salatstealer | 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5

Analysis

max time kernel
15s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT8).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
MD5 a2865133b7b6bc0adcc51acb7d64ae20
SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
TLSH
T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 3 IoCs

resource	yara_rule
behavioral31/files/0x000e00000001c598-6116.dat	family_salatstealer
behavioral31/files/0x000d00000001c59d-7493.dat	family_salatstealer
behavioral31/files/0x000d00000001c59d-7492.dat	family_salatstealer

Executes dropped EXE 1 IoCs

pid	Process
5692	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4756	certutil.exe
5848	certutil.exe
2892	certutil.exe
600	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5072	4620	cmd.exe	90
PID 4620 wrote to memory of 4756	4620	cmd.exe	91
PID 4620 wrote to memory of 5692	4620	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT8).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5072
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:5692
- - C:\Users\Admin\AppData\Roaming\NewCompress\agent_LOlygWXm.exe
    C:\Users\Admin\AppData\Roaming\NewCompress\agent_LOlygWXm.exe
    3⤵
    PID:2768
  - - C:\Program Files (x86)\Windows Mail\sppsvc.exe
      "C:\Program Files (x86)\Windows Mail\sppsvc.exe"
      4⤵
      PID:3636
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:4056
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\sppsvc.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\sppsvc.exe" -
        5⤵
        
        PID:4296
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5848
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:1940
- - C:\Users\Admin\AppData\Roaming\EditPop\agent_rGRsbXGk.exe
    C:\Users\Admin\AppData\Roaming\EditPop\agent_rGRsbXGk.exe
    3⤵
    PID:1216
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2920
- - C:\Users\Admin\AppData\Roaming\ConfirmRedo\agent_SOcNkZUk.exe
    C:\Users\Admin\AppData\Roaming\ConfirmRedo\agent_SOcNkZUk.exe
    3⤵
    PID:5296
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:600
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:3740
- - C:\Users\Admin\AppData\Roaming\ProtectRename\agent_JCXBtiiq.exe
    C:\Users\Admin\AppData\Roaming\ProtectRename\agent_JCXBtiiq.exe
    3⤵
    PID:3428
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sppsvc.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\sppsvc.exe
Size 1.7MB
SHA256 f92dcc8fedf3a3db23dc40307b72152f8df94512023e51237b803df299fcbe19
MD5 cd39275b752b03def81a5ddb7c7c1978
SHA1 8b3055b597c355020024054b8af83dc2fd21c5bf
SHA512 c345f240c2301ac2120c705da8a6bf1b7f262d6a5e72fc9570e744a03c80d1c8e6b496af0abe539d48de6814ff40b8788c786a2fa22f480e624693ccb4eb5786
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeJ:TjycqCUjvnTGmp2TedLKN
TLSH
T12285A564EEEFC1F4ED435C30615BB23F6A3522098B38DEEBDB941D02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sppsvc.exe

Path C:\Program Files (x86)\Windows Mail\sppsvc.exe
Size 3.3MB
SHA256 2cd5e8abcd7f3af320b0362fad383a201559fa967411d9c60668e360faab8382
MD5 2b1626c465480624d89daf181b4fc5a1
SHA1 c15e21d513389ae92bf6986c1c0bdc8b8a8bbbfa
SHA512 12f227cf3f407c842fbe5c7107c95950c1af6b975bfcfb1430d624fcf2859ece478f452d3c4b3f63c6c1b2e899cb2b4df954cc7021503327359fac08f02a1ed4
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7Z:icVUcTedI6C9e9MG
TLSH
T1B8F5D564EEEFD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sppsvc.exe

Path C:\Program Files (x86)\Windows Mail\sppsvc.exe
Size 1.7MB
SHA256 19ff3b5674f15dd82174f487da9702410fe1b731501f635382af3f93bc237338
MD5 2b5af8eb0ba3a275fb30a91a60594d7f
SHA1 329f740f1f49b41604b7b3595bf8ea00775293b7
SHA512 08ed09196b07b05a231004d5c4827645387479c533be18a244d841bd69c2a9e4040ae1d0203ef41819cdf92fb8161212d9db8bb4d972eb4df8f4cef5d5f19419
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVex:TjycqCUjvnTGmp2TedLKV
TLSH
T12485A564EEEFC1F4ED435C30615BB23F6A3522098B38DEEBDB941D02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 10.7MB
SHA256 9dd370b0a6dda5c2b5e097754e6f0b467034c9b5d78fbfa8144b62f8f4df45c0
MD5 5778d779cfb8b65cfe906c161cc24b65
SHA1 a0d537d4c0db0883c65a2d27bdea3a7fae76c95b
SHA512 561543d81861fbe745443e7d75478d3523c636a559fc30cdf49bfca09a1da37abca13bf7bf2d9db4eec71cfc7befed9dd6d140962e67f8a001a47beea6bec208
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvt:0bsPPSavMjysmCV3IhGjkJPnvgaQIvt
TLSH
T189B6BF03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.5MB
SHA256 6295cbbd77bd3809a1c6d10bc17b73af2adc6f7858819792a165c99d0d04105a
MD5 0d452d35db92c673b534bb6ac4fec476
SHA1 884b45077cc36457a3ca952cda4c6645d4a3b537
SHA512 2eb1e146224660705596df5ed0ae1718158ab949c7c64cdb3fce1a13ac7bc979c666ae0b3ae54714f98a622251cc77afb67b97de55bf564c429eea6d764d4d0b
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSVib:06GtcbPy/lwHVSc
TLSH
T184F5E917E8A550E8C0EEC5758723A623BEA13C49073433D36BA1B6211F76FE06DB9758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 24KB
SHA256 5ce4edd8428e545faefa69a999a5524d5bdc249e5867b1a0033755e71a2f584a
MD5 980e5f3fd30dacd3ee1fbf4e6e869c28
SHA1 d13959a6c8512ed96e3ba6ca27941bee0b3fd428
SHA512 89379cbfeef2de6cffc5107a7f3ca2be1fde1fa752c3550c194cb8469c7ed660cdee1a968b2e02abbb9dcbb817c1cd3c00c2335edc7f83e2b26fd3bef63286cc
SSDEEP 384:G/HiEjxICJAj9ivoH6htJnqb7tTccW04IFDAMxuBKkAK5MqMHAk:GqayC69xYqbBCX6DB+KkASk
TLSH
T180B229790AE3607E3AEC3C8538611D5C9D6D1F09997E03065BC434F6F35C8948A39EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.3MB
SHA256 8acefaf0d40cfbf9d11fc196ab515e76053aa839badd29aca1d193ec339a469a
MD5 83589fe629b69e077ec11c07eb050e71
SHA1 96a4d6a241d34dff07d4463d31efbccec26c2cee
SHA512 ffc75ea27e6cac6342a850c3d1efa61f6800e8c6d65b81e4249bf43c652fef897c7cabac45c8c60c1fea60e1f69f8f8f41beed2f7e281462b3c98285295fee4c
SSDEEP 49152:d0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvY:q
TLSH
T178E6BE320683BDBD3FAD3D45E0012E495D9D7A0B11A89359FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 7.1MB
SHA256 94e08a58192df786c8d35d07c821359c74eb6ad10ac2da0beb75439403954516
MD5 e9d10cc7546dd0ea7d4116abfd53a653
SHA1 db270fc80ec22a0631c7d978e0aea336aeb7e49a
SHA512 7a558be488bb5c71713c1ad338b80d97cc23f273801efb7805c7886553b51664f844338779fb312a75f4c1de86de504edbd61c076259586d15251b7fd1937347
SSDEEP 49152:yPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSycLXypwutu0okH4MmQua:F
TLSH
T17D76F1721607FDDE6F6A0D44D0053A405CAC7DAB5298E2A4FE8A719771EE610EE3DCB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 4.1MB
SHA256 a518b9102c3c934358f1483c406e09d639b0aecba1b9cb60f1e430fa456f3aa6
MD5 95a779a0814de5b3bd292c7f40df8da9
SHA1 cdf932fb725dbf512c3c93f565bd30539365a333
SHA512 0a568d861649c78b5567cdda13a17c6081c089c2fac61d89a0d97d1e5f57818b17339b33c0b697cc01ae5173f043fb2438a77d4fc2a628951039d7cc83f3de8a
SSDEEP 49152:yPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpf5:N
TLSH
T16916AF721607FDDE6F6A0D44D00439415CAC7DAB5398E2A4FE8E729771EA610EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 40KB
SHA256 21af4b7581af2ecf74ee2d5c5d2291d530ed5d1d79629b6ab5831cdcd59d085a
MD5 285cae23ecc786ea0184e5174315df20
SHA1 91875c8fc584eea404000166c21e6c40c270c0a8
SHA512 4338a8506ee0103fd2d1c15113304a2eab5696542fdb902e45ef94573f72499377b424c7317e926f8baa65ecf7e4315cf9fb9394589de62beeb0ff2b7a27f330
SSDEEP 768:SJH9XuutQyGMNroE3O8tHEi/maleqUlT5/vMfvrcNkZJtHjqd29w2S4/AFJYNu6:SR0utQGNro8ttj/mauOICJ1429uT6
TLSH
T1270339304EE728BD3AEC7D6221601DEC9E6C1F4B64A9130F47C478F9A15D5BC8E29879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3o3oxzei.wht.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3o3oxzei.wht.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_SOcNkZUk.exe

