Trojan.DataStealer.F
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,686 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 614 |
| First Seen: | December 14, 2023 |
| Last Seen: | April 23, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.DataStealer.F |
|---|---|
| Signature status: | Modified signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
41475a69e9e083071b6709d6bb6620cf
SHA1:
c9321ba3aa4d0db6bf746eb950dc4b8e8fad83b4
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
9fa51afb36a262821dcad677b81b049f
SHA1:
967aaadd5e4992b2b2bdc6adfa26a5dff2e41f1c
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
f78d06227958ce0423130a22f1298f9e
SHA1:
3ab38335ecd7abe1f91570e217d23f92238d7589
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
091025549063267c022ef410c77a67ed
SHA1:
91e53e20a044d6c0b6e6a01664c33d7d4fca66ae
File Size:
920.46 KB, 920456 bytes
|
|
MD5:
04dd1453533c1cea368ccbdfe0f14061
SHA1:
9adc8fa4a37838d48f98e150c704b5eeabcaa6ba
File Size:
834.44 KB, 834440 bytes
|
Show More
|
MD5:
c68f8cdbd04f017eaa3234cb651af28a
SHA1:
e34e072eba0a2cce472a56996bcb09b467259f9a
File Size:
1.10 MB, 1099792 bytes
|
|
MD5:
aa1a15bb8dc242b458cfaafc3653f7e5
SHA1:
9beec0f82c38781f5092a318b54c2f916e77a2e9
SHA256:
A8E171DCE7C81294A2E8E3157EDF63E4D376BFAFB8863C15E4F6DD88DFADCB2E
File Size:
998.88 KB, 998880 bytes
|
|
MD5:
d3ac6d2a74d0aaf1ed1100d75c4965b8
SHA1:
6911473019ba3275e60643407b84f2325d357284
SHA256:
5D9698693C0A38191805B125DE71DFC57987654324AF996665262F4B1DC7FC1D
File Size:
1.10 MB, 1099800 bytes
|
|
MD5:
39fa248edc77d6d54519678594527b94
SHA1:
e85313e8a2a192b18e1945e86adc22ee18476a35
SHA256:
682F49D577A88DCE900CBF4821E96D51BA8806A4474E3700EDC3A48F81E68AAA
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
e2aebcc233ac9d0540c0fb9e4e218c4c
SHA1:
427d2b0c63a22e979be5cd49bd03e66defaa89e3
SHA256:
94F01533FE6097DF08507461B69C80335F657B5A7F89D994D5BB03A600589813
File Size:
981.73 KB, 981728 bytes
|
|
MD5:
56d8716b9f82147991515f6fc74d9c91
SHA1:
cdf36837d0c6110f4f60050f4fdd92410b79375d
SHA256:
626E3115683939C051FE493BCC0779448CAB39D6CB6895367055C551787B29AE
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
a3189475671b41303d0341cedc418f07
SHA1:
e3d6963e99cd4f65fa0da17b57cd4bbc7d6bd63d
SHA256:
FDB2CF1DF2C8798829A14B3470A008E3BEA0634733A6A477CD2C79285FF13A20
File Size:
977.25 KB, 977248 bytes
|
|
MD5:
36ca74ed622e1a784bbab49472644388
SHA1:
0895589809d31adb6faf7cce3301606cd887157f
SHA256:
60B98B3368CD0E47BED368DD855A476143454EAEF9637DA988EC90E8A9F8BD16
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
8ccdbd0474293ad55fbbcb6b24f6cdda
SHA1:
0a531cdbdad30b31608809089706e50545390e13
SHA256:
E6B90518B67143B54FFABE5FB8CD435F275294CF5953CBF3A3B85F3CB25F7368
File Size:
834.62 KB, 834616 bytes
|
|
MD5:
c45899be885ac2fcfa5d6e2b6104f58e
SHA1:
15f2026a94d6426aa8b285eb8c4b6700620d20cf
SHA256:
48EA2ED3B60F11887BCC93319F3A5334D34290B8CA69F98BFADFDB08DF6FA1D1
File Size:
991.03 KB, 991034 bytes
|
|
MD5:
b86db4c60ca34e3bf1e7448b051a1e42
SHA1:
4421ecd1de0c427d0eef37c3cce35d4cd5a47edb
SHA256:
4269EC2FD29440DCD16AEC9CDFCF2481AD3E18159A71CE3A386E66087A5075E2
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
0984a6ac1287b0e678a39b7e09039fb9
SHA1:
296a1779692ba48b7c5823098331c9a0e95b0a22
SHA256:
BCBF06B3582ABB62F193F484815CBE221EFE2630A855F716432190A9D769CFF4
File Size:
703.34 KB, 703344 bytes
|
|
MD5:
568397623132c1772bacfc768e6ebe6f
SHA1:
c34a780bec53aeaa63e9e5816ea54174ce2edef1
SHA256:
AD1BEFE9F57EF8ECF78D33BE1D5D6C9CF6D9128B90AA40F18B15D7BFAA724269
File Size:
1.10 MB, 1099824 bytes
|
|
MD5:
4204884cbe8ccefc054d59d5b5732990
SHA1:
61b3e290a794b06d47459a3e132ec7581e19e47b
SHA256:
ED2C02E13730DBCB4899F786806262ECDF5FF884FEB84CF450D0EF348353DF39
File Size:
966.48 KB, 966480 bytes
|
|
MD5:
1eecc16003430ae2e400306c789c9127
SHA1:
44e876ba16abf0451bd8128128fcc8ce4aca99ea
SHA256:
49ED8582FD9F7C8EA4BB4A9E80988F7BC2A11366154695FF087EF399163E2D39
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
6a947e24b1ea098b6de9d5b066838da6
SHA1:
a8e7dc8c6b0f5e68758b6a521da50f8c2810a7c9
SHA256:
BD3FD3416979096500027A9B204EE7E87C7F5C74722002730926DAC0EF897B3D
File Size:
1.03 MB, 1026928 bytes
|
|
MD5:
88ebbf93727c2cb4ab5105876e2453d9
SHA1:
9d90fb34828ddd3629ae779c5ce232d5a31a7b41
SHA256:
C997D0FD78683047BCAF70EDABE641F23C0E1CDFD7C7A2D255457ECB3F24699E
File Size:
966.54 KB, 966544 bytes
|
|
MD5:
e1c76f2358c579d8d275dd8daac46dfd
SHA1:
1ee046e5b16dcc238013881a98d81cc1572e7f0a
SHA256:
44E23B9212FF37D2377C7766BA3292BFE4CC8272A73010B9BF09040EFBDA702A
File Size:
1.05 MB, 1054640 bytes
|
|
MD5:
4842e6a8cf02581726d25fc7c6d8f660
SHA1:
90e8650579a351bb975d21cffeff25b33f51cefa
SHA256:
3E811832B1DC6856D5DF940F94C1C4B5B159CFB93725E3659B08DFFCD3170433
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
197262fc95939b26629fe971b6d4fe4a
SHA1:
4dfd1d92505684e2111f1cdbc9a0051de49d02aa
SHA256:
79EE0355B8A73C6FA824E1D502E10C560AA4AAED056B71966E8B598A3317F19E
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
d1bf22d717e2a8a9a6eba16ed30e7075
SHA1:
4fd5206bd28225af261bca47b8006c65c5a6ae64
SHA256:
06DB87752D571BD7E46FC730A4EDE77512C46918BE9EBC42C5025B1B0668CACD
File Size:
1.08 MB, 1076792 bytes
|
|
MD5:
f375d7b05ee7ee46ed2733c11ba9afe6
SHA1:
2b093a2ceb6db98e1bde7a0af2fdea012dc1a0df
SHA256:
501CB7B9A415CBAAF60DD4E0AAB0E8FF7D79731EAEC0CC0B21BA8684F989F2DC
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
8828b071d2840906e691a9cbd1e51f83
SHA1:
a5dce0e55e005a1762e75f970a9b98e3470e675d
SHA256:
66F1F5E07DD12F3F427A339EE06C2828F252AAFAF7930C0D6D20303DE0366C77
File Size:
851.97 KB, 851968 bytes
|
|
MD5:
d900d7704ec829bd8d40f7d3feedab18
SHA1:
cc2b9528bee73da3cf03677de32b68a03613599b
SHA256:
A6D5D85C4D62B59744B9108E10F0BDAD6B89E008E527B00C1B70BD929D00AE06
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
e3deb93340f0dd575d4fc4fd3bc1b731
SHA1:
285f30aa3040daef11d51ab4d4957f21432506bc
SHA256:
7198C5036E61630244A30F769A604FDC63E0FFB1C58A0EEFBB8841EB82C07D5F
File Size:
1.02 MB, 1019632 bytes
|
|
MD5:
7a56617db956f575b6e302e2ae5176dd
SHA1:
bf7453155d51ecde5ff7dfe31ec942c94a271ff2
SHA256:
5F6F0D0F2A2951D8AE296AE61ECAB5A9007DEE6D5E71F60D33C1CAE208C126AA
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
b6fc7a7cbae8a8427cdab64e536f297f
SHA1:
30b9269be329f353400c9417e4599d71d6c0a217
SHA256:
40F126444DE12002F55A0CCB145B82F882C60D67C05511EADAFA4D14FB09982D
File Size:
991.26 KB, 991264 bytes
|
|
MD5:
bdcec2834949263ec0c83cb134c5cb8d
SHA1:
9013a289f6b9e6e361359e6029f593d00da83ed5
SHA256:
8EB8F328736BCF7324E91B759F544FF07FCABFF3F2233D3DF708DDEA856BD6EC
File Size:
851.97 KB, 851968 bytes
|
|
MD5:
f0c6759ee11625ceab3a8f8f0d8b2214
SHA1:
ba67f02c88d0c568d835375ca80bf74f4107ed28
SHA256:
5272CFB3E949A24039868AD099AEE8161980D02022F0E2086AD6AE3AA0962C90
File Size:
966.54 KB, 966544 bytes
|
|
MD5:
7b0734fae9e1e2205a2f9ca510db0e63
SHA1:
bdc9539d478d4076096578313d747f953d8a60f2
SHA256:
249E65707D371ABF44C3B148C45775D7DA47EB7CF3DDD8FE7A282E2B35E12CF5
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
20cb98b97e37899d4b3e6910fae6cee9
SHA1:
31027cb264c52ba9d1b307a7080f43df15e58c72
SHA256:
6C24D635761B43BBDF1CD40C6FAB4F81C3BE5CB43F67C649DF4ABFE576C4B94A
File Size:
999.22 KB, 999224 bytes
|
|
MD5:
aacc8441248d304cebed4527a2b0ddc7
SHA1:
a36db4f62fd8db47a912abfec50c0b93e89d7a88
SHA256:
EEAA4B6D6D58E95DAF614DC3BC1E540CBA602B25F7C71B2CA57021FF03773115
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
e31782d65780717da7b3ef53a0c3e91f
SHA1:
e575e0c59f693c83004d76517b4d8e846040fdda
SHA256:
E2C544C7A1DF2A0B0FDB35221A472BCC2A42F9FB052BD8D98AE5943F58CA171D
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
ac7d3e7e992689114f5bdca8c1db778d
SHA1:
85452fa89a46b03c4d976b89fa62be79acafbcb1
SHA256:
1AE64351B01DA774D49D2E3083E2F90CBF76F4C731D74090241D40E8FC8CAE2E
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
d99202238d724f18ba94e0bc4aeed574
SHA1:
5af10588edeeb7fc0106a00aa6a5dad41a0cdcd2
SHA256:
A35CBFE4CEC633D083BFEA594D8BBDF80524C388CC3D311AB8BCA9DCF31AC3A6
File Size:
999.08 KB, 999080 bytes
|
|
MD5:
3b93e509ea5c6c24985ca11a63b4ac5d
SHA1:
fa91bc3cef33c9fb73c082a13f0955a5ec7c3836
SHA256:
0A6C7CA76DEE0D14B2A5A895AB9B9EA20239D995494041893DB740A8FABF98D9
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
1bda6bcb57000adfcf24640d0023149e
SHA1:
a7a36943eb8dc50e7fda1a702c93311d050659c8
SHA256:
15123C0D0AFC2B12CDC2C51C14792A6EE60BC902704996A3D6442EDFB6AE7326
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
b61ed201f1e4e0814bee3a6012fa5eaf
SHA1:
198e04d275f5f4b13aaa8c2f7eb1f2df377f9873
SHA256:
3E1B645EBD862DC336F5EB229BB8AB71373C307A3A54009D187FA2191F6FD77D
File Size:
999.19 KB, 999192 bytes
|
|
MD5:
995aa39017a2daa24db1b357033cf31d
SHA1:
2c1461d52e73aea29864ac37c1f91a069e3dcd14
SHA256:
EA84E3FEE4EE8D0DE7BDF8F04EEE010593444627855C1EBC5D4EC1A66BF9CE5B
File Size:
1.13 MB, 1133272 bytes
|
|
MD5:
a38ee98a3cdc200ed13bd0f40af8ff9e
SHA1:
9f137232767226aaf65fb7f95e3c90dbd9062df4
SHA256:
0288A77B8FCC589A3B47F80B3C5BA9AD506E3CDAE1A7659A61BD5EF365E72A20
File Size:
961.81 KB, 961808 bytes
|
|
MD5:
521044804001d92b8199dffcfddc62bf
SHA1:
7a9d2f8205bbdf9f4ee6e1fd910cca1240a1575b
SHA256:
6EDA2B970326999D5F6859A58D22E128ED2E1A5B0694BEAE2451DEDD9D8F7CCD
File Size:
1.05 MB, 1050656 bytes
|
|
MD5:
19bee8838d03f1d88ba317ebe56fa868
SHA1:
7ab9d4f34a65d50148e32786a3c4752808da0ddf
SHA256:
A3A44CD1316F074D179F911242E46DBF2EABB51E2B9F1FFCFBE30D7CCDAF081A
File Size:
991.45 KB, 991448 bytes
|
|
MD5:
a5636a7207e661680768cab183375f22
SHA1:
8df627db53bc51128f8848146de65d41b90b19f1
SHA256:
1D3C27DA4A7EC1FF37B41D9745147D2C4D64AB74DF55DB23D8C528963D3B614E
File Size:
966.34 KB, 966344 bytes
|
|
MD5:
994d659ce2fa4e6d6693c902f9660ff1
SHA1:
f385fb030438adaf114b4596e88c524cf4ad6a28
SHA256:
58DD45B25A8FFF40CE93822C7D66DBDAF174EE899467DB547D892D5A43D5CA6C
File Size:
961.74 KB, 961736 bytes
|
|
MD5:
f6fb2d80738134657756d6a761a0e121
SHA1:
27dc747badb06e0b8ef683e9218e84019a34b6ff
SHA256:
E82BEAE61FBB27E7BAF59BF12F8ADA0506A921886ABBDF47D5C1457A72B57225
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
d9b466a6ae1314b1f6bffc2b5411a8f8
SHA1:
0d5f7181e0f00257f5a246ba949de9f31529f9e3
SHA256:
091D5526B46C20F7F841637DFF1F4BB892C4BD630DA051D4E09DCC312247FA38
File Size:
704.10 KB, 704096 bytes
|
|
MD5:
951db397c04a44f6694392d7bcec3309
SHA1:
71ca64975619db2fbf66f17ca8d879f077c9bbce
SHA256:
96534D1CF871A81CB7C14F8C267EDDAB9B7C1D87425FCA9B153EB5A9190F28C8
File Size:
883.67 KB, 883672 bytes
|
|
MD5:
d90b5e359f1638f3ed092b66bd12e47a
SHA1:
217ee5ff5a20b7f67aa75412f907fc2521eff145
SHA256:
0359C716ABB2DC17BA42A5B0E1EEADD1F1C10A430416128B06CCACFE11F63765
File Size:
710.59 KB, 710592 bytes
|
|
MD5:
c8743ace46231aa8ed75607fd7e4e34d
SHA1:
85f9185cd0b2b7d71747f86125a035c92a90af67
SHA256:
6C829278CE79D86E497702D8ED6ABF5624CC8A9DCAF54D055ED9D5FF9B642742
File Size:
993.39 KB, 993392 bytes
|
|
MD5:
1dbabcddab09f2b81b957fc59d1c2b6f
SHA1:
dacce43113744c1d5c5ad6e5be281e96b241b5ae
SHA256:
B7DD84F686FBCF2B1E380BB231220FD6B353E8F101F7FB2B955A72E5A795DB6C
File Size:
1.03 MB, 1026960 bytes
|
|
MD5:
bbdd29d6c99cdae0cdc17717f1fda9e1
SHA1:
e9d45f2e36880fbdb7785f791a53efa038071e16
SHA256:
4C31B6F9B6F29A4E1B5980E9F3C7C3AF8FE2701E9613EA90749571D9107F6205
File Size:
947.92 KB, 947920 bytes
|
|
MD5:
e390922f18daf3faea4068ae16020147
SHA1:
2d69d7fb4973a2f58376bad1e3319eb506d349e4
SHA256:
80AEA66BC7E6E2101CFA94459E9F7A05333B724A0D24EA56FD397F7142B767E0
File Size:
993.31 KB, 993312 bytes
|
|
MD5:
c6da14121df88a2dd963abc93a75028c
SHA1:
48f9b0a6c930758dfa0f6d02ac2756d330611e0d
SHA256:
5B164C0B9252C0D6026F4B2E928E82E5DEEEABA6FD2026338B7B5CCA59B76F08
File Size:
991.48 KB, 991480 bytes
|
|
MD5:
b7d9b04ddcd77f77a73d4263c8fe29e6
SHA1:
1134a457617157aa4434d505a5e603ff41ded792
SHA256:
8376D0D135E5B1CCF332BF1FDF89F2BB089E51526E996EBC9BB05CB77370D8CB
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
23d3b40fd78a378e3bd6d01bbab2eec0
SHA1:
fd995679d18794cc35c48668c515a1281b95adaf
SHA256:
27CBA4CEEC1E48F6C273367412E79A14C1A8B74DDDE6A66F266074E64EA07D48
File Size:
1.03 MB, 1026952 bytes
|
|
MD5:
c88da9e5852e51aa820d55c38f2cab9b
SHA1:
a61f775157bab8266dac6109279a4d0408280e1a
SHA256:
3B814BF0ABF7AC7D058F8AB9654B630EABEB0E189E21C8797DB8368D9F5E5D8B
File Size:
1.10 MB, 1099792 bytes
|
|
MD5:
d4431c35ced3d3a0de4c15972946b182
SHA1:
54d5eead3b6be4c4cd324fc31e77824a7e0a64ae
SHA256:
D8916DF6FE59E04B12371AEE63A9A641A257B522C3F684C84EA33A2CCBCEF9DE
File Size:
981.73 KB, 981728 bytes
|
|
MD5:
7a46155aa07c747e059403a5a20e6b5b
SHA1:
6da6071b5d50eef9c987789505b795f98443d514
SHA256:
4F6C47AFB9D75B9EC928AF1EBDFE26A40FDC5C4C4853815A284A396B982247DB
File Size:
1.08 MB, 1076784 bytes
|
|
MD5:
558db88c8f483c30cad29dade429b4ae
SHA1:
61bcdffd1283a95826682b5d33229d935346f20d
SHA256:
2AD86D34F9FF03DB4D21491CFDE9AB1A6820A1CA3F1947D02D73D4BCB30897CA
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
99cee0e20a3aa71a923377589a3ed7fa
SHA1:
de773105aec76e1c7fc3aa3bedd6356f65fba567
SHA256:
8B20DD8F5462959B2873FB170BDDC68F8190F82C4EC2EC12E08A45987D9D8E17
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
2957e9cacb59af869115e23b9264f6b3
SHA1:
b34ded7f991dd548ed3ec244bdfbca9710982417
SHA256:
A5384706433D155334DBC0ED9627453C1F8F714E710AADDFA2C9195A25F59E9D
File Size:
1.08 MB, 1076792 bytes
|
|
MD5:
a42f1b0f08e44f76347a57f429324b28
SHA1:
904ccd199634aac95f265595cfeeecabfe51a728
SHA256:
82946F964BD8243BB4C929649269357CE12B4C333999AF553F2ACC8533116A6C
File Size:
981.73 KB, 981728 bytes
|
|
MD5:
e949c65fefea2007aaeffe3a8c11ed5b
SHA1:
9e9652cbf471fd82cecaf632072629c9d4016abb
SHA256:
AB8598510B69A13B0706498A7916A3B5E6617CAF98C8A7A2C9E58B74DB11F3D7
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
be8e607c99bb0142e9883530c2bb87e5
SHA1:
daf0c8e402cfdb38140587007f2a9c1408f11483
SHA256:
2BD31FAF37EFCD97F8523499810F9641FBA375B9705B42DF0ED9ABCED01231AD
File Size:
961.74 KB, 961736 bytes
|
|
MD5:
186501413f926c14fae6a851f843efb8
SHA1:
c77a184f3e9baaee477d484a62f546caa6aca5fa
SHA256:
66447F9436A4232D884A4BCEC08511A6CC9D37B98C159000A5406E708A2F4822
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
2fdb719fb45b10d21480822e9541123b
SHA1:
89053d676affafc1037445074a02fe22fe05f8ef
SHA256:
83B1AD8B8CB0FF13291542E68419FDAF98EEBE0F38F9578F91A8DABFC2DBCC78
File Size:
1.02 MB, 1019720 bytes
|
|
MD5:
e08951f801b680b04b71f08fb60e09a4
SHA1:
b49792650f74b737cfa7f969b12253a1b1b7d765
SHA256:
277EA20089E4745D85D0A86DB7FF5165254FFF92F93D2DA534A493F0B2AE1E57
File Size:
981.73 KB, 981728 bytes
|
|
MD5:
49f54df7ff29b8a39774177b4cabeca6
SHA1:
25cd04d78e518bccefdef9624cab42947054dcff
SHA256:
84EC359139EF18EC8683890CDE4EE9E81BE13633CBCFCF385C1BD12079A061D0
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
41d6a513819c7fd277aa80db8038f9a6
SHA1:
f7da4fbcc3a3a0b4ca5447555dc9cfbc51ae29bf
SHA256:
6A9CB3252CFE29B01F5018E9EF6FD1F948926F1E2C81316BD0D870970F54E46E
File Size:
1.10 MB, 1099792 bytes
|
|
MD5:
d3ef8c39116175094e93db5689185ba7
SHA1:
b65a37405c970fc54f5c8b986f88d4dbd81e4f04
SHA256:
C94A38FDB26C3C619B5D70DDA7A77D98130F3778E202CCE55B72E61B1932D92D
File Size:
1.08 MB, 1076792 bytes
|
|
MD5:
5a6d1cb85002d9bc1802c215a4b0f90e
SHA1:
b071bfb3dde757a2ce034ca824a85b400060861c
SHA256:
5F65D54991B94C78F7955B102077F999F5512F3F24757A4E0FF817C22D527BFB
File Size:
985.35 KB, 985352 bytes
|
|
MD5:
c81c3e6c5165f5b3b275516f594f7ac0
SHA1:
4ef8b2b47c3af09570e5106100660804cc155136
SHA256:
5639D57D5025C490603BA2F82A5AD35E90AD1873F21F183CA66166DCDF43E804
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
5ebafb1faa92fd217dd700d408bb6d06
SHA1:
1a8c9ccecb5ab70ab624240aabe2a762ed70f55a
SHA256:
34ABF5F8CAADB74755B4DE975B166E9D99798352665EF969EA30A1BCB5EC83CC
File Size:
1.08 MB, 1076280 bytes
|
|
MD5:
3c51a6cd892b1d342cffbe8adeb90d91
SHA1:
15e768a1d994dbd0e3af8c4b1af98e1268acfa5b
SHA256:
AA5A9C68A8910EF6B2856257E64D581EF3E9B6C1E89A4D954C06D020A4C7C7F8
File Size:
991.77 KB, 991768 bytes
|
|
MD5:
63e5af30befac4c5c795e97c608585b1
SHA1:
2d040f12d34c88e19e64208fbeb34d51371bc469
SHA256:
5865EADFF387EE65FC46BF9E2B55AA9DEAD4C9CF2A8EE91666BB801FA5CBFBBD
File Size:
991.52 KB, 991520 bytes
|
|
MD5:
48372ecf767aa84aec66fc78b88f0016
SHA1:
cc968fc97b2d409b10345dcd7340be422eb383d9
SHA256:
7E895EECB1C47462439698FF32D1B44535E5D183BC2CD8A6F377A51D70B339D8
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
403860997649f477c035393717a45b3b
SHA1:
c9d12bbb2e2ddb0044fa9f4bfa61697455c878ac
SHA256:
E809A914F9A780FCC30575198809148376720E4287D09AEAC81829D69D7AEED3
File Size:
1.10 MB, 1099816 bytes
|
|
MD5:
7b1f7ae7aeb67e440a65d394b44234d4
SHA1:
5146457f5354f54266b35ff0d426d79869b118e9
SHA256:
0F8214D6F78B4FB3FD872D526A7F1F6568A70620114440DF70AA1FB939383CA3
File Size:
999.37 KB, 999368 bytes
|
|
MD5:
d2a513335c5dc92fb1848ba90bc3665f
SHA1:
232b8db25cf5fae86e6fd8a2ad96a13b24e91d3d
SHA256:
BCF65B10E8D32CFB0A40E121DAB7EB213C3808295CB42FB2F8DFC5163E6E7116
File Size:
961.38 KB, 961376 bytes
|
|
MD5:
6a2b9165c2e5239b489dcd71ea8babe0
SHA1:
a23315a4377c01889ba69d089a6f827168db292c
SHA256:
E7165140FAFB22B251FF6174E94EDC850038DCB92D3AE5B3202A227459798A7A
File Size:
912.22 KB, 912216 bytes
|
|
MD5:
f64f671daa1a8ac428cc3acd051c46cb
SHA1:
f31546e99265de7b853670ab24fc2ce4be07a06b
SHA256:
D33BA6E4AFA9AF325E9E1CADA16EE168697E2447630F1557998142305F0E27A7
File Size:
1.10 MB, 1099768 bytes
|
|
MD5:
c875488bccb728334465287c34349231
SHA1:
8ed93b2ffdb55fa4a693076b1305d277922c2539
SHA256:
F4FD74C87AE4D735584924B3B4AF4E7677ED519A15D173B0214675A644101E7C
File Size:
1.10 MB, 1099792 bytes
|
|
MD5:
ef8e87757b275afc6370b63f57c4dc56
SHA1:
a0d6b4d78e8c125cb454c00f858a13bbe30b1ca6
SHA256:
73D4AD698594C09105E563519BB662185E4B521F4B84374BE0E553E30BE1A3EB
File Size:
991.71 KB, 991712 bytes
|
|
MD5:
22879c0e714ff1f6dd2429816f776b9b
SHA1:
467ba272912b23340a055eaae7c9fe3649df1573
SHA256:
39E540B3984399CC1E331311A81C48360C8743ABC2D321D572DE56B00A218CE7
File Size:
999.44 KB, 999440 bytes
|
|
MD5:
e64a6d0ca6551b972fa87b1da708ceaf
SHA1:
b18407f2f56fa2412bbf031a22b6e12f8b16a438
SHA256:
892BC31EEB33773696E12BC74A0C4D33A50FACA332B5922CE8E466F9B30696A5
File Size:
999.22 KB, 999216 bytes
|
|
MD5:
726cea13739bb4c599b0810cafc19ccf
SHA1:
96cb629453445d67c6749505c1ef07e873f78d1a
SHA256:
9835503B5D2C4DA177037137145CFE3010BB944418B78E2AAF135289661BF70E
File Size:
981.73 KB, 981728 bytes
|
|
MD5:
d99126475ad29a30014c0f0dbd5c0fa7
SHA1:
207d089c81fc88840aaebbc17115795981927679
SHA256:
EF812D7D15309DCD52BFEA7C35B0DCFDF351BD8D91088A5C6A5143CE1E2ACB13
File Size:
1.10 MB, 1099768 bytes
|
|
MD5:
6db4ecb1857466bb0ecf42dc2f845600
SHA1:
81b85ae9f830acfd8d24c978dba934a904509c98
SHA256:
7CB8047D340CDB8D96CA503BEE8FAB07DC304EA24FEB1C8261F1D3EFF07097AD
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
032ccb3f883a7a628f8d5d721913acd7
SHA1:
32069ec4172c29bdf4ec023e0611cac85e8ada8a
SHA256:
2171756BCCFEF4AD4D90C27B3BA58FC18A538CD27D3ECE8F0F46AEE61A24DBA5
File Size:
1.10 MB, 1099824 bytes
|
|
MD5:
92538cbddc311b53e76b678f72d7553d
SHA1:
4be2f9c2df761b0c2598825960246ee1c633d8a6
SHA256:
66C3DCDB70C23DDB0EB035204B27170E006F2E47681D4076ABE7727860F1089F
File Size:
834.49 KB, 834488 bytes
|
|
MD5:
7f9c80d72af08acc0681fcfd9eaba6a5
SHA1:
08c9d9b0f92c196179d5fc80cac5e203e9509ced
SHA256:
DAC90E1ECADF42297522FD2C1A6157E655F2AF41B67D8C34CB99BB539B3CE662
File Size:
961.38 KB, 961376 bytes
|
|
MD5:
9f1b992f912a809480bf838fccfaa454
SHA1:
1b568b0c5bd3e7f07b94bb4c19f99658c30dad6a
SHA256:
