Reference: https://twitter.com/ankit_anubhav/status/1636714527218880515
MD5 of extracted payload from memory: b3ee90839fb872c6bdd75c3397ec4c35

InstallFolder: %AppData%
InstallFile: Defender.exe
Delay: 3
Hwid: null
Ports: 6606,7707,8808,3313,3314,3315,9441,9442,9443,2900,2901,5505,8888,9999,6666,5155,5122
Hosts: 127.0.0.1,chromedata.accesscam.org,cdt2023.ddns.net,chromedata.webredirect.org
Version: | Edit 3LOSH RAT
Install: false
Key: QUd0NVYxeGR0T216M05KNkgxUGxraUlyMkI1eDRvQk8=
MTX: AsyncMutex_6SI8OkPnk
Certificate: MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhYg1tekZ8F29gsEIDgf8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMwVwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXLhXoEwCzwzvUCrzPXd3uMsLfFMDHZJOQ9OXKUCHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3ingNFaTyYmGsmLIE2Jq5AR1AxAFEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICtJ8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNtCjnlaMc40DJHlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQHMA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6xZCPjr22VxZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWTnKuRvIEYU4RaB39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7kVfIYuRxlYefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWNFmlzF3THeHU6vNJ5UoAWHYFW8wfJCbzQ0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckULlEf4Y92uJVKvLGruQtmtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv36kLKhgIJlqC7XxPVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWSJykARBv9o2BjLPTADfwAtc1b4nWo0lCI8IjjYXumJOuwRkFJ19INtwbffQvT9U12t4smpcZVOK0opk4Yr9r1tZYm92ghXA
ServerSignature: eMPjfmjCdxuRWtal1HvTUAypuYKTvSKWwOGMVYds7gcWJ6Z5UAOol82re1jnvHj56kZlvtPCUQpS6Jkd5JBJUzWHe2faeNK1uQ5UzPVIEYG8zszFukAZVVwwT5ZnS9GdFOA57FLCRmfQ8zVeinB8aSN4rT0Czf4osXDGqxtXF3tMfJ4XYfO1BRuMswzDCK9WrBYhHbidiUqAmznOjrXNLrupW6skL5ePIxzCsLGs8ul29Yb7jRNpE4v8DpFtnV2uo5SOPVr1f96yw799nbFE8M5F9cschXP8RIC1Ft28Qe24HN3FZ6UAMOVlVBtTdGk3ZgNBlM0H7X4idbJn8oy2Rpf4LZA4LmFj5NFrLssz3N9YyHgpNXFXH2terX0zR1BzedXfj8rwdGvKCJzqT0sJtD3ElYp7pEOkeqaLUfBG3c2PXCJGukbxCRPE8ed3wW8T5iTV59sn2ja4265vLw0xclJ8mFxFAwJMnN7dKJQlPOXZNkqk1uT5hcNOaB5FPZiVcWQzKqUHBP2rYIyldVS8ka7aQfHW8GCNtXbNnVJMKUEV2BRWCq8RiqCuQMs3tqb4wRew7fbVPwGFOaZF0ZvkiAFc7qC0VsMr7ZZDSyNQuOkdvplqkM5hamLfBZN7hw2njGQnrop5H8mjNeSqKtjRFc
Anti: false
offlineKL: false
clipper: false
btc: BTC Address
eth: ETH Address
tron: Trc20 Address
Pastebin: null
BDOS: false
Group: MARO2022
