231107-bz5yxsbb62_pw_infected.zip
- SHA256 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8
Overview
overview
10Static
static
10Samples 1/...cd.exe
windows7-x64
10Samples 1/...cd.exe
windows10-2004-x64
10Samples 1/...9f.exe
windows7-x64
10Samples 1/...9f.exe
windows10-2004-x64
7Samples 1/...95.exe
windows7-x64
10Samples 1/...95.exe
windows10-2004-x64
5Samples 1/...d2.exe
windows7-x64
10Samples 1/...d2.exe
windows10-2004-x64
10Samples 1/...6c.exe
windows7-x64
10Samples 1/...6c.exe
windows10-2004-x64
10Samples 1/...e8.exe
windows7-x64
10Samples 1/...e8.exe
windows10-2004-x64
10Samples 1/...4f.exe
windows7-x64
10Samples 1/...4f.exe
windows10-2004-x64
10Samples 1/...0a.exe
windows7-x64
7Samples 1/...0a.exe
windows10-2004-x64
7Samples 1/...a5.exe
windows7-x64
10Samples 1/...a5.exe
windows10-2004-x64
10Samples 1/...f4.exe
windows7-x64
10Samples 1/...f4.exe
windows10-2004-x64
10Samples 1/...c3.exe
windows7-x64
7Samples 1/...c3.exe
windows10-2004-x64
7Samples 1/...c7.exe
windows7-x64
10Samples 1/...c7.exe
windows10-2004-x64
10Samples 1/...26.exe
windows7-x64
10Samples 1/...26.exe
windows10-2004-x64
10Samples 1/...3a.exe
windows7-x64
1Samples 1/...3a.exe
windows10-2004-x64
1Samples 1/...91.exe
windows7-x64
10Samples 1/...91.exe
windows10-2004-x64
10Samples 2/...c4.exe
windows7-x64
10Samples 2/...c4.exe
windows10-2004-x64
10Static task
static1
Behavioral task
behavioral1
Sample
Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
Resource
win10v2004-20231215-en
raccoon
5ba094fed1175cc7d1abb03fa165c23c
http://79.137.207.53/
901785252112
privateloader
http://45.133.1.107/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
51.178.186.149
http://45.133.1.182/proxies.txt
45.133.1.60
https://vipsofts.xyz/files/mega.bmp
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.znsjis.top/
stealc
http://robertjohnson.top
/e9c345fc99a4e67e.php
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 5/050506129490bf4fc71dfedbf612532a669ea9b02f2d6b8311428601e915763e.exe | family_zgrat_v1 |
| static1/unpack002/Samples 6/bd4e2dd3ffc3977b2ca8f818c2e51c421a1f4772b4fe11a1aa8448dc50fddab2.exe | family_zgrat_v1 |
| static1/unpack002/Samples 6/c6befd3879040aeca88afd9b461177c9a3fc830f2020f2878696ddca0cea994e.exe | family_zgrat_v1 |
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 2/6c48e39183dda2dbdc8c92592c72feef6c6688c7b9e033ffe55581be572858e5.exe | family_raccoon_v2 |
| resource | yara_rule |
|---|---|
| static1/unpack004/out.upx | family_snakekeylogger |
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 4/9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe | family_socelars |
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 5/448140b0da950c59905b373bc96a0cefce7bce665c2727f416353d035f35583d.exe | upx |
| static1/unpack002/Samples 5/b6b789bb154eaee918cb7eec069e9a80ca1e7596d27a2a8495ddee5e800259ed.exe | upx |
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe | vmprotect |
| static1/unpack002/Samples 6/c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31.exe | vmprotect |
AutoIT scripts compiled to PE executables.
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe | autoit_exe |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack002/Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe |
| unpack002/Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe |
| unpack002/Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe |
| unpack002/Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe |
| unpack002/Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe |
| unpack002/Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe |
| unpack002/Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe |
| unpack002/Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe |
| unpack002/Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe |
| unpack002/Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe |
| unpack002/Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe |
| unpack002/Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe |
| unpack002/Samples 2/18f74890fef60f1e18d5b1d0b43f100c69b430445187d672bbedf46aff687d09.exe |
| unpack002/Samples 2/23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe |
| unpack002/Samples 2/5eff7e99184b9c8352125aaf8aa9d72e33049c52dc4eb7a69d509da3e7004cb2.exe |
| unpack002/Samples 2/5fca14e334abfa6aefad9d409d44e951f14231ae0a0f91b7af0ce392726be3ad.exe |
| unpack002/Samples 2/6b53de90d4c71ace801f6208d6a38c6e59a7e5d50de83544b9ef7f20c5296de2.exe |
| unpack002/Samples 2/6b8687e4a9ec832619d1e0477cc54e1709e25251c79571e697f6b43c4785fc29.exe |
| unpack002/Samples 2/6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d.exe |
| unpack002/Samples 2/6c48e39183dda2dbdc8c92592c72feef6c6688c7b9e033ffe55581be572858e5.exe |
| unpack002/Samples 2/8b70ca880f25f4e03bcac422fb2e6044369bf25d45d9b846db546728d66618a6.exe |
| unpack002/Samples 2/8ce95aee92cffc56420902fa657bc82a44574450ada63eb864d11e404a59a078.exe |
| unpack002/Samples 2/9cf8a802217928175088777f3f886dde3cba71c0a5c427ed169e24581e1c7a9b.exe |
| unpack002/Samples 2/9d0863c76aa5212eee67a9d8e8fa25547d9c99e9c47286027637fb50812a1110.exe |
| unpack002/Samples 3/081a3d200edb928e18cfac98d151d6af21b7fc1fb017f066a1ce428929c5da9b.exe |
| unpack002/Samples 3/093ea014b7458f9388f4c76b758c08b6a34e713736330f97fa49c99d71e2b371.exe |
| unpack002/Samples 3/095acff5fceaebcb8026d5dc628953ac226c8bf66aa1fbd929b2b569c9b937d2.exe |
| unpack002/Samples 3/179a03ea134385e1a80aaa05703d70008024d8771d836f62595c5b9187138723.exe |
| unpack002/Samples 3/209dc352ae660c94c7bd22fc9e97420bebfc56840e237e0d60cc42f734bfa386.exe |
| unpack002/Samples 3/31e7e054709f5b627f50b6b26f95c6e0536c7d03361c16c9677c70fe327a7181.exe |
| unpack002/Samples 3/56e26fd1b4bb65afbfccfcd02b594270030f800f0270068d00c3eb6c31553323.exe |
| unpack002/Samples 3/61a764045daabe15243e13405d418e3f60b6671ee7a1e325c6021204920f741c.exe |
| unpack002/Samples 3/74bafd56c1fb3cdebf0a63de4ffb6f16dc1d5cee38e11ab0d2bc2614538da65f.exe |
| unpack002/Samples 3/74f60be5e412a3af9701289707be3aa8e6e321283a0280c20cb437ac25d8d90e.exe |
| unpack002/Samples 3/77bdc94b3e90f3d4df5ca299e563e8425b6dd7ec50e0fe6fa697e87b1926f778.exe |
| unpack002/Samples 3/80db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168.exe |
| unpack002/Samples 3/91bbe97818559d7e7f7c35b60c152e6e2db4f42e3f9c6f80421bbdfb646e7068.exe |
| unpack002/Samples 3/94dbf6089ceccafd34ec1011941f18682361d71a9fbc54d1495dc0f9ec52169e.exe |
| unpack002/Samples 3/96b3a6f88bebb213230bd38f95804466296c238e0774861ceec6ad4424dcfb45.exe |
| unpack002/Samples 4/0532a82db5727b773fd280a5bc3ffa8b3be3be05bf5a9c125dbdf5f1e9fa63ce.exe |
| unpack002/Samples 4/0600f0c29e7513b060c4634804b2a2ad7e636c8372f7ee927b9e20e72e2bc807.exe |
| unpack002/Samples 4/25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe |
| unpack002/Samples 4/4051eb7216e002cc6d827d781527d7556f4eb0f47bf092fc1a58b41b365252ec.exe |
| unpack002/Samples 4/569cf42b940d1e5d5d4d675f6172542a8ac01596c7bc69a8b65dbe7f9ff7ed25.exe |
| unpack002/Samples 4/5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27.exe |
| unpack002/Samples 4/65350ee5de866f54845c13472cc7e0257b55715560ff9696ba2d4dc0494991e6.exe |
| unpack002/Samples 4/6577f5c5150e1dc818be87c2483db10b3af00effc2faf5c1acd174a8db760001.exe |
| unpack002/Samples 4/7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe |
| unpack002/Samples 4/81539fb95214aadc076c01161cdce901fc57b6cc8d82e27bae4915c512d9baad.exe |
| unpack002/Samples 4/87876acd533b5e473c1f27bf24ad26a9b6d0e6859186e00ac3efa334711b8f4a.exe |
| unpack002/Samples 4/8896b158ac271c269cfea637cd9402db48676eeef02b9d694d5c9f0eaeb3dbb0.exe |
| unpack002/Samples 4/9797a37016362ce602e53046e32a596c186a489976d38a7e2e9113344415c71a.exe |
| unpack002/Samples 4/995d009e2fa6b510a0251895e0e71d0709ebfdeac782eae91caa3b4ee30bd29b.exe |
| unpack002/Samples 5/1391748ce1bffd2513a95275adeb87105e963ef9452ea26798edd2dbd0126f2e.exe |
| unpack002/Samples 5/210353e2c687a7e1e94408ca27cf59fbbec44495d75a3e466ae528a1a33a53ea.exe |
| unpack002/Samples 5/448140b0da950c59905b373bc96a0cefce7bce665c2727f416353d035f35583d.exe |
| unpack002/Samples 5/618969df2d98c660836fc0c94f95d93c8c561f19f106c56eca3f5aa9930cbba8.exe |
| unpack002/Samples 5/640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8a.exe |
| unpack002/Samples 5/836486fba787ca151a90548a0ebe5d6bfc006c52133bf6a349a266c8ccf4f79b.exe |
| unpack002/Samples 5/a5e6cd875238850ec701202134a00d276574d623ac52383f4a96e26650ceac77.exe |
| unpack002/Samples 5/aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e.exe |
| unpack002/Samples 5/af74c04a2c7ab70c4b5e3c12ed698d0220be1324f341bd9d4e38d83a9f49adc6.exe |
| unpack002/Samples 5/b554bb8695c6674175bb3493f8f34c3d1d5b7f4cbb6da4c2e8431bd03acb4351.exe |
| unpack002/Samples 5/b6b789bb154eaee918cb7eec069e9a80ca1e7596d27a2a8495ddee5e800259ed.exe |
| unpack004/out.upx |
| unpack002/Samples 5/b89afe8f268ee82f378f123ec7dbb7de41e296d1ef26993f03f29b0f7b39884c.exe |
| unpack002/Samples 6/b592a44f67e06e47646ade57f8737600011b7317fd9c130b5835e9aaecf795c2.exe |
| unpack002/Samples 6/b842080ef401cb64de4b9c7d823ef60b0ed4f4bbd42431fbf26db940ece9f4f1.exe |
| unpack002/Samples 6/bb6758a9bce33333cbe3c141c2f7c94077d97cf25c83eb4282cc5ddcaeccc194.exe |
| unpack002/Samples 6/bb6f2d4376bb6c4e88d386ad55e243295b82704441e9c849ec13063febe5c112.exe |
| unpack002/Samples 6/bb9f86e51b9f942e3e196517f059b6ed77f27007228acb0a8aa640eab1f2c69f.exe |
| unpack002/Samples 6/bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7.exe |
| unpack002/Samples 6/c4ec2c4d73a45bba85debe9fe243708bb52afd29dc95d7fdefed02cd34c375ca.exe |
| unpack002/Samples 6/c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe |
| unpack002/Samples 6/ca181f57edb3d99fbdfd1a512a783d266d479c2fd38ffea14742771df7ba2c1a.exe |
| unpack002/Samples 6/cd22c1aabcafc40bf81d42b42e625e49eff9e0f928fa961e43573e1eb45ace18.exe |
| unpack002/Samples 7/d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122.exe |
| unpack002/Samples 7/d0d97c70ea6e26b3708dc101a310f056d690bbc17306c493ccba4a6f00fad541.exe |
| unpack002/Samples 7/d3d18f34a1494d87502f0ea05c56f6194e50610bc71f53653e15c98d25e57e62.exe |
| unpack002/Samples 7/da52dc0f002d544115f1d64dbc1d7ec9569be150d59cfe0bfd3f6bb5aed54dc5.exe |
| unpack002/Samples 7/dde59b015e0acd1910513cf1da07f3b17d6530816d663c102ed9ad6ab6d575a5.exe |
| unpack002/Samples 7/e396aa398fb1fa0f6c9db780211f758649e9a1f26bb5a2e7026b1cfec6ea9c0d.exe |
| unpack002/Samples 7/e5474bdcb0a87bd6c1c74d6a2fd6cff6c8ff913248b84e22c1ef5e82cb6f5cde.exe |
| unpack002/Samples 7/e63f3efc1462f054169998d9bdb7e5b2ca0cb78b393e978880458965472f76de.exe |
| unpack002/Samples 7/e99f3824ab81860db9ae48fac88f7530d0b5a8a450e16d85580c9cc57d064ea6.exe |
| unpack002/Samples 7/e9c49519d313aa6bb790838f020b991b862bead9aaf2a3a665004a8d284973ea.exe |
| unpack002/Samples 7/e9c61a893b569c4af984f03b39ae1e0850dff66cc9ce743156a0612021ba2cf7.exe |
| unpack002/Samples 7/ea8e29d73139cc53e5ecf03f229c27ecec1f4f54a34a3781aab5f0e59596f2ee.exe |
| unpack002/Samples 8/ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe |
| unpack002/Samples 8/ebc207c310f6738099c6e4522b022b4c18fcbb3a0c385b1a8d71fc411285ca48.exe |
| unpack002/Samples 8/ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe |
| unpack002/Samples 8/efb621959cf78ebda987c42334d70311e95e3359a6c149a3a134493d988e3324.exe |
| unpack002/Samples 8/f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe |
| unpack002/Samples 8/f2866d013e000884415fa13490799a626792a29967bf20e7bbbf23a72c0fd7f7.exe |
| unpack002/Samples 8/f6aedcfebf23aa3dae3c39862ad14c350479335c30e45f231e2108e4b5395488.exe |
| unpack002/Samples 8/f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938d.exe |
| unpack002/Samples 8/fc490a08797ff3a4ad9b791fcecc88f90e1140759220023e97489a08ff5e0cbf.exe |
| unpack002/Samples 8/fd4d1fc83330c5cf818e557ef882ca147ba98fee4128fe00bda07c6c2f79050a.exe |
| unpack002/Samples 8/fe622c4801737dede008dfecf2bcf48316f0adebbc080d27a2664ee8b606415c.exe |
| resource | yara_rule |
|---|---|
| static1/unpack002/Samples 2/15e3a34b2bd7ad520d87fe902eee65f35049cc5bc3579bbb5182dfb91e3fd289.exe | nsis_installer_1 |
| static1/unpack002/Samples 2/15e3a34b2bd7ad520d87fe902eee65f35049cc5bc3579bbb5182dfb91e3fd289.exe | nsis_installer_2 |
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Sep 26, 2023
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=149, productName=VS2008 build 21022, version=21022,
count=126, id=131, productName=VS2008 build 21022, version=21022,
count=40, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=143, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Oct 26, 2023
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Oct 31, 2022
SERIALNUMBER=140 322 916,CN=SoftPerfect Pty. Ltd.,O=SoftPerfect Pty. Ltd.,L=Brisbane,ST=Queensland,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=12, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=2, id=261, version=23013,
count=56, id=261, version=24123,
count=4, id=244, version=40116,
count=17, id=239, version=40116,
count=382, id=1, productName=Unmarked objects,
count=74, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Unsigned PE
Checks for missing Authenticode signature.
Nov 6, 2023
NSIS installer
Jan 4, 2024
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=45, id=171, productName=VS2010 build 30319, version=30319,
count=23, id=158, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=119, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=201, version=65501,
count=1, id=204, version=65501,
count=5, id=209, version=65501,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=77, id=109, productName=VS2005 build 50727, version=50727,
count=31, id=110, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=96, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=58, productName=Unmarked objects (old),
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Raccoon Stealer V2 payload
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=260, version=27412,
count=1, id=262, version=27412,
count=9, id=257, version=27412,
count=10, id=1, productName=Unmarked objects,
count=19, id=265, version=30136,
count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=171, productName=VS2010 build 30319, version=30319,
count=24, id=158, productName=VS2010 build 30319, version=30319,
count=112, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=155, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Nov 5, 2023
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=27412,
count=146, id=261, version=27412,
count=18, id=260, version=27412,
count=17, id=260, version=28427,
count=22, id=259, version=28427,
count=44, id=261, version=28427,
count=3, id=257, version=27412,
count=93, id=1, productName=Unmarked objects,
count=3, id=265, version=28614,
count=1, id=255, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.5.5 build 28614, version=28614,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=40, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=139, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
Dec 1, 2009
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=77, id=109, productName=VS2005 build 50727, version=50727,
count=31, id=110, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=96, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=58, productName=Unmarked objects (old),
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=26, id=158, productName=VS2010 build 30319, version=30319,
count=119, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=137, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Socelars payload
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=259, version=27412,
count=185, id=261, version=27412,
count=81, id=261, version=29804,
count=18, id=260, version=29804,
count=26, id=259, version=29804,
count=1, id=264, version=29913,
count=24, id=260, version=27412,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=249, id=1, productName=Unmarked objects,
count=7, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Detect ZGRat V1
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=158, productName=VS2010 build 30319, version=30319,
count=40, id=171, productName=VS2010 build 30319, version=30319,
count=112, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=145, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Dec 1, 2009
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Oct 30, 2023
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=29, id=1, productName=Unmarked objects,
count=2, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=17, id=260, version=32533,
count=20, id=259, version=32533,
count=42, id=261, version=32533,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=9, id=257, version=30795,
count=105, id=1, productName=Unmarked objects,
count=1, id=265, version=32824,
count=1, id=255, version=32824,
count=1, id=258, version=32824,
Snake Keylogger payload
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=17, id=260, version=32533,
count=20, id=259, version=32533,
count=42, id=261, version=32533,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=9, id=257, version=30795,
count=105, id=1, productName=Unmarked objects,
count=1, id=265, version=32824,
count=1, id=255, version=32824,
count=1, id=258, version=32824,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=37, id=171, productName=VS2010 build 30319, version=30319,
count=95, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=148, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Jan 4, 2024
count=4, id=259, version=30795,
count=22, id=261, version=30795,
count=68, id=260, version=30795,
count=25, id=257, version=30795,
count=354, id=1, productName=Unmarked objects,
count=34, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=29395,
count=171, id=261, version=29395,
count=22, id=260, version=29395,
count=17, id=260, version=31823,
count=21, id=259, version=31823,
count=5, id=257, version=29395,
count=132, id=1, productName=Unmarked objects,
count=84, id=261, version=31823,
count=1, id=261, version=31937,
count=1, id=258, version=31937,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=158, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=31104,
count=7, id=1, productName=Unmarked objects,
count=13, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Detect ZGRat V1
Oct 31, 2023
Oct 12, 2023
CN=Etwok Inc,O=Etwok Inc,ST=Delaware,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Detect ZGRat V1
Oct 31, 2023
Oct 26, 2023
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=221, productName=VS2013 build 21005, version=21005,
count=3, id=223, productName=VS2013 build 21005, version=21005,
count=21, id=224, productName=VS2013 build 21005, version=21005,
count=15, id=203, version=65501,
count=103, id=1, productName=Unmarked objects,
count=17, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=158, productName=VS2010 build 30319, version=30319,
count=40, id=171, productName=VS2010 build 30319, version=30319,
count=111, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=150, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24237,
count=19, id=260, version=24237,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=261, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=171, productName=VS2010 build 30319, version=30319,
count=24, id=158, productName=VS2010 build 30319, version=30319,
count=112, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=157, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=132, productName=VS2008 build 21022, version=21022,
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=71, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=82, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=35, id=149, productName=VS2008 build 21022, version=21022,
count=126, id=131, productName=VS2008 build 21022, version=21022,
count=40, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=143, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Nov 4, 2023
Jul 26, 2023
CN=Sefa Eyeoglu,O=Sefa Eyeoglu,ST=Nordrhein-Westfalen,C=DE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=134, id=170, productName=VS2010 build 30319, version=30319,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=136, id=1, productName=Unmarked objects,
count=58, id=171, productName=VS2010 build 30319, version=30319,
count=21, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=139, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 19, 2023
CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=43, id=241, version=40116,
count=194, id=243, version=40116,
count=40, id=242, version=40116,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=261, version=23013,
count=6, id=199, version=41118,
count=22, id=259, version=24123,
count=72, id=261, version=24123,
count=33, id=260, version=24123,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=264, version=24215,
count=812, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=862, id=1, productName=Unmarked objects,
count=130, id=260, productName=VS2015 UPD3 build 24213, version=24213,
count=683, id=261, productName=VS2015 UPD3 build 24213, version=24213,
count=309, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=27412,
count=154, id=261, version=27412,
count=17, id=260, version=28427,
count=23, id=259, version=28427,
count=42, id=261, version=28427,
count=21, id=260, version=27412,
count=9, id=257, version=27412,
count=125, id=1, productName=Unmarked objects,
count=5, id=265, version=28614,
count=1, id=255, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=258, productName=VS2019 v16.5.5 build 28614, version=28614,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=133, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=67, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=39, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=139, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=135, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=59, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=205, version=65501,
count=47, id=207, version=65501,
count=387, id=1, productName=Unmarked objects,
count=31, id=203, version=65501,
count=25, id=206, version=65501,
count=95, id=211, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
Unsigned PE
Checks for missing Authenticode signature.
count=45, id=171, productName=VS2010 build 30319, version=30319,
count=23, id=158, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=119, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,