419F7D955D51596B5070B16A05D8B0FC86364792A556444B3B238D8BD845BB91
File Size:
1.08 MB, 1076776 bytes
|
|
MD5:
d6893abff40c905d76addc9b0f7f45ae
SHA1:
88f0ea83856bd2e58a2cd45399582099b20d852f
SHA256:
C082B6F21FB2A152EE0F500D2C4AF0F773B334F3F25059B1AC8E1145DE46A7F5
File Size:
981.73 KB, 981728 bytes
|
|
MD5:
f4bab4c1a7042f188eccbec637df6deb
SHA1:
0ebb148af73cb3a62c7a6758ddb929098fa3e3b4
SHA256:
C43C73D3EDEF6E0FFD18FC999F27D2F88FE36CA13B05B48F44824AFB983EDABA
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
ce02c08e3b8769ced4c2bf7fe6464986
SHA1:
a87292a7e54f4ed94752955e18ca42a109c379e2
SHA256:
663210ACFB53ED0A8EDD510D8B023FD9C2C7B5187378B71A528872D3884C9E90
File Size:
895.79 KB, 895792 bytes
|
|
MD5:
5798164bbfb130d1c68c3612eb6991c7
SHA1:
0f0ab3f4a7403b89f1bc0e2f1613e1d99712592f
SHA256:
F9D95DA1B423BD0578FD650B479AC34BE998F9B3091DA61777C7C0A408173DCF
File Size:
1.08 MB, 1076800 bytes
|
|
MD5:
f4482b5633e2040fc5cdddcee83d5c9f
SHA1:
5f94d2fac46f8568eb1af16b03c30df8c7929b6d
SHA256:
E41EE788D29F7A73019794D9E1FC9D670D1274DF5A9207DC3378CD4C0EB64699
File Size:
992.01 KB, 992008 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
Show More
|
| Internal Name | LittleInstaller |
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
Show More
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Slimware Utilities Holdings, Inc. | Symantec Class 3 SHA256 Code Signing CA | Hash Mismatch |
File Traits
- HighEntropy
- Installer Version
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,163 |
|---|---|
| Potentially Malicious Blocks: | 296 |
| Whitelisted Blocks: | 1,830 |
| Unknown Blocks: | 37 |
Visual Map
1
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
1
0
x
0
x
x
0
0
0
0
0
x
x
0
x
1
x
x
0
x
0
0
?
x
0
0
0
0
1
0
x
0
0
0
0
0
1
x
0
x
0
0
1
0
1
0
x
x
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
x
x
x
0
x
0
0
x
x
0
0
0
0
1
0
?
0
0
0
0
0
x
0
0
x
0
0
0
0
0
x
1
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
1
0
x
x
0
x
0
x
x
0
0
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
x
0
0
0
0
1
0
0
x
0
x
0
1
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
x
x
x
x
x
x
x
0
x
x
0
1
0
x
1
0
x
x
?
x
?
x
x
?
?
?
?
x
x
x
x
0
x
0
0
x
1
1
x
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
x
1
x
x
x
0
x
0
0
x
x
0
0
0
0
0
1
0
0
1
0
0
0
1
0
0
1
0
x
x
x
x
0
x
x
x
0
0
x
x
x
0
0
x
0
x
x
0
0
0
0
0
x
x
0
0
1
x
0
x
0
x
0
0
0
0
0
x
x
x
x
?
x
0
0
x
0
x
x
?
x
x
0
?
?
x
0
0
1
0
0
x
x
0
0
1
x
x
x
x
0
x
x
x
0
?
0
1
0
0
1
1
0
0
1
0
0
1
x
0
1
0
x
?
x
x
0
x
0
0
1
0
0
1
x
0
x
x
x
x
x
x
0
1
0
x
x
1
0
x
x
x
x
0
x
0
x
x
0
x
x
0
0
0
0
0
1
0
0
0
0
0
0
0
x
x
1
x
0
0
x
x
x
0
x
x
x
x
0
x
0
x
x
0
x
x
x
x
0
0
x
0
x
0
1
x
x
x
x
0
0
2
0
0
x
0
x
x
x
0
1
x
x
x
x
?
?
0
x
x
?
x
x
0
0
x
?
?
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
?
x
x
x
0
0
0
x
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
1
0
x
?
x
x
x
x
0
0
x
x
x
x
x
x
0
x
0
x
0
x
0
0
0
0
0
0
x
x
x
0
x
x
x
x
0
0
x
x
x
0
1
0
0
0
0
x
x
x
?
0
0
x
x
x
0
x
x
0
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
x
0
x
0
0
0
x
0
0
x
x
0
x
0
x
0
0
x
0
0
0
0
0
x
0
x
0
x
0
0
x
0
0
0
x
x
0
0
0
0
0
x
0
0
x
0
0
x
x
x
x
0
0
x
0
x
x
0
0
0
0
0
0
0
0
x
x
x
0
0
x
x
x
x
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
?
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
1
1
0
1
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
2
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
1
1
0
3
1
1
2
3
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
1
0
0
1
0
0
0
0
1
1
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
0
1
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- DataStealer.F
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\swu1186.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu1b2b.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu1eca.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu1f23.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu2395.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu2606.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu2e99.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu3004.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu304.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu3113.tmp | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\swu31f8.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu3271.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu3e1a.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu3f95.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu405f.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu46aa.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu47ad.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu4bdf.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu4f74.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5129.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu53b9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu53d3.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu56.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5715.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5719.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5734.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5bcd.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5c98.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu5d34.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu63eb.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu6556.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu67e2.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu6a34.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu72b.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu7820.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swu8179.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swua59c.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swua999.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuad32.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuad90.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuaed8.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuaee8.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swub063.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swub274.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swub27b.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swub2ef.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swubcf5.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swubd04.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swubea2.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuc1af.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuc3b3.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuc7d9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swud209.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swud5f.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swud609.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swud87e.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swud9de.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swudc9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuea99.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swued27.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuf8a5.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swufc3e.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swufcc7.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\swuffcd.tmp | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\slimware utilities inc::machineid | 끦旓炋䯇₾䵒퍁됇 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 禎쏄䣺鎅ꜙ詽 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ‒䇽銆ꕥ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 㮇爫朔䒈鰥伀܁ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ㉺㜓䚔窛㠌쁽㭝 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 龍ᢖ鬭䛰┞鬒 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ϥ沵瘠䵅钊ဃ핪峸 | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\slimware utilities inc::machineid | ഉ죽㼫䎅鶶㳝ꤝ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | Zᷢ䘊傚Շ뚼體 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ꪈ覗읗䕓麸칊绯 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 㙏酮瀯䉣咶ꕱ‗ャ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 콉럭㫗䒠ꦜ콾ܼ鸄 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 痥땜镐䙎妀醢fi둞 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 뭯蝑땋䯉⢵쎵㔔蹄 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ፁ↚Dž䥊ঢ熂噻塵 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ꦀʤﺏ伵訣 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 累䚡릵滓ᨓ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 缯倜Ჳ䅞ᦋ햟횛 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 뻚십㊯䒽䮵៹ꇔ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | Šꇚ螂䕸풰傛ៈ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | Ĉឪ俿䎮䘠䟦 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ↺轧䫡侧妗ꠌ浩 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ꙼쓉䅠ₛ껊ᰥꖊ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 端枢竩䕢ᛵ뺝 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 兹～귕䓢➙沋輕 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 㑶礭ꍗ䮱躸縩ᴽ㪏 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ﯵ៩鸵䥔ﶴខણ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 㗵╫佣涼둃⩐澱 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ㏌됀ﻭ䓢ガ⣔媸텸 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 쏗㏪Ԛ䑿璲珄꙾ஊ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 这醔土䟫讛꜔ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::tbinstallationsessionid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc\driverupdate::installationsessionid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc\driverupdate\registration::installationid | RegNtPreCreateKey | |
| HKCU\software\slimware utilities inc\driverupdate::installationsessionid | RegNtPreCreateKey | |
| HKCU\software\slimware utilities inc::tbinstallationsessionid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc\driverupdate::installeroverlay | 㩡㨱獻㌺∺灵≬猻㈺㘳∺呙は湏穴橏㙫湉獖㍘ぎ坤灊䍚㝉穣穯橎楯䝚桖䑍此㉍瑍呚硕䍎〰䑏㉧坌ぅ坙瑙橍ㅅ呍祅㉙㕙坚汖橉穴橏睅楏ㅊ䙢樹㉢祊坙欵橉穴橏㙍汉塎楍㝉穣硯呍楯坤晸㉙瑆䝣灆㉚椴㍏㙍橎楯䝥瑒䑍㍁橉穴橏㙧湉獖㍘ㅎ浙歬橉穴橏㉉楏䑊䙔穣呤浨塡楬䕎䝎坕塖䕤癆䑚卒啒㍆卑㝉兦 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ჯ茈크䏣킲邐봍 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ﱳ䄤ቧ䂢鞢꿁솜췵 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 竧덇䴻䷱窹뼭▛↊ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ៱坉䓨芾丞ཪᐇ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 溂꛵䭡붹ᕁẤ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 姨㧼䠆㢚舕䟥抛 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 겝茒ڕ仏粢塾⒪楽 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 浰탍㓭䑬妀떩銡㋥ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 崦ۄ攩䩦펋鿫㛹岓 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 喼䲾ﱥ䜶⚬︯䐿 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 㸝㾰䞚ﶟٙ덾欘 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 씅掆놰䌟㪺폧୕ǣ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ㎗䇼憅ꋏ韈㋻ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 㴗ꕗ슾䅙㎚ಧᏍ펹 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 塰⦘촊䲋咴澨ᶜ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 侦⹈㲶䧢쎥볉槡ﱈ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 껎棝丛垘패ꆳ頀 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ʓ㶑䙸Ƃ῝ꚜ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 臑셝ꂸ互鲡ꖩ每뒍 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ᷌ᄏ乏庀㹸폇Ɠ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ꢾ뻉乓侩쩚 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | ㊛麌拇䎭ꚻ敿弛 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 긢댿䦝스螹 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 蹕ᡒ还䛙몪鿁∵ꄹ | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 详ꉴ決䢼㸻펼훨 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 湣晍秄䷀떰朌彻 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | RegNtPreCreateKey | |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 휉昴씩䡔羠颿寮 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 攔耀蠊丏䊤뵻䰊涮 | RegNtPreCreateKey |
| HKLM\software\wow6432node\slimware utilities inc::machineid | 뉨蘪鮈䄃䚻笀리 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| Other Suspicious |
|
| Network Winsock2 |
|
| Network Winhttp |
|
| Network Wininet |
|
