Behavioral task
behavioral1
Sample
ZEROWARE/Zero.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ZEROWARE/Zero.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ZEROWARE/Zero.hl.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
ZEROWARE/Zero.hl.exe
Resource
win10v2004-20220812-en
General
-
Target
ZEROWARE_ICloodHack_Best__.rar
-
Size
278KB
-
MD5
b527bfc29876e94e6aaf2188a8a2aaff
-
SHA1
1a3a8681950bc953eb49c898fb5d6feb2dcd58ff
-
SHA256
61122e919d8eae9052be9b9647df23b4c12bba8216935dd0c82f9e5085e291f9
-
SHA512
34acdcf20799925da6f659d8389d726b89d32f97feaf8d318a94634b2bde02e7ad65964996689905b6833ae2cc88611df74892c38ed4a980d53eaf0675bea0df
-
SSDEEP
6144:BsFFl2OSFmwMXjmYKY87a1wowsohngG8UO9PINV2t:BsXl2O9wZtYGSvOht8UO9POS
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ZEROWARE/Zero.hl.exe upx
Files
-
ZEROWARE_ICloodHack_Best__.rar.rar
-
ZEROWARE/Zero.dll.dll windows x86
09d0478591d4f788cb3e5ea416c25237
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 165KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ZEROWARE/Zero.hl.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 196KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ZEROWARE/Zero.ini
-
ZEROWARE/config/fps+.cfg
-
ZEROWARE/config/fps-.cfg
-
ZEROWARE/config/knifebot_attack+.cfg
-
ZEROWARE/config/knifebot_attack-.cfg
-
ZEROWARE/config/legit.cfg
-
ZEROWARE/config/psilent.cfg
-
ZEROWARE/config/rage.cfg
-
ZEROWARE/config/softer.cfg
-
ZEROWARE/config/zero.cfg
-
ZEROWARE/injmthd.ini
-
ZEROWARE/ways/$1000$/ct
-
ZEROWARE/ways/$1000$/t
-
ZEROWARE/ways/$2000$/ct
-
ZEROWARE/ways/$2000$/t
-
ZEROWARE/ways/$5000$/ct
-
ZEROWARE/ways/$5000$/t
-
ZEROWARE/ways/35hp_2/ct
-
ZEROWARE/ways/35hp_2/ct_long
-
ZEROWARE/ways/35hp_2/new
-
ZEROWARE/ways/35hp_2/t
-
ZEROWARE/ways/35hp_2/t_long
-
ZEROWARE/ways/aim_deagle/ct
-
ZEROWARE/ways/aim_deagle/t
-
ZEROWARE/ways/aim_headshot/ct
-
ZEROWARE/ways/aim_headshot/t
-
ZEROWARE/ways/aim_map_usp/ct
-
ZEROWARE/ways/aim_map_usp/t
-
ZEROWARE/ways/awp_dust/ct
-
ZEROWARE/ways/awp_dust/t
-
ZEROWARE/ways/awp_india/ct
-
ZEROWARE/ways/awp_india/t
-
ZEROWARE/ways/awp_map/ct
-
ZEROWARE/ways/awp_map/t
-
ZEROWARE/ways/awp_rooftops/ct
-
ZEROWARE/ways/cs_assault/ct
-
ZEROWARE/ways/cs_assault/t
-
ZEROWARE/ways/cs_italy/ct
-
ZEROWARE/ways/cs_italy/t
-
ZEROWARE/ways/de_dust2/ct
-
ZEROWARE/ways/de_dust2/new
-
ZEROWARE/ways/de_dust2/t
-
ZEROWARE/ways/de_dust2/tt
-
ZEROWARE/ways/de_dust2/tt_all
-
ZEROWARE/ways/de_dust2_2x2/ct
-
ZEROWARE/ways/de_dust2_2x2/new
-
ZEROWARE/ways/de_dust2_2x2/t
-
ZEROWARE/ways/de_dust2_2x2/tt_all
-
ZEROWARE/ways/de_dust2x2/ct
-
ZEROWARE/ways/de_dust2x2/t
-
ZEROWARE/ways/de_dust_32/ct
-
ZEROWARE/ways/de_inferno/ct
-
ZEROWARE/ways/de_inferno/new
-
ZEROWARE/ways/de_inferno/t
-
ZEROWARE/ways/de_inferno_2x2/t
-
ZEROWARE/ways/de_mirage/new
-
ZEROWARE/ways/de_nuke/ct
-
ZEROWARE/ways/de_nuke/t
-
ZEROWARE/ways/de_train/ct
-
ZEROWARE/ways/de_train/new
-
ZEROWARE/ways/de_train/t
-
ZEROWARE/ways/de_westwood/ct
-
ZEROWARE/ways/de_westwood/t
-
ZEROWARE/ways/fy_pool_day/ct
-
ZEROWARE/ways/fy_pool_day/t
-
ZEROWARE/ways/hns_floppytown/ct
-
ZEROWARE/ways/hvh_lite2/new