Resubmissions

30-04-2023 20:16

230430-y169psah37 7

30-04-2023 20:09

230430-yxckxsah25 10

30-04-2023 20:03

230430-ys13qaag96 7

30-04-2023 19:55

230430-ym5hyscf3w 7

General

  • Target

    ChatGPT (Bot).zip

  • Size

    7.1MB

  • MD5

    d2f022536243004be4a21092f99b8d0f

  • SHA1

    856b042c9fdf1604679be190acb1c2068cb52730

  • SHA256

    c1fe20b075cd91dbe6454422825af7b98d5e4914c00f81612c18a5be7f8cd509

  • SHA512

    076e79b7521467a3e204d5cf820f6a312bf9eb8d581b0d0c6a6d96235c9f8284fed92d8b3a546fa6b0603743d5b90f64f6b596e13b2b44efc63930e09e3e5852

  • SSDEEP

    98304:3unHAbqD9nF3jbQD3l6rMgXneBMYFzxVyOax5Zg2ILh7shAUA:3unHAuD9ljzG3xAZ/TkshAUA

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • ChatGPT (Bot).zip
    .zip
  • ActiveReign/.gitignore
  • ActiveReign/.gitmodules
  • ActiveReign/LICENSE
  • ActiveReign/Pipfile
  • ActiveReign/Pipfile.lock
  • ActiveReign/README.md
  • ActiveReign/bdist.linux-x86_64/build/ALMountConn.dll
    .dll windows x86

    b035cfed2ef80a7bb2326d03c3f68a9d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ActiveReign/bdist.linux-x86_64/build/ALMountDrv.sys
    .exe windows x86

    04f95ef2546a06f3eb5fcb0360b2cfe5


    Headers

    Imports

    Sections

  • ActiveReign/bdist.linux-x86_64/build/ALMountDrv64.sys
    .exe windows x64

    9b47ab88d9d4741660b38ac6942f38c9


    Headers

    Imports

    Sections

  • ActiveReign/bdist.linux-x86_64/build/ALSTS.dll
    .dll windows x86

    248366095390f81b0cefcd88c37fb2f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ActiveReign/bdist.linux-x86_64/build/Cabinet.dll
    .dll windows x86

    9265de4279ec2b9cc932b695004ba8dd


    Headers

    Imports

    Exports

    Sections

  • ActiveReign/bdist.linux-x86_64/build/Styles/Office2013.dll
    .dll windows x86


    Code Sign

    Headers

    Sections

  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/1.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/110Banner.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/1121Banner.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/2.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/3.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/4.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/en-us/5.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/ko-kr/1121Banner.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/Tutorial/ko-kr/4.gif
    .gif
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/__init__.py
    .py .sh linux
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/__main__.py
    .py .sh linux
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/atexec.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/connector.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/ldap/__init__.py
    .py .js
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/ldap/query.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/rpc.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/smb.py
    .py .js
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/smbexec.py
    .py .js
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/winrm.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/wmi.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/core/wmiexec.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/first_run.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/helpers/misc.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/helpers/powershell.py
    .py .ps1
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/helpers/remotefile.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/loaders/config_loader.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/logger.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/example_module.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/get_lockedaccounts.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/get_netdomaincontroller.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/gpp_password.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/invert_hunter.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/invoke_kerberoast.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/invoke_vnc.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/ironkatz.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/kill_defender.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/mimikatz.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/procdump.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/process_hunter.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/test_execution.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/user_hunter.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/wdigest.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/modules/wifi_passwords.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/db/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/db/arg_parser.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/db/db_core.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/db/db_query.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/db/db_shell.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/arg_parser.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/code_execution.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/file_parser/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/file_parser/parse_docx.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/file_parser/parse_regex.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/file_parser/parse_xlsx.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/host_enum.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/lockout_tracker.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/ntds_extract.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/polenum.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/share_finder.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/spider/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/enum/spider/file_search.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/query/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/query/arg_parser.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/shell/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/shell/arg_parser.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/spray/__init__.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/ops/spray/arg_parser.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/pysmb/file_ops.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/pysmb/smb.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/servers/http.py
  • ActiveReign/bdist.linux-x86_64/build/lib/ar3/servers/smb.py
  • ActiveReign/impacket/.git/HEAD
  • ActiveReign/impacket/.git/config
  • ActiveReign/impacket/.git/description
  • ActiveReign/impacket/.git/hooks/applypatch-msg.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/commit-msg.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/fsmonitor-watchman.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/post-update.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/pre-applypatch.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/pre-commit.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/pre-merge-commit.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/pre-push.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/pre-rebase.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/pre-receive.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/prepare-commit-msg.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/push-to-checkout.sample
    .sh linux
  • ActiveReign/impacket/.git/hooks/update.sample
    .sh linux
  • ActiveReign/impacket/.git/index
  • ActiveReign/impacket/.git/info/exclude
  • ActiveReign/impacket/.git/logs/HEAD
  • ActiveReign/impacket/.git/logs/refs/heads/master
  • ActiveReign/impacket/.git/logs/refs/remotes/origin/HEAD
  • ActiveReign/impacket/.git/objects/pack/pack-8a3049cc7cae21ec5baae5b10847802eaf5417aa.idx
  • ActiveReign/impacket/.git/packed-refs
  • ActiveReign/impacket/.git/refs/heads/master
  • ActiveReign/impacket/.git/refs/remotes/origin/HEAD
  • ActiveReign/impacket/.github/ISSUE_TEMPLATE/bug_report.md
  • ActiveReign/impacket/.github/workflows/build_and_test.yml
  • ActiveReign/impacket/.gitignore
  • ActiveReign/impacket/.travis.yml
  • ActiveReign/impacket/ChangeLog
  • ActiveReign/impacket/Dockerfile
  • ActiveReign/impacket/LICENSE
  • ActiveReign/impacket/MANIFEST.in
  • ActiveReign/impacket/README.md
  • ActiveReign/impacket/SECURITY.md
  • ActiveReign/impacket/requirements.txt
  • ActiveReign/impacket/setup.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/__init__.py
  • ActiveReign/impacket/tests/ImpactPacket/runalltestcases.bat
  • ActiveReign/impacket/tests/ImpactPacket/runalltestcases.sh
    .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_ICMP6.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_IP6.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_IP6_Address.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_IP6_Extension_Headers.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_TCP.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_TCP_bug_issue7.py
    .py .sh linux
  • ActiveReign/impacket/tests/ImpactPacket/test_ethernet.py
    .py .sh linux
  • ActiveReign/impacket/tests/SMB_RPC/__init__.py
  • ActiveReign/impacket/tests/SMB_RPC/dcetests.cfg
  • ActiveReign/impacket/tests/SMB_RPC/rundce.sh
    .sh linux
  • ActiveReign/impacket/tests/SMB_RPC/test_bkrp.py
  • ActiveReign/impacket/tests/SMB_RPC/test_dcomrt.py
  • ActiveReign/impacket/tests/SMB_RPC/test_dhcpm.py
  • ActiveReign/impacket/tests/SMB_RPC/test_drsuapi.py
  • ActiveReign/impacket/tests/SMB_RPC/test_epm.py
  • ActiveReign/impacket/tests/SMB_RPC/test_even.py
  • ActiveReign/impacket/tests/SMB_RPC/test_even6.py
  • ActiveReign/impacket/tests/SMB_RPC/test_fasp.py
  • ActiveReign/impacket/tests/SMB_RPC/test_ldap.py
  • ActiveReign/impacket/tests/SMB_RPC/test_lsad.py
  • ActiveReign/impacket/tests/SMB_RPC/test_lsat.py
  • ActiveReign/impacket/tests/SMB_RPC/test_mgmt.py
  • ActiveReign/impacket/tests/SMB_RPC/test_mimilib.py
  • ActiveReign/impacket/tests/SMB_RPC/test_ndr.py
  • ActiveReign/impacket/tests/SMB_RPC/test_nmb.py
  • ActiveReign/impacket/tests/SMB_RPC/test_nrpc.py
  • ActiveReign/impacket/tests/SMB_RPC/test_ntlm.py
  • ActiveReign/impacket/tests/SMB_RPC/test_rpch.py
  • ActiveReign/impacket/tests/SMB_RPC/test_rpcrt.py
  • ActiveReign/impacket/tests/SMB_RPC/test_rprn.py
  • ActiveReign/impacket/tests/SMB_RPC/test_rrp.py
  • ActiveReign/impacket/tests/SMB_RPC/test_samr.py
  • ActiveReign/impacket/tests/SMB_RPC/test_scmr.py
  • ActiveReign/impacket/tests/SMB_RPC/test_secretsdump.py
  • ActiveReign/impacket/tests/SMB_RPC/test_smb.py
  • ActiveReign/impacket/tests/SMB_RPC/test_smbserver.py
    .py .sh linux
  • ActiveReign/impacket/tests/SMB_RPC/test_spnego.py
  • ActiveReign/impacket/tests/SMB_RPC/test_srvs.py
  • ActiveReign/impacket/tests/SMB_RPC/test_tsch.py
  • ActiveReign/impacket/tests/SMB_RPC/test_wkst.py
  • ActiveReign/impacket/tests/SMB_RPC/test_wmi.py
  • ActiveReign/impacket/tests/coveragerc
  • ActiveReign/impacket/tests/dot11/runalltestcases.bat
  • ActiveReign/impacket/tests/dot11/runalltestcases.sh
    .sh linux
  • ActiveReign/impacket/tests/dot11/test_Dot11Base.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_Dot11Decoder.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_Dot11HierarchicalUpdate.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameControlACK.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameControlCFEnd.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameControlCFEndCFACK.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameControlCTS.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameControlPSPoll.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameControlRTS.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameData.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagement.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementAssociationRequest.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementAssociationResponse.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementAuthentication.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementDeauthentication.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementDisassociation.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementProbeRequest.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementProbeResponse.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementReassociationRequest.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_FrameManagementReassociationResponse.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_RadioTap.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_RadioTapDecoder.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_WEPDecoder.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_WEPEncoder.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_WPA.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_WPA2.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_helper.py
    .py .sh linux
  • ActiveReign/impacket/tests/dot11/test_wps.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/runalltestcases.bat
  • ActiveReign/impacket/tests/misc/runalltestcases.sh
    .sh linux
  • ActiveReign/impacket/tests/misc/test_crypto.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_dcerpc_v5_ndr.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_dns.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_dpapi.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_ip6_address.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_krb5_crypto.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_structure.py
    .py .sh linux
  • ActiveReign/impacket/tests/misc/test_utils.py
    .py .sh linux
  • ActiveReign/impacket/tests/runall.sh
    .sh linux
  • ActiveReign/impacket/tests/walkmodules.py
    .py .sh linux
  • ActiveReign/impacket/tox.ini
  • ActiveReign/requirements.txt
  • ActiveReign/setup.py
  • ChatGPT (Bot).exe
    .exe windows x64


    Code Sign

    Headers

    Sections