aurora | REpractice[.]7z

resource	yara_rule
static1/unpack001/4Ben/aurora/packed_e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416	themida
static1/unpack001/4Ben/aurora/unpacked_b158f9fb6f2206c705626c87446fa6427848c0d0eba9b6b14e256f165bad48ff	themida

resource
unpack001/4Ben/aurora/packed_e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416
unpack001/4Ben/aurora/unpacked_b158f9fb6f2206c705626c87446fa6427848c0d0eba9b6b14e256f165bad48ff
unpack001/4Ben/challenge/552626fe924de9c9f4508e74d40143c2

REpractice.7z

SHA256 3a53917c3ecfb8a1ff4a1822a3684c6f6fcdf66c210db91ccc07a91a5f09a923
MD5 b4c5864d7c43d5f4c037bee9ad6f0b42
SHA1 3a88b66c706565c2008aa94eefd68708ed830e08
SHA512 30d6113469e98693bbdc6cca58284d97f501db94c8e8ed3e4733e3f7e89783ef430af089723741e5cbda664b6173a6598fbc47b4fd5bab12d9cbb5c6e1fea3ec
SSDEEP 98304:21PdItoQYlism8ddw3VJK97BCIH+fXfHsOk3EZUo4KuH1uN1ZliGQpPhDodzryPf:21PW+QYvHddwFJKgI2fsX37KuH1LD7DT
MD5 SHA1 SHA512 SSDEEP

Password

infected

4Ben/aurora/go_func.py

SHA256 892f6fbc588e3642fd80de85796ae93ca0af0a91cf8d719d79723bdead7056ed
MD5 d133b964769c0859957be960765d9701
SHA1 be4751e7b6f5a46d36b6b8ec402c37f2ba81052e
SHA512 0faf02d878fe0fb5cc4f00f54387f46dea81724c66c99d37c3277832e762d0829b0ce2d866ce20253ae22b1919e3f7ba5258a2f0b3419cbd8be4ded4173ab98a
SSDEEP 96:ALAKm4uPC2jw9zaehrQGJCzlfhrQGJ+QJahrQGDQ5uqEC:FH4uP3jCukrApprU9rHQ5uqEC
MD5 SHA1 SHA512 SSDEEP

4Ben/aurora/packed_e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416

SHA256 e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416
MD5 c28a180de1f80c8c98d0904e64142bef
SHA1 b1c100d5a99ae34ccb3654c7b7f8573376a44fd9
SHA512 b22e434f563436ca3842d75a7eeba03f681b14461789661aee8c13de169548c77d4ba0e9e6461fca7a9fe67ad8d046dd0547a3f7af610804c01ad4edbdfa3f95
SSDEEP 98304:vEsSYksC43VgdB6D5DHv2RMJLZuEawxmpp:sDYkV2w6R2kLZu+yp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

6

Entry point

8152000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

672KB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

537KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

77KB

Virtual Size

414KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

44KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

4Ben/aurora/unpacked_b158f9fb6f2206c705626c87446fa6427848c0d0eba9b6b14e256f165bad48ff

SHA256 b158f9fb6f2206c705626c87446fa6427848c0d0eba9b6b14e256f165bad48ff
MD5 553ae77683ff687d366ab84ed864c3de
SHA1 1a230416f7a4f3bc1228c12e073a6e7051e081ad
SHA512 73f89f61d342dbdbed05a1861e10f854785a7c0f710002bfe0196d4a8355d8d15ac8a366be8311b69e0642bc7b907d3627764ec3cb1de28df342c395eb79d0b0
SSDEEP 98304:1RbzCSsJ1jKiMSfJUmfN3+BuYdArGFEv2RMJLZuEawxmp:rChy43+PeGfkLZu+y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

6

Entry point

8152000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

4Ben/challenge/552626fe924de9c9f4508e74d40143c2

IMPHASH 32784d1723a59c861ce413c9c9c322a3
SHA256 02f7c3fc88d9a59a06fd63d9ed91ab08799a7a8e4bda5e03bfcc805eb6a3b817
MD5 552626fe924de9c9f4508e74d40143c2
SHA1 b232497812c0bd0bc710920426386b659e4de29f
SHA512 4c44f06af7f1659cb0a7244fa1b7898b4e9666ac06de58c8c1387ad81d1f1a9b56714b3c17b3e9e5902fdff77183c89e21961314ef9290542b9e841097ac0700
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/app.html

SHA256 d301a7d23e62ae2747777cde00260dc5ab633361daf80d338a24358ff2133f50
MD5 08785f3794a7ae9aab6b3fa669646794
SHA1 be015854a82c1c8119861ccb5cabc35249a4f2a7
SHA512 833f24db5ca6db903179a53d2afac77719acf8224f658e77c497244336f2a72706b719585b9af7be06cdc574d993b604f7eccb89eb8cbd6b0610a971aee271ec
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/config.js

SHA256 da06b313e161c6097da5aafe74130b1df08ba25fdd7148926120a7eada87fb4c
MD5 c1a22718368fb05b268f792a5a889bd1
SHA1 a5da82fe3cc0f78a25e6d2fa025adcdaf2baba18
SHA512 7f71f416c0d2237a7ce74bc326353acbcdeec1f0abbe33a899b35cb2a16cdc5909ba16ce4f69fdcac8202bc2b1b607a26b69be1d44faded3fea859e4d0bf90c5
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/ico.png

SHA256 7d1878c4a74f2b7c6deb2efb39aa4c1cef86b8792efd2022644437cad6c48af3
MD5 40de419c81de274c26c63e0f23d91a3f
SHA1 3fda2c10bf0d84aa327e107730b3596fcd13d4fd
SHA512 a6c0a9328941b31ab92d7de6bfedb7012a66e10f1726a3648d8314a49fd37dfbed06c199db04ddf6a0da6f9d42d9a78378ea67e7399fd847d48e4427bbb0ff99
MD5 SHA1 SHA512

Password

infected

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/manifest.json

SHA256 d361378fc594ec357a16708221c9ea69cbf630afe32ac940e3e47342e3adc787
MD5 4d6b2765978de96ca9c78bd8a1b488ee
SHA1 218edd90d220321adeaf304ecf659f5f309ab46c
SHA512 d8235a8ecf61fac5c09d669437f6383c77ef329cbefd3c64f521cd57a091e5b888c5c8f0e8d58c5517a495425bc6532c5812c2acbb514b9472db3689a88c55f5
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/modules/content-scripts-register-polyfill.4.0.0.js

SHA256 9131098ee7ca044ab431727bb04caeb3e5a3c4cc47441bd255f9e30a9c42fb5f
MD5 5bf61a91e003afb1e169e3e3be336cac
SHA1 63a94bdb78f57952db8e2a8f9719b4467e664fcd
SHA512 c439a455410a30e9047631e6cf3214d9518b00f0cf10d219a623fde3cdeb8f3a847403f23eb59e93d3d86ba8b233db4ac6997217bca6bdf6644a682bf9e39f97
SSDEEP 192:23Ho04WC4GQCZncQZoifBgUPB4ikQTRaeAae5cPWt6KwyIab4VUeWmVO:23o04WlpQoifao+iFHKQa0VTWT
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/rules.json

SHA256 09aa1c09bd6316b4d8cc83ba1dbfa915c5a0802cab8cd414a52b766a3e1d9ffe
MD5 6c1f6ab3492a615404a70161303de746
SHA1 d699813f9847cf859b0c2de40b94e32fc32c9976
SHA512 9e8b33d9144d6ee3c53cd0c756d649ee21ecbebfc2b880d9dd29f2c654632042c51edd838e2b3440acce2dd761fe6d4b82fedac9a62addb724b9145e256cd40f
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/background.js

SHA256 f781ec1bf0f82152c773279c8bd85156df7475f8f5cd14e803839480a72f6dba
MD5 88aa703092625574ce0adf19c28070d0
SHA1 d9b9d6b9a42df05e4a1294757feca77380c54aa4
SHA512 f6a9f2553c6ba803e9827762c1dad32d05fd2503e9227d057f8c06a3bf02f2b6101aaa727b10614dfa76157b0c164841c231ca40130f70f6375432f9c1b1b9c6
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/content/main.js

