General

  • Target

    asdfgdfdfdfdfdfdffgfdfg.zip

  • Size

    39.6MB

  • MD5

    26211232c4e9de64151d668d6fc5ab01

  • SHA1

    e2f0ee29f876b7822fa1f8337cd129f20c6df618

  • SHA256

    952fd48df104b9002c3f94e433a7a06024cfd86522f981e981c4f8cd1a2f2483

  • SHA512

    dbb47ed24b8ac4791cac5986022c835f29fccc01f493dcafe3e7ea8a7d1315d1f878d2264aa3c9aa62faf9fdf4533f3bfbd8f958efa48875349e8fa58e0cd4b4

  • SSDEEP

    786432:0Tr7fQKPYWxmcwSD6grWJhZ15YMZgUn4rQy5sxQjV9SrTW:0/7fQKQbSDfWhfQZ5s+BgrS

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

Files

  • asdfgdfdfdfdfdfdffgfdfg.zip
    .zip
  • .peu/New Project 1/compile.log
  • .peu/New Project 1/src/Api/kernel32.inc
  • .peu/New Project 1/src/Api/msvcrt.inc
  • .peu/New Project 1/src/Api/shlwapi.inc
  • .peu/New Project 1/src/Compression.asm
  • .peu/New Project 1/src/Download.asm
  • .peu/New Project 1/src/Drop.asm
  • .peu/New Project 1/src/Emulator.asm
  • .peu/New Project 1/src/Melt.asm
  • .peu/New Project 1/src/Obfuscator/nop.txt
  • .peu/New Project 1/src/Obfuscator/nop_minimal.txt
  • .peu/New Project 1/src/Obfuscator/register.txt
  • .peu/New Project 1/src/PebApi.asm
  • .peu/New Project 1/src/PebApi.inc
    .vbs
  • .peu/New Project 1/src/Resources/default.manifest
    .xml
  • .peu/New Project 1/src/Resources/elevated.manifest
    .xml
  • .peu/New Project 1/src/RunPE.asm
  • .peu/New Project 1/src/Stage2.asm
  • .peu/New Project 1/src/Stub.asm
  • .peu/New Project 1/src/nt.inc
  • BouncyCastle.Crypto.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Certificate/BackupCertificate.zip
    .zip
  • Certificate/ServerCertificate.p12
  • Chrome.ico
  • Clients/Downloads/A82871D5B4CE1A95/1.DAT
  • Clients/Downloads/A82871D5B4CE1A95/10.DAT
  • Clients/Downloads/A82871D5B4CE1A95/11.DAT
  • Clients/Downloads/A82871D5B4CE1A95/2.DAT
  • Clients/Downloads/A82871D5B4CE1A95/5.DAT
  • Clients/Downloads/A82871D5B4CE1A95/7.DAT
  • Compression7zip.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • FastColoredTextBox.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Gry73.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Guna.UI2.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • LiveCharts.Wpf.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • LiveCharts.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MetroFramework.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • New Project 1.peu
  • Obfuscation.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ActiveWindows.dll
  • Plugins/Admin.dll
  • Plugins/AntiMalware.dll
  • Plugins/BotsKiller.dll
  • Plugins/Chat.dll
  • Plugins/Clipboard.dll
  • Plugins/Cmd.dll
  • Plugins/DDos.dll
  • Plugins/DotNet.dll
  • Plugins/File Manager.dll
  • Plugins/FileManager.dll
  • Plugins/Fun.dll
  • Plugins/HBrowser.dll
  • Plugins/HRDP.dll
  • Plugins/HVNC.dll
  • Plugins/Helper.dll
  • Plugins/HiddenApps.dll
  • Plugins/HiddenProgram.dll
  • Plugins/Hosts.dll
  • Plugins/IconLib.dll
  • Plugins/Information.dll
  • Plugins/Installedsoftwares.dll
  • Plugins/Keylogger.dll
  • Plugins/MessageBox.dll
  • Plugins/Mic.dll
  • Plugins/Mining.dll
  • Plugins/Options.dll
  • Plugins/Password.dll
  • Plugins/Powershell.dll
  • Plugins/Ransomware.dll
  • Plugins/RecoviryPasswords.dll
  • Plugins/Regedit.dll
  • Plugins/RegistryEditor.dll
  • Plugins/RemoteCamera.dll
  • Plugins/RemoteDesktop.dll
  • Plugins/ReverseProxy.dll
  • Plugins/SClient.dll
  • Plugins/SendFile.dll
  • Plugins/Services.dll
  • Plugins/Startup.dll
  • Plugins/StreamLib.dll
  • Plugins/TCPConnection.dll
  • Plugins/TaskManager.dll
  • Plugins/USBSpread.dll
  • Plugins/User ID.dll
  • Plugins/WiFi.dll
  • Plugins/lz4.AnyCPU.loader.dll
  • Plugins/protobuf-net.dll
  • QuickLZLibrary.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • S500RAT.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • S500RAT.ico
  • Socks5.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SunnyUI.Common.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SunnyUI.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Svg.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Terror/1.gif
    .gif
  • Terror/2.gif
    .gif .ps1
  • Terror/3.gif
    .gif
  • Terror/4.gif
    .gif
  • Terror/T.wav
  • Tulpep.NotificationWindow.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Vestris.ResourceLib.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WinMic.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WinSound.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • cGeoIp.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • dnlib.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • initialization.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • lz4.AnyCPU.loader.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • protobuf-net.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • settings.xml
  • zxing.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections