Overview
overview
1Static
static
shellbutto...014.js
windows7-x64
1shellbutto...014.js
windows10-2004-x64
1shellbutto...500.js
windows7-x64
1shellbutto...500.js
windows10-2004-x64
1shellbutto...502.js
windows7-x64
1shellbutto...502.js
windows10-2004-x64
1shellbutto...503.js
windows7-x64
1shellbutto...503.js
windows10-2004-x64
1shellbutto...504.js
windows7-x64
1shellbutto...504.js
windows10-2004-x64
1shellbutto...505.js
windows7-x64
1shellbutto...505.js
windows10-2004-x64
1shellbutto...002.js
windows7-x64
1shellbutto...002.js
windows10-2004-x64
1shellbutto...018.js
windows7-x64
1shellbutto...018.js
windows10-2004-x64
1shellbutto...500.js
windows7-x64
1shellbutto...500.js
windows10-2004-x64
1shellbutto...502.js
windows7-x64
1shellbutto...502.js
windows10-2004-x64
1shellbutto...503.js
windows7-x64
1shellbutto...503.js
windows10-2004-x64
1shellbutto...504.js
windows7-x64
1shellbutto...504.js
windows10-2004-x64
1shellbutto...505.js
windows7-x64
1shellbutto...505.js
windows10-2004-x64
1shellbutto...020.js
windows7-x64
1shellbutto...020.js
windows10-2004-x64
1shellbutto...038.js
windows7-x64
1shellbutto...038.js
windows10-2004-x64
1shellbutto...500.js
windows7-x64
1shellbutto...500.js
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
shellbutton/Log/darasahi.com-10014.js
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
shellbutton/Log/darasahi.com-10014.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
shellbutton/Log/darasahi.com-500.js
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
shellbutton/Log/darasahi.com-500.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
shellbutton/Log/darasahi.com-502.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
shellbutton/Log/darasahi.com-502.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
shellbutton/Log/darasahi.com-503.js
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
shellbutton/Log/darasahi.com-503.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
shellbutton/Log/darasahi.com-504.js
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
shellbutton/Log/darasahi.com-504.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
shellbutton/Log/darasahi.com-505.js
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
shellbutton/Log/darasahi.com-505.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
shellbutton/Log/diaryofafatblackman.com-10002.js
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
shellbutton/Log/diaryofafatblackman.com-10002.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
shellbutton/Log/diaryofafatblackman.com-10018.js
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
shellbutton/Log/diaryofafatblackman.com-10018.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
shellbutton/Log/diaryofafatblackman.com-500.js
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
shellbutton/Log/diaryofafatblackman.com-500.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
shellbutton/Log/diaryofafatblackman.com-502.js
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
shellbutton/Log/diaryofafatblackman.com-502.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
shellbutton/Log/diaryofafatblackman.com-503.js
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
shellbutton/Log/diaryofafatblackman.com-503.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
shellbutton/Log/diaryofafatblackman.com-504.js
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
shellbutton/Log/diaryofafatblackman.com-504.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
shellbutton/Log/diaryofafatblackman.com-505.js
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
shellbutton/Log/diaryofafatblackman.com-505.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
shellbutton/Log/dpackco.com-10020.js
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
shellbutton/Log/dpackco.com-10020.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
shellbutton/Log/dpackco.com-10038.js
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
shellbutton/Log/dpackco.com-10038.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
shellbutton/Log/dpackco.com-500.js
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
shellbutton/Log/dpackco.com-500.js
Resource
win10v2004-20220901-en
General
-
Target
8d9fb14c830ca60a95eda9fe8943629b4a292e4596ecd7bfd4563c8eb0d20a6a
-
Size
519KB
-
MD5
8d7b1db56d40d7ea24f97deaf0cde9ff
-
SHA1
3a973332ebaa2ea0d2a106c1b657fc8d8c622022
-
SHA256
8d9fb14c830ca60a95eda9fe8943629b4a292e4596ecd7bfd4563c8eb0d20a6a
-
SHA512
f713caf7b9efc36a43464ebf5be2c666ecc898032c74d65de84462b450b7a1999d5340b7ce988478aa4602370c9861f28dc1e8ed27df11d44b837ee6f74c80d8
-
SSDEEP
12288:VwZyPfwJ0BKf3DfyuyZSz83ShFwaKrKOQRITcfvOD:q4q0BVufgSUaILKITyOD
Malware Config
Signatures
Files
-
8d9fb14c830ca60a95eda9fe8943629b4a292e4596ecd7bfd4563c8eb0d20a6a.zip
-
shellbutton/AdminPanels.txt
-
shellbutton/Log/darasahi.com-10014.txt.js
-
shellbutton/Log/darasahi.com-500.txt.js
-
shellbutton/Log/darasahi.com-502.txt.js
-
shellbutton/Log/darasahi.com-503.txt.js
-
shellbutton/Log/darasahi.com-504.txt.js
-
shellbutton/Log/darasahi.com-505.txt.js
-
shellbutton/Log/darvonda.com.txt.html .js
-
shellbutton/Log/dianipalmresort.com-10007%20%20.txt.html .js
-
shellbutton/Log/dianipalmresort.com-10018%20%20.txt.html .js
-
shellbutton/Log/dianipalmresort.com-10019%20%20.txt.html .js
-
shellbutton/Log/dianipalmresort.com-10020%20%20.txt.html .js
-
shellbutton/Log/diaryofafatblackman.com-10002.txt.js
-
shellbutton/Log/diaryofafatblackman.com-10018.txt.js
-
shellbutton/Log/diaryofafatblackman.com-500.txt.js
-
shellbutton/Log/diaryofafatblackman.com-502.txt.js
-
shellbutton/Log/diaryofafatblackman.com-503.txt.js
-
shellbutton/Log/diaryofafatblackman.com-504.txt.js
-
shellbutton/Log/diaryofafatblackman.com-505.txt.js
-
shellbutton/Log/dpackco.com-10020.txt.js
-
shellbutton/Log/dpackco.com-10038.txt.js
-
shellbutton/Log/dpackco.com-500.txt.js
-
shellbutton/Log/dpackco.com-502.txt.js
-
shellbutton/Log/dpackco.com-503.txt.js
-
shellbutton/Log/dpackco.com-504.txt.js
-
shellbutton/Log/dpackco.com-505.txt.js
-
shellbutton/Log/drkalan.com-10000.txt.js
-
shellbutton/Log/drkalan.com-500.txt.js
-
shellbutton/Log/drkalan.com-502.txt.js
-
shellbutton/Log/drkalan.com-503.txt.js
-
shellbutton/Log/drkalan.com-504.txt.js
-
shellbutton/Log/drkalan.com-505.txt.js
-
shellbutton/ShellButton.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
shellbutton/WebShells/backup
-
shellbutton/WebShells/stcchatcc.php
-
shellbutton/admp.zip.zip
-
shellbutton/admp/AdminPanels.txt
-
shellbutton/include.txt
-
shellbutton/lic
-
shellbutton/logins.txt
-
shellbutton/mod_ariimageslider.zip.zip
-
shellbutton/mod_articless.zip.zip
-
shellbutton/xNet.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
shellbutton/xNet.xml.xml
-
shellbutton/zagr.txt