Path C:\Users\Admin\AppData\Roaming\ConfirmRedo\agent_SOcNkZUk.exe
Size 5.0MB
SHA256 65fb9ca49ff41e539de37fc6ad47e6d2dfd3448d5745dd666b8060416b1d40ec
MD5 0fbcc36faceb9c63b4383be7b9b6e999
SHA1 1a63e0e0986f33843aa56b4e23ea4345bbd0b454
SHA512 af19ea9b7c9bbb614ec95750b2bd82f4858524d8b2032cc88df3bbc46bba88571c2c04e83f509c84fe27f3b106ea4314ff15f30b82820d1d1a7c518cca7ff327
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSt:icVUcTedI6C9e9MQR7t+ct
TLSH
T1E936E624EEEBD1F5ED035C30215BB33F6A3516098738DEE7DB901E02E56B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_SOcNkZUk.exe

Path C:\Users\Admin\AppData\Roaming\ConfirmRedo\agent_SOcNkZUk.exe
Size 4.4MB
SHA256 472d6cf13d81845bbe6222edc1b378ac1af3f5acbacf520bc193df90cc976aa9
MD5 de95303ff893cd3d15cfc2a02bc77a9e
SHA1 c3f71f2aed33324b95c2dbd7d7a46d82ecc6998d
SHA512 38f78cacd1db673fdb5eb858fea33e37a9f992777901d3e7f54c852666b3baf5f10998ff5204c6dacd2082b5603d6c06e830270a275a1a59c0a1d1207bfe5594
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhVO:icVUcTedI6C9e9MQR7tO
TLSH
T1A126D664EEEBD1F5FD035C30215BB23F6A3516098738DEEBDB901E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_rGRsbXGk.exe

Path C:\Users\Admin\AppData\Roaming\EditPop\agent_rGRsbXGk.exe
Size 11.1MB
SHA256 8be07afd43f8789ea1892e98fc0b528b948015d6918a3f831f64990bd857645c
MD5 a7a8f4094345be16b728c892527d4bab
SHA1 4aee3b7fc23a75cf6a7bc27d2c555451f0b5fd1e
SHA512 4cd22670ee21fe8f1046e0f37969fa9b4d5ccc83cfd59c517d7ffeaa21723a96938fec83cb7b291b2f3144273ebc3dfe651fa3867b5f99c3271ae4d0a8c4b285
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfF:icVUcTedI6C9e9MQR7t+chQa4NG20Z
TLSH
T150C65A10FEDB95F2E9035831416BB27F27305D048B28DB9BEB547A2AF87B6911C7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_rGRsbXGk.exe

Path C:\Users\Admin\AppData\Roaming\EditPop\agent_rGRsbXGk.exe
Size 11.9MB
SHA256 743c6c3f96017a009c76ac8f56242505ee2cc6df4a4bb4131e07d2d27982e49f
MD5 dde63332afbb642f22ccdcd91698f9d2
SHA1 2f9cc6d47e98a961ee5715a1076f6bba4e8dcc72
SHA512 8843120f21af0081c2d79e6ecde6d8e85ded945d16d1ef6a320accaf6b7bb38ddfcdb7124907329f16a9b7b8592c0b72074c9fc3213b381abc3e643fa876af79
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEEB:Ac9ZeuQt+IJnAEB
TLSH
T18CC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_LOlygWXm.exe

Path C:\Users\Admin\AppData\Roaming\NewCompress\agent_LOlygWXm.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_JCXBtiiq.exe

Path C:\Users\Admin\AppData\Roaming\ProtectRename\agent_JCXBtiiq.exe
Size 2.7MB
SHA256 ed44519994c78b7f2d18f2b3f2ed4d3e3b808691539e1638ba7228d483e3da5a
MD5 7dbca0c228e9073e7712406b8d060ae1
SHA1 a6d280c7c4fa4114988de7c92eebb49a633945cd
SHA512 fea538b34a0bf958e7ade7daa1a32d3e5799cb5c73dd8f56300f47bcf52f57c2b016fd161ee6e2bdc4d8844fa1c412be5b1bbe6439b0c46ba3f0c26c60d522f8
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJ2:icVUcTedI6C9e9B
TLSH
T15AD5C660EEEFC1F5ED435C30115BB23F6A3526098738DEEBDB941E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_JCXBtiiq.exe

Path C:\Users\Admin\AppData\Roaming\ProtectRename\agent_JCXBtiiq.exe
Size 2.3MB
SHA256 29a7c2bb31e7b73a0e29359ff1528d598ac8c5a8067a2f25763ddf45cd0657d5
MD5 5e7a40f5c8aa10f58c38b1c718bd77cd
SHA1 a50e858f5deac992c39527a737ffb3a8f9212ca2
SHA512 5082bb5b14eb7acad3788d7d9d9b18f9f3d71c9e431caf0b14b26f4d0cdfc494e84ef6a132a1dda55570b223150dad6a5d9f41a1baddb367eb1ce27a078d00a4
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVe6:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR
TLSH
T1C3B5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4056-9726-0x0000000005440000-0x0000000005A8A000-memory.dmp

Download

memory/4056-9746-0x0000000070B00000-0x0000000070B4C000-memory.dmp

Download

memory/4056-9761-0x0000000008A00000-0x0000000008FBA000-memory.dmp

Download

memory/4056-9728-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/4056-9760-0x0000000007C60000-0x0000000007C82000-memory.dmp

Download

memory/4056-9729-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/4056-9727-0x0000000005340000-0x0000000005362000-memory.dmp

Download

memory/4056-9736-0x0000000005C70000-0x0000000005FCB000-memory.dmp

Download

memory/4056-9745-0x0000000007600000-0x0000000007636000-memory.dmp

Download

memory/4056-9740-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/4056-9741-0x0000000006180000-0x00000000061CC000-memory.dmp

Download

memory/4056-9759-0x0000000007890000-0x0000000007926000-memory.dmp

Download

memory/4056-9744-0x0000000007320000-0x0000000007368000-memory.dmp

Download

memory/4056-9747-0x0000000070DF0000-0x000000007114B000-memory.dmp

Download

memory/4056-9755-0x0000000007660000-0x0000000007703000-memory.dmp

Download

memory/4056-9754-0x0000000007640000-0x0000000007660000-memory.dmp

Download

memory/4056-9725-0x00000000028C0000-0x00000000028F6000-memory.dmp

Download

memory/4056-9757-0x0000000007780000-0x000000000779A000-memory.dmp

Download

memory/4056-9758-0x00000000077E0000-0x00000000077EA000-memory.dmp

Download

memory/4056-9756-0x0000000007DC0000-0x000000000843C000-memory.dmp

Download

memory/6128-9709-0x00007FFFCEBA0000-0x00007FFFCEEA2000-memory.dmp

Download

memory/6128-9710-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/6128-9711-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/6128-9713-0x00007FFFCEBA0000-0x00007FFFCEEA2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads