory.dmp

Download

memory/4920-12916-0x0000000070360000-0x00000000703AC000-memory.dmp

Download

memory/4920-12930-0x00000000076F0000-0x00000000076FE000-memory.dmp

Download

memory/4920-12931-0x0000000007700000-0x0000000007714000-memory.dmp

Download

memory/4920-12933-0x0000000007730000-0x0000000007738000-memory.dmp

Download

memory/4920-12932-0x0000000007800000-0x000000000781A000-memory.dmp

Download

memory/4920-12940-0x0000000008620000-0x0000000008BC4000-memory.dmp

Download

memory/4920-12939-0x0000000007830000-0x0000000007852000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads