Extracted

• 1106.zip

  .zip
• 1106-01-Redline.exe

  .exe windows:5 windows x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 25KB - Virtual size: 25KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .bss

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 346KB - Virtual size: 349KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .jkqvbz

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• 1106-02-Stealc.exe

  .exe windows:5 windows x86

  892cf399352d143dfa090ba225b3a97b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetSystemDefaultLangID

  WriteConsoleInputW

  lstrlenA

  GetStringTypeA

  GetConsoleAliasA

  WaitNamedPipeA

  GetEnvironmentStringsW

  WriteConsoleInputA

  AddConsoleAliasW

  FlushConsoleInputBuffer

  SetTapeParameters

  MoveFileWithProgressA

  FindNextVolumeMountPointA

  GetConsoleAliasesA

  ConvertFiberToThread

  ExpandEnvironmentStringsA

  GetPrivateProfileStringW

  ReadConsoleW

  GetWindowsDirectoryA

  GetCompressedFileSizeW

  GetConsoleAliasExesW

  CreateActCtxW

  GetPrivateProfileIntA

  LoadLibraryW

  SetCommConfig

  FatalAppExitW

  _hread

  GetSystemPowerStatus

  HeapDestroy

  GetFileAttributesA

  GetExitCodeProcess

  ReplaceFileW

  IsDBCSLeadByte

  GetTimeZoneInformation

  EnumSystemLocalesA

  GetConsoleOutputCP

  GetStartupInfoA

  FindFirstFileA

  GetLastError

  SetLastError

  GetProcAddress

  WriteProfileSectionA

  RemoveDirectoryA

  CopyFileA

  GlobalGetAtomNameA

  SetFileApisToOEM

  LoadLibraryA

  LocalAlloc

  SetConsoleCtrlHandler

  CreateEventW

  VirtualLock

  OpenJobObjectW

  FoldStringA

  GlobalFindAtomW

  GetModuleHandleA

  SetLocaleInfoW

  FindNextFileW

  VirtualProtect

  GetCurrentDirectoryA

  CompareStringA

  GetShortPathNameW

  OpenSemaphoreW

  ReadConsoleInputW

  FindFirstVolumeW

  MoveFileWithProgressW

  ReadConsoleOutputCharacterW

  EnumSystemLocalesW

  DeleteFileA

  ExpandEnvironmentStringsW

  CreateFileW

  WriteConsoleW

  InterlockedIncrement

  InterlockedDecrement

  EncodePointer

  DecodePointer

  Sleep

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  HeapFree

  GetCommandLineW

  HeapSetInformation

  GetStartupInfoW

  RaiseException

  RtlUnwind

  HeapAlloc

  WideCharToMultiByte

  LCMapStringW

  MultiByteToWideChar

  GetCPInfo

  IsProcessorFeaturePresent

  HeapCreate

  HeapSize

  GetModuleHandleW

  ExitProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  SetFilePointer

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  FreeEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetCurrentThreadId

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetLocaleInfoW

  GetACP

  GetOEMCP

  IsValidCodePage

  GetUserDefaultLCID

  GetLocaleInfoA

  IsValidLocale

  GetStringTypeW

  HeapReAlloc

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  CloseHandle

  user32

  CharUpperA

  Sections

  .text

  Size: 177KB - Virtual size: 176KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 68KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• 1106-03-AgentTesla.exe

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 697KB - Virtual size: 696KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 1106-04-Warzone.exe

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 187KB - Virtual size: 186KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 1106-05-Windigo.exe

  .exe windows:1 windows x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 584B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 97KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• 1106-06-Zgrat.exe

  .exe windows:4 windows x64

  
  

  Code Sign

  5b:35:64:39:ee:e3:36:83:4c:9a:f1:9a:34:50:98:4c

  Certificate

  Issuer

  CN=MoonMist

  Not Before

  05-11-2023 21:52

  Not After

  05-11-2024 22:12

  Subject

  CN=MoonMist

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  5b:35:64:39:ee:e3:36:83:4c:9a:f1:9a:34:50:98:4c

  Certificate

  Issuer

  CN=MoonMist

  Not Before

  05-11-2023 21:52

  Not After

  05-11-2024 22:12

  Subject

  CN=MoonMist

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  e3:15:54:82:bc:42:49:cf:71:8c:fa:02:f3:38:30:ba:8b:30:c9:b9:9f:99:4e:a8:67:fb:c7:75:49:de:0d:cc

  Signer

  Actual PE Digest

  e3:15:54:82:bc:42:49:cf:71:8c:fa:02:f3:38:30:ba:8b:30:c9:b9:9f:99:4e:a8:67:fb:c7:75:49:de:0d:cc

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  4b:09:4c:73:51:d3:4c:23:5f:78:25:f5:37:91:82:f0:63:32:99:33

  Signer

  Actual PE Digest

  4b:09:4c:73:51:d3:4c:23:5f:78:25:f5:37:91:82:f0:63:32:99:33

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 4.3MB - Virtual size: 4.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3.2MB - Virtual size: 3.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• 1106-07-BlankGrabber.exe

  .exe windows:5 windows x64

  20d446c1cb128febd23deb17efb67cf6

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Not Before

  29-09-2021 00:00

  Not After

  28-09-2024 23:59

  Subject

  SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  2e:a2:ac:21:28:2e:c7:69:0b:ee:03:0b:30:65:93:65:21:6d:fe:db:64:6a:48:35:c6:1d:36:de:72:eb:33:9c

  Signer

  Actual PE Digest

  2e:a2:ac:21:28:2e:c7:69:0b:ee:03:0b:30:65:93:65:21:6d:fe:db:64:6a:48:35:c6:1d:36:de:72:eb:33:9c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  CreateWindowExW

  MessageBoxW

  MessageBoxA

  SystemParametersInfoW

  DestroyIcon

  SetWindowLongPtrW

  GetWindowLongPtrW

  GetClientRect

  InvalidateRect

  ReleaseDC

  GetDC

  DrawTextW

  GetDialogBaseUnits

  EndDialog

  DialogBoxIndirectParamW

  MoveWindow

  SendMessageW

  comctl32

  ord380

  kernel32

  GetStringTypeW

  GetFileAttributesExW

  HeapReAlloc

  FlushFileBuffers

  GetCurrentDirectoryW

  IsValidCodePage

  GetACP

  GetModuleHandleW

  MulDiv

  GetLastError

  SetDllDirectoryW

  GetModuleFileNameW

  CreateSymbolicLinkW

  GetProcAddress

  GetCommandLineW

  GetEnvironmentVariableW

  GetOEMCP

  ExpandEnvironmentStringsW

  CreateDirectoryW

  GetTempPathW

  WaitForSingleObject

  Sleep

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoW

  FreeLibrary

  LoadLibraryExW

  SetConsoleCtrlHandler

  FindClose

  FindFirstFileExW

  CloseHandle

  GetCurrentProcess

  LocalFree

  FormatMessageW

  MultiByteToWideChar

  WideCharToMultiByte

  GetCPInfo

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  GetTimeZoneInformation

  HeapSize

  WriteConsoleW

  SetEnvironmentVariableW

  RtlUnwindEx

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  SetEndOfFile

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  GetCommandLineA

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetFullPathNameW

  RemoveDirectoryW

  FindNextFileW

  SetStdHandle

  DeleteFileW

  ReadFile

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  CompareStringW

  LCMapStringW

  advapi32

  OpenProcessToken

  GetTokenInformation

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidW

  gdi32

  SelectObject

  DeleteObject

  CreateFontIndirectW

  Sections

  .text

  Size: 167KB - Virtual size: 166KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 75KB - Virtual size: 75KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• D4X[��.pyc
• 1106-08-Glupteba.exe

  .exe windows:5 windows x86

  892cf399352d143dfa090ba225b3a97b

  
  

  Code Sign

  49:a3:9c:39:b4:ee:8e:82:68:35:68:c5:44:0c:3e:a2

  Certificate

  Issuer

  CN=522910322628070b250c52200b542f1a57031b422732351e332f4620190820022d0b,POSTALCODE=10826,ST=0b1c1115005f5c4e010b00101c041100031a0d10104b111d+ST=0b1c1115494a5c18101602500b53081d121c021c1b120f07110e12511d161a5003091c030c1053460e4113160e181d130101060d401252070f0f08001312055b0c0b0a070b

