General

  • Target

    Photo_Y.zip

  • Size

    40.0MB

  • MD5

    1da7a02ba4d6be03f8e81dda32a2cb00

  • SHA1

    68104a88fa087d743ba352dbc014573f348b5b92

  • SHA256

    b04f0b4f5ac6225f239710dc0cc6e921300770bc9d6ec54ad64131be12d72b33

  • SHA512

    61bc9ba6ae0ffd7842dcdbc87a8f3d4246911c51ac5728609486515f418fa3f17c545fa4a8defb38f0adcc0c78dbb15f5b6a24e07f045a1078d6d58c7ed22f85

  • SSDEEP

    786432:t8bLIZYVsDHH2lJcLzoQJ8hEJKIwRNThxLN7tUG6DYIxjeR6:WLIZYVsDHWlMolhEo/XdxLFtUG6DYIxR

Score
10/10

Malware Config

Signatures

  • Detects Empyrean stealer 1 IoCs
  • Empyrean family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • Photo_Y.zip
    .zip
  • Photo Y/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Photo Y/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Photo Y/Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Photo Y/Monaco/Monaco.html
    .js
  • Photo Y/Monaco/base.txt
  • Photo Y/Monaco/classfunc.txt
  • Photo Y/Monaco/globalf.txt
  • Photo Y/Monaco/globalns.txt
  • Photo Y/Monaco/globalv.txt
  • Photo Y/Monaco/vs/base/worker/workerMain.js
    .js
  • Photo Y/Monaco/vs/basic-languages/bat/bat.js
  • Photo Y/Monaco/vs/basic-languages/coffee/coffee.js
  • Photo Y/Monaco/vs/basic-languages/cpp/cpp.js
  • Photo Y/Monaco/vs/basic-languages/csharp/csharp.js
  • Photo Y/Monaco/vs/basic-languages/csp/csp.js
  • Photo Y/Monaco/vs/basic-languages/css/css.js
  • Photo Y/Monaco/vs/basic-languages/dockerfile/dockerfile.js
  • Photo Y/Monaco/vs/basic-languages/fsharp/fsharp.js
  • Photo Y/Monaco/vs/basic-languages/go/go.js
  • Photo Y/Monaco/vs/basic-languages/handlebars/handlebars.js
    .js
  • Photo Y/Monaco/vs/basic-languages/html/html.js
    .js
  • Photo Y/Monaco/vs/basic-languages/ini/ini.js
  • Photo Y/Monaco/vs/basic-languages/java/java.js
  • Photo Y/Monaco/vs/basic-languages/less/less.js
  • Photo Y/Monaco/vs/basic-languages/lua/lua.js
  • Photo Y/Monaco/vs/basic-languages/markdown/markdown.js
    .js
  • Photo Y/Monaco/vs/basic-languages/msdax/msdax.js
  • Photo Y/Monaco/vs/basic-languages/mysql/mysql.js
  • Photo Y/Monaco/vs/basic-languages/objective-c/objective-c.js
  • Photo Y/Monaco/vs/basic-languages/pgsql/pgsql.js
  • Photo Y/Monaco/vs/basic-languages/php/php.js
  • Photo Y/Monaco/vs/basic-languages/postiats/postiats.js
  • Photo Y/Monaco/vs/basic-languages/powershell/powershell.js
  • Photo Y/Monaco/vs/basic-languages/pug/pug.js
  • Photo Y/Monaco/vs/basic-languages/python/python.js
  • Photo Y/Monaco/vs/basic-languages/r/r.js
  • Photo Y/Monaco/vs/basic-languages/razor/razor.js
    .js
  • Photo Y/Monaco/vs/basic-languages/redis/redis.js
  • Photo Y/Monaco/vs/basic-languages/redshift/redshift.js
  • Photo Y/Monaco/vs/basic-languages/ruby/ruby.js
  • Photo Y/Monaco/vs/basic-languages/rust/rust.js
  • Photo Y/Monaco/vs/basic-languages/sb/sb.js
  • Photo Y/Monaco/vs/basic-languages/scss/scss.js
  • Photo Y/Monaco/vs/basic-languages/solidity/solidity.js
  • Photo Y/Monaco/vs/basic-languages/sql/sql.js
  • Photo Y/Monaco/vs/basic-languages/st/st.js
  • Photo Y/Monaco/vs/basic-languages/swift/swift.js
  • Photo Y/Monaco/vs/basic-languages/vb/vb.js
  • Photo Y/Monaco/vs/basic-languages/xml/xml.js
  • Photo Y/Monaco/vs/basic-languages/yaml/yaml.js
  • Photo Y/Monaco/vs/editor/contrib/suggest/media/String_16x.svg
  • Photo Y/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
  • Photo Y/Monaco/vs/editor/editor.main.nls.de.js
  • Photo Y/Monaco/vs/editor/editor.main.nls.es.js
  • Photo Y/Monaco/vs/editor/editor.main.nls.fr.js
  • Photo Y/Monaco/vs/editor/editor.main.nls.it.js
  • Photo Y/Monaco/vs/editor/editor.main.nls.ja.js
  • Photo Y/Monaco/vs/editor/editor.main.nls.js
  • Photo Y/Monaco/vs/editor/editor.main.nls.ko.js
  • Photo Y/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
  • Photo Y/Monaco/vs/language/css/cssMode.js
    .js
  • Photo Y/Monaco/vs/language/css/cssWorker.js
    .js
  • Photo Y/Monaco/vs/language/html/htmlMode.js
    .js
  • Photo Y/Monaco/vs/language/html/htmlWorker.js
    .js
  • Photo Y/Monaco/vs/language/json/jsonMode.js
    .js
  • Photo Y/Monaco/vs/language/json/jsonWorker.js
    .js
  • Photo Y/Monaco/vs/language/typescript/lib/typescriptServices.js
    .js
  • Photo Y/Monaco/vs/language/typescript/tsMode.js
    .js
  • Photo Y/Monaco/vs/language/typescript/tsWorker.js
    .js
  • Photo Y/Monaco/vs/loader.js
    .js
  • Photo Y/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Photo Y/Photo Y API.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Photo Y/Photo Y WPF.exe.config
  • Photo Y/Photo Y.exe.config
  • Photo Y/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    02e88351c3784f615719503b75919424


    Headers

    Imports

    Exports

    Sections

  • Photo Y/WRDAPICONF.json
  • Photo Y/WeAreDevs_API.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Photo Y/bin/RobloxPlayerLauncher.exe
    .exe windows:5 windows x86 arch:x86

    c07a4ba227db3782e12f36219d41b123


    Code Sign

    Headers

    Imports

    Sections

  • Photo Y/bin/exploit-main.dll
    .dll windows:6 windows x86 arch:x86

    2d7a7ee26f70ae2d3f844ffc7c352dd8


    Headers

    Imports

    Exports

    Sections

  • Photo Y/bin/photoyDLL.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections

  • Photo Y/bin/rbxfpsunlocker.exe
    .exe windows:6 windows x64 arch:x64

    e990d7f0100453070ffacc114d7fece9


    Headers

    Imports

    Sections

  • Photo Y/bin/settings
  • Photo Y/bin/ver.txt
  • Photo Y/photo-y.exe
    .exe windows:5 windows x64 arch:x64

    1e92fd54d65284238a0e3b74b2715062


    Headers

    Imports

    Sections

  • main.pyc
  • Photo Y/runtimes/win-arm64/native/WebView2Loader.dll
  • Photo Y/runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:5 windows x64 arch:x64

    2a83d48aba3833cd76509f4d745e10bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Photo Y/runtimes/win-x86/native/WebView2Loader.dll
    .dll windows:5 windows x86 arch:x86

    608537c42a46a95b31cc1ef01ab6eeb0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Photo Y/workspace/IY_FE.iy
  • Photo Y/workspace/Mukuro/BF/kiwix2good_4191165852.json
  • Photo Y/workspace/Mukuro/BF/kiwix2pro_4228266744.json
  • Photo Y/workspace/Mukuro/Key.txt
  • Photo Y/workspace/Serverbin.json
  • Photo Y/workspace/TurtleSpySettings.json
  • Photo Y/workspace/fates-esp.json
  • Photo