Static task
static1
Behavioral task
behavioral1
Sample
NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2.exe
Resource
win10v2004-20230220-en
General
-
Target
NordVPN Checker by xRisky v2.rar
-
Size
3.1MB
-
MD5
a5c29a79c38c213a4cc9194bbc09065a
-
SHA1
377e54ed0a1f2f166142f2a38ea3ba35ff469d82
-
SHA256
671c37266d8edfe445ac284ba2b1f1131cf314130a3cdc2f791ac1b965ed4ca8
-
SHA512
ca977a49a49c9dea82026ad0bd6528e5b3f58bf35acd38ac3dd904e2e2972b4099f5df82188242fb0da5566ed585d301c27b2366dfe0499ada24c0c64c166aba
-
SSDEEP
98304:XYu2NFa2UIBGA+Y3JtcZRfKOjEtdhkENsjoPn:XYu2NFKIBGA+uORltj2
Malware Config
Signatures
Files
-
NordVPN Checker by xRisky v2.rar.rar
Password: x-slayer.fun
-
NordVPN Checker by xRisky v2/------Read Me! ------.jpg
-
NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2/Leaf.xNet.dll.dll windows x86
Password: x-slayer.fun
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorDllMain
Sections
.text Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2/MetroSuite 2.0.dll.dll windows x86
Password: x-slayer.fun
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 291KB - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2/NordVPN Checker by xRisky v2.exe.exe windows x86
Password: x-slayer.fun
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