  Not Before

  06-11-2023 13:34

  Not After

  05-11-2024 13:34

  Subject

  CN=522910322628070b250c52200b542f1a57031b422732351e332f4620190820022d0b,POSTALCODE=10826,ST=0b1c1115005f5c4e010b00101c041100031a0d10104b111d+ST=0b1c1115494a5c18101602500b53081d121c021c1b120f07110e12511d161a5003091c030c1053460e4113160e181d130101060d401252070f0f08001312055b0c0b0a070b

  a1:2d:0e:50:ae:2f:31:e1:d8:c8:98:f1:35:a4:fe:6f:08:37:aa:72:e2:75:0b:2a:ea:44:33:45:83:19:54:db

  Signer

  Actual PE Digest

  a1:2d:0e:50:ae:2f:31:e1:d8:c8:98:f1:35:a4:fe:6f:08:37:aa:72:e2:75:0b:2a:ea:44:33:45:83:19:54:db

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetSystemDefaultLangID

  WriteConsoleInputW

  lstrlenA

  GetStringTypeA

  GetConsoleAliasA

  WaitNamedPipeA

  GetEnvironmentStringsW

  WriteConsoleInputA

  AddConsoleAliasW

  FlushConsoleInputBuffer

  SetTapeParameters

  MoveFileWithProgressA

  FindNextVolumeMountPointA

  GetConsoleAliasesA

  ConvertFiberToThread

  ExpandEnvironmentStringsA

  GetPrivateProfileStringW

  ReadConsoleW

  GetWindowsDirectoryA

  GetCompressedFileSizeW

  GetConsoleAliasExesW

  CreateActCtxW

  GetPrivateProfileIntA

  LoadLibraryW

  SetCommConfig

  FatalAppExitW

  _hread

  GetSystemPowerStatus

  HeapDestroy

  GetFileAttributesA

  GetExitCodeProcess

  ReplaceFileW

  IsDBCSLeadByte

  GetTimeZoneInformation

  EnumSystemLocalesA

  GetConsoleOutputCP

  GetStartupInfoA

  FindFirstFileA

  GetLastError

  SetLastError

  GetProcAddress

  WriteProfileSectionA

  RemoveDirectoryA

  CopyFileA

  GlobalGetAtomNameA

  SetFileApisToOEM

  LoadLibraryA

  LocalAlloc

  SetConsoleCtrlHandler

  CreateEventW

  VirtualLock

  OpenJobObjectW

  FoldStringA

  GlobalFindAtomW

  GetModuleHandleA

  SetLocaleInfoW

  FindNextFileW

  VirtualProtect

  GetCurrentDirectoryA

  CompareStringA

  GetShortPathNameW

  OpenSemaphoreW

  ReadConsoleInputW

  FindFirstVolumeW

  MoveFileWithProgressW

  ReadConsoleOutputCharacterW

  EnumSystemLocalesW

  DeleteFileA

  ExpandEnvironmentStringsW

  CreateFileW

  WriteConsoleW

  InterlockedIncrement

  InterlockedDecrement

  EncodePointer

  DecodePointer

  Sleep

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  HeapFree

  GetCommandLineW

  HeapSetInformation

  GetStartupInfoW

  RaiseException

  RtlUnwind

  HeapAlloc

  WideCharToMultiByte

  LCMapStringW

  MultiByteToWideChar

  GetCPInfo

  IsProcessorFeaturePresent

  HeapCreate

  HeapSize

  GetModuleHandleW

  ExitProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  SetFilePointer

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  FreeEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetCurrentThreadId

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetLocaleInfoW

  GetACP

  GetOEMCP

  IsValidCodePage

  GetUserDefaultLCID

  GetLocaleInfoA

  IsValidLocale

  GetStringTypeW

  HeapReAlloc

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  CloseHandle

  user32

  CharUpperA

  Sections

  .text

  Size: 4.1MB - Virtual size: 4.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 68KB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• 1106-09-Msfvenom.exe

  .exe windows:4 windows x86

  481f47bbb2c9c21e108d65f52b04c448

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _iob

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  __p___initenv

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  strrchr

  wcsncmp

  _close

  wcslen

  wcscpy

  strerror

  modf

  strspn

  realloc

  __p__environ

  __p__wenviron

  _errno

  free

  strncmp

  strstr

  strncpy

  _ftol

  qsort

  fopen

  perror

  fclose

  fflush

  calloc

  malloc

  signal

  printf

  _isctype

  atoi

  exit

  __mb_cur_max

  _pctype

  strchr

  fprintf

  _controlfp

  _strdup

  _strnicmp

  kernel32

  PeekNamedPipe

  ReadFile

  WriteFile

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  GetExitCodeProcess

  TerminateProcess

  LeaveCriticalSection

  SetEvent

  ReleaseMutex

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  CreateMutexA

  GetFileType

  SetLastError

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  TlsAlloc

  TlsFree

  DuplicateHandle

  GetCurrentProcess

  SetHandleInformation

  CloseHandle

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  Sleep

  FormatMessageA

  GetLastError

  WaitForSingleObject

  CreateEventA

  SetStdHandle

  SetFilePointer

  CreateFileA

  CreateFileW

  GetOverlappedResult

  DeviceIoControl

  GetFileInformationByHandle

  LocalFree

  advapi32

  FreeSid

  AllocateAndInitializeSid

  wsock32

  getsockopt

  connect

  htons

  gethostbyname

  ntohl

  inet_ntoa

  setsockopt

  socket

  closesocket

  select

  ioctlsocket

  __WSAFDIsSet

  WSAStartup

  WSACleanup

  WSAGetLastError

  ws2_32

  WSARecv

  WSASend

  Sections

  .text

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• 1106-10-Windigo.exe

  .exe windows:1 windows x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 584B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 97KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• 1106-11-Njrat.exe

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 99KB - Virtual size: 99KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 1106-12-Gh0st.dll

  .dll windows:4 windows x86

  4847c8aea5b26a115e9f4b1fffee02d5

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrlenA

  lstrcpyA

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  GetTickCount

  WinExec

  ReadFile

  GetFileAttributesA

  LocalFree

  LocalSize

  LocalAlloc

  lstrcatA

  GetCurrentProcessId

  Process32Next

  TerminateProcess

  OpenProcess

  Process32First

  CopyFileA

  GetModuleFileNameA

  GetLastError

  WaitForSingleObject

  CreateProcessA

  GetCurrentDirectoryA

  FreeConsole

  GetModuleHandleA

  HeapAlloc

  GetProcessHeap

  VirtualProtect

  HeapFree

  InitializeCriticalSection

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  EnterCriticalSection

  SetEvent

  CreateEventA

  WritePrivateProfileStringA

  GetSystemDirectoryA

  GetPrivateProfileStringA

  lstrcmpiA

  GetFileSize

  CreateFileA

  SetFilePointer

  WriteFile

  CloseHandle

  Sleep

  InterlockedExchange

  VirtualAlloc

  GlobalMemoryStatusEx

  VirtualFree

  user32

  GetWindowThreadProcessId

  GetLastInputInfo

  wsprintfA

  ChangeDisplaySettingsA

  GetSystemMetrics

  advapi32

  RegQueryValueA

  RegSetValueExA

  RegCloseKey

  CloseServiceHandle

  ControlService

  QueryServiceStatus

  OpenServiceA

  OpenSCManagerA

  RegOpenKeyExA

  shell32

  SHGetSpecialFolderPathA

  ole32

  CoCreateInstance

  CoInitialize

  oleaut32

  VariantClear

  VariantInit

  mfc42

  ord825

  ord823

  msvcrt

  _strupr

  _strcmpi

  _stricmp

  _strnicmp

  _onexit

  ??1type_info@@UAE@XZ

  _beginthreadex

  _errno

  realloc

  strchr

  _adjust_fdiv

  __dllonexit

  _initterm

  ceil

  _ftol

  __CxxFrameHandler

  _CxxThrowException

  _except_handler3

  _local_unwind2

  rand

  strstr

  strncpy

  strrchr

  free

  malloc

  printf

  atoi

  strcspn

  wcstombs

  urlmon

  URLDownloadToFileA

  ws2_32

  connect

  inet_addr

  getsockname

  WSAStartup

  WSACleanup

  closesocket

  ntohs

  listen

  bind

  socket

  accept

  htons

  gethostbyname

  sendto

  recvfrom

  __WSAFDIsSet

  select

  send

  recv

  getpeername

  inet_ntoa

  iphlpapi

  GetIfTable

  GetAdaptersInfo

  Exports

  Exports

  DllUpdate

  Install

  MainThread

  ServiceMain

  Uninstall

  Sections

  .text

  Size: 34KB - Virtual size: 34KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