SHA256 b01729a6ce1a0afacb40fd2827e992f9c5a16d83c4338cba3e40a67c1b4a99e6
MD5 badb5f9b82ff98f4b0f78b54e490f261
SHA1 91d08d1c76b5989da99a140bf959e7f833febff0
SHA512 e29bb033c4163be35e6a81afcc94313494472158f94d6528a44826f6965873ed04f74d00755696300ccc92b93c30034186f05f6ba31db2cb5b513a791c1e5b9d
SSDEEP 1536:WNjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkm4M5gPtcNRQZ:WcqmCU3zhINzfmR4lb3e34UQ47GKI
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/cmds.js

SHA256 a0370737674a1a9cc1d0638aff7ec504df6700b0187ca155e821f29be907efb5
MD5 22974d5c1936a92a53f85d0b6ce2a4d1
SHA1 c4737ba825cca0288ee3ec6adb2c3b93d9e9940f
SHA512 ff6fa97e4e9704881f033592f654e48742430eb677a7e2d39a8eb04127d2257d8a7aa8b98d324b3971f3a2fc0d764f8df8c19ff160d344ab53993e68f7f94d1e
SSDEEP 48:cFqqAinysXxc3wESCbpJdLvM2xRaRJIT2FJ3FcbuMXPFAUc/9ZvQcWbTMKtqGHqi:FqAaxspJhvjyrcjPFAUcVZoF9bHqr+
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/cmds.js_deobfuscated

SHA256 119ffbf015e8c963341232a27b281f8a125baa4dacf1d5eb936d20380b923abd
MD5 e31ac8a5b11b8df81d68d809afa34879
SHA1 e1f064812f8f4e2cb6dc6bc71cfd8c421994c30b
SHA512 0905bd5e90c871cc5215ddb24fa534310b2447aa42aa854d76aa9eccb15795a0e1f04ec4357cdeb4f850093b99dc11d8c03440aa6f6e3a33c72c223bf24cd93b
SSDEEP 96:FqAaxspJh96C8YTZkU6LDZIScSGFAUcVZoF9bHqr+:baKl9H8UZkUkD2SXGFXKSZO+
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/csp.js

SHA256 b3115ba66cb77fc44f66cd4c87f44807016c2eb67ff49e2696401fbd3e0ce21c
MD5 72dc01108b67251b0fae2bbc6dcd087b
SHA1 d9b15c6f449b7d5004ac0a2103f20885e28bfcf5
SHA512 1b22d3458bfe4f6774c0c3d1dc955f20789a10287d6e5a2482cb2a08e65f86822048ebe9996c7c0f8bd48ddba2ff236c3a511b92764787ec032438ee785405c3
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/domain.js

SHA256 a66357899118f0f10991aad40e174ed7e607761f657240d28e616b1e2b074e8b
MD5 add1cd30e44fae8cd7068e138a188f42
SHA1 1239020865c51f81a00c2d3ee0751c97465cb082
SHA512 56bbe927351d022633376e504cadb27c5b5c01e4fa4f5d3ab22c23c021ddca27a76d1be0e22973e4075ba3fe7d24a6e0976946db73d9c57c265954867e79f629
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/exchangeSettings.js

SHA256 46916c8f240ed734ca2b82851a582d12066bb1f184a53c17cd69f64141d38c40
MD5 403f84bd293655e8c1073de320329b17
SHA1 8edbfcab3e7c3b52ff1a82cdbb37356edddab133
SHA512 deee5e2647035a793c004658eb82f1c0f9b6ce70aceeaff742c1b7807d62d8e20af0d9450d76d9ae2e6ab115700730d66a9f361c0410931c3cdf7d829b2e693a
SSDEEP 96:i8acTR0uaoRPeqCx2I8C9R0qfgekTuqyTi+F0riL/qiwZYAtWMtNNH2Aw6qKeUFP:DOBoPeczqR0qfjkTnecZVtyAw6qrlgf
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/exts.js

SHA256 411b3713e348601ef0e2efdf0d84417cd84612e796176b6fb21db5cf0ed95d48
MD5 deb81aedf6cb72c70a0d20fda6266da6
SHA1 d45daf7abb23b3a04b63d85ded739f1dd108d37e
SHA512 43f9ed77bb613dd89f62ff117c44e53798dc2a86f19aaea2b3b8dd39c3a41d56a12cd6944168d17203df9da628060d710b54343c1d8e231ae571c614f31f98eb
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/historytab.js

SHA256 75b823ab06e1eb62de6c1a89b796c9f7a9fb50ea54ebd1b502d79ffadba242f8
MD5 719459e219f9e9b424b027bea560f134
SHA1 d959c32002d854d9fe52fbb4368edf5ac386e580
SHA512 5afca961c227dd60ad5b3dab0512ef34f1d5f5929c0a766c239d099e189245e3b2fd8d4c246a4b9cd6aa329060de72f7204ba5e39bb6d95bcdcb0486388a9dbd
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/inj.js

SHA256 bf0bcea5ee2ad24c8365999d33b708c499659feb890c6fe6cba979b3376506fa
MD5 66610909fb024baa010d05535755c87a
SHA1 42d257f5b31096201cf611c685290ac56328143b
SHA512 7df84955a9fe9558b94b86a96c391a2c322e7c3283bbabfa0064c5343587dd50e191517bf610347be030d3112582ac1eab47c32da940e60f59b0a5678c79cc91
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/machine.js

SHA256 7306e12ff43a9b6530ef39e45e39d2c30a9216777ea3788b97484552816e2648
MD5 f10b593e5402545c6e76cb88fc9c3553
SHA1 ebc7a6adcf16d33eb3e31c318213b1eb7be7cd91
SHA512 65c2d567c18cf351e5ba6d96a3b1d5367277ea5b5c92980d38fc00f8f9439109cef1f478a46e8421c2fd81b24bc112835537e447ea37ba5234e5b7b43d667f8f
SSDEEP 96:/ZoZ6Z1/UPkcnw6nsnZMqQ4X1qGhDWLMs6WiVvh2FyIdY+:BoQZdWbU1qGhDWL76Wo52cIh
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/notif.js

SHA256 31064a301bfaf3acd9df3f14a28ec51c942ebd28781355fc30160639650c7e3d
MD5 8b67f5e82a6cc38faa59c931f639c463
SHA1 850b960922a0abe3a03ee32552a3f67d28d36d97
SHA512 41c01950971e499bead863834c87455b956178757899a0e889d919592abab33ae8cb12d1068d66bcc6c2c9c51bb1b1ebb53bd00ccd59a25d0a8688c2cf41fd79
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/proxing.js

SHA256 31885c130017f6e6ed677519105152bec774cdf0be1ff7fc210517ed1163b2bb
MD5 fde7a47048b9e40b36f61ece2afa5969
SHA1 999868405967a6a038b6148553388537f56ff62b
SHA512 36ff82fb159bd8d336ee9b89882f52c8b1c3027d0d107ecc31a61ee4b542d4d0b48d545f055201514354e6d6e1a2152dcf53c211fb85ce1f1c963bd83c3b0644
SSDEEP 192:hja4d51/yEFHGXnIqByG0PtKIBk0cyFxR1+d1ObqlR3vOvs6IQgxwxzm:hja4d51tFHWnIqByHPtK6tcWqHlR3vOC
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/screen.js

SHA256 a3e558ea393fd12b836a64e2c2df803abf60a009cae0708145f3ea57cc47598e
MD5 4e6b0ee498ce1357467f184666e92618
SHA1 dd75270f2c1fb3c2094cd4461b19ad90149cdb30
SHA512 38e2511bf5d8002a3be8f70ddfcd452e29e22efb36855b2d80a1d9993df2da1e6f335e9274a604ffe67ae7fb06deceb707b07ca16b02b21c321d6cb97a80e133
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/scrrule.js

SHA256 9fd3b369152666564f96f146eac17f38381bef1267c1a5c8dbb0870a36f729fa
MD5 f7ddad865a28c850edd4606ec33d0500
SHA1 10bedd103318e0fe29aa53a7682de33f97df311c
SHA512 cd687ee090c4db18c1a03fc82a5a0661235d74b94b32cc14fa79095194feaa06b7f8e60bc5f5e46d6fad38a0903295fcdcb82c7e0b3748ce0831143f0307ee0a
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/set.js

SHA256 3a0c09ed01f10298739a6aa04c0df1ccfddb4226ef00d8be985cf144844366d7
MD5 4eac8a191705d927aa1ee7d4f4dd8220
SHA1 4751feca61739cb6ca2884cc06f41af664010894
SHA512 8d1d8fcae3ad2ac347a09e847a267974fe3951244ef371c5464405ee4ce0d36cf8cf27c93495685e2d5d9ec54297cdf0122d0ccf17ed4fb1bf6671de18b1786b
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/utils.js

SHA256 95c6a667ea279e59d292ad7837eda4146922907bc23411fdde22b15e9a464196
MD5 f14778fcffaedfc65cd6b9a12afbcd71
SHA1 b8ea4c9e520b34343104fb7d207e8b4e7e06accd
SHA512 b31ff3201609bd86c0ee6bc4d949199d2a01e46a988fdbfd4e56d856ea92ebc9684a5c3d680ceb284b619ce132a48d685ba2d2cc8e00330ba196ad972575de2b
MD5 SHA1 SHA512

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/letters/gmail.js

SHA256 56bc0fc3788658d00141b8f2b9bf89732be7a09b45124924b16b5c6ee6795406
MD5 49c851c025506d0a570d75bc00c7605a
SHA1 ce1c63f469edc0ef006329e1af1df9f8bc42c094
SHA512 b09227af06570fa394bd2eddf86aaed5bd5c7e16b99ff24455ead4286af65e362bd9cd44780119270c9134c41a96dc8ca89205cbeddc5c0d3e69f6be00a4e8b1
SSDEEP 3072:DIh8GgP3hujzwbhd3XvSiDQ47GKmHz0gjGsUU86bbDUcQr6:Dy8G6RujcHX6MQ47GK+7j0R6bbDUcr
MD5 SHA1 SHA512 SSDEEP

4Ben/rilide/Rilide_deobfuscate.py

SHA256 5c55b873e87646569219206eabd784ba956eb3461301b41ca46df0a46a3ba23c
MD5 501a1c805dd10574cff25a7c3b365ab8
SHA1 009634cb602a65e45e9c84fb12519336d7019172
SHA512 3ad606add4b35718ca5bb9facb4cbbd5d5217c4c9c4cc9b15e10ea59e03595a22fceb1dc06b9eb1d01210cca0f6f0d6461bd0286916902b63e9ff4f15877194c
MD5 SHA1 SHA512

REpractice.7z

4Ben/aurora/go_func.py

4Ben/aurora/packed_e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416

generic

4Ben/aurora/unpacked_b158f9fb6f2206c705626c87446fa6427848c0d0eba9b6b14e256f165bad48ff

generic

4Ben/challenge/552626fe924de9c9f4508e74d40143c2

kernel32

wsock32

generic

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/app.html

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/config.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/ico.png

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/manifest.json

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/modules/content-scripts-register-polyfill.4.0.0.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/rules.json

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/background.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/content/main.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/cmds.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/cmds.js_deobfuscated

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/csp.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/domain.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/exchangeSettings.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/exts.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/historytab.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/inj.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/machine.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/notif.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/proxing.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/screen.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/scrrule.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/set.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/utils.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/letters/gmail.js

4Ben/rilide/Rilide_deobfuscate.py

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

REpractice.7z

4Ben/aurora/go_func.py

4Ben/aurora/packed_e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416

generic

4Ben/aurora/unpacked_b158f9fb6f2206c705626c87446fa6427848c0d0eba9b6b14e256f165bad48ff

generic

4Ben/challenge/552626fe924de9c9f4508e74d40143c2

kernel32

wsock32

generic

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/app.html

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/config.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/ico.png

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/manifest.json

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/modules/content-scripts-register-polyfill.4.0.0.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/rules.json

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/background.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/content/main.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/cmds.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/cmds.js_deobfuscated

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/csp.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/domain.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/exchangeSettings.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/exts.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/historytab.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/inj.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/machine.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/notif.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/proxing.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/screen.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/scrrule.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/set.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/functions/utils.js

4Ben/rilide/0fd8a4468d7d5370d1f67b01badb2e7e1aacb3e6cf1689cab4f678cc7868f520/src/letters/gmail.js

4Ben/rilide/Rilide_deobfuscate.py