Overview

overview

7

Static

static

7

zero.dll

windows10-1703-x64

1

zero.hl.exe

windows10-1703-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    cs.rar

  • Size

    570KB

  • MD5

    7b529f57140751b4323f7d1319dff638

  • SHA1

    6db79ebcaaa36ce89d4935744ffb0e1eeb224fb0

  • SHA256

    814807348f921200a62c5faf5cbefbe0e6fab07637f50b4d8ae918a01a4dd678

  • SHA512

    6c4e6899e470ab57b106c8737433a2e1d746d19ecd32feba96fcf594c29f7730762842cb34b6c3f823bb3712bfbb4173bd6c07480b1ef847f6b7dfef6e43c895

  • SSDEEP

    12288:yUKM4/45N6wR9590CzVL+7Yt+lvtsnih8+Olm8:fvQ4z6wX59fzVK7Yt+lSiBOlm8

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • cs.rar
    .rar

    Password: infected

  • config/alternative.cfg
  • config/fps+.cfg
  • config/fps-.cfg
  • config/knifebot_attack+.cfg
  • config/knifebot_attack-.cfg
  • config/legit.cfg
  • config/psilent.cfg
  • config/rage.cfg
  • injmthd.ini
  • k l a.txt
  • read me.txt
  • ways/$1000$/ct
  • ways/$1000$/t
  • ways/$2000$/ct
  • ways/$2000$/t
  • ways/$5000$/ct
  • ways/$5000$/t
  • ways/35hp_2/ct
  • ways/35hp_2/ct_long
  • ways/35hp_2/new
  • ways/35hp_2/t
  • ways/35hp_2/t_long
  • ways/aim_deagle/ct
  • ways/aim_deagle/t
  • ways/aim_headshot/ct
  • ways/aim_headshot/t
  • ways/aim_map_usp/ct
  • ways/aim_map_usp/t
  • ways/awp_dust/ct
  • ways/awp_dust/t
  • ways/awp_india/ct
  • ways/awp_india/t
  • ways/awp_map/ct
  • ways/awp_map/t
  • ways/awp_rooftops/ct
  • ways/cs_assault/ct
  • ways/cs_assault/t
  • ways/cs_italy/ct
  • ways/cs_italy/t
  • ways/de_dust2/ct
  • ways/de_dust2/new
  • ways/de_dust2/t
  • ways/de_dust2/tt
  • ways/de_dust2/tt_all
  • ways/de_dust2_2x2/ct
  • ways/de_dust2_2x2/new
  • ways/de_dust2_2x2/t
  • ways/de_dust2_2x2/tt_all
  • ways/de_dust2x2/ct
  • ways/de_dust2x2/t
  • ways/de_dust_32/ct
  • ways/de_inferno/ct
  • ways/de_inferno/new
  • ways/de_inferno/t
  • ways/de_inferno_2x2/t
  • ways/de_mirage/new
  • ways/de_nuke/ct
  • ways/de_nuke/t
  • ways/de_train/ct
  • ways/de_train/new
  • ways/de_train/t
  • ways/de_westwood/ct
  • ways/de_westwood/t
  • ways/fy_pool_day/ct
  • ways/fy_pool_day/t
  • ways/hns_floppytown/ct
  • ways/hvh_lite2/new
  • zero.dll
    .dll windows x86

    Password: infected

    9110c9cc062244e30a4d84956b2b2833


    Headers

    Imports

    Sections

  • zero.hl.exe
    .exe windows x86

    Password: infected


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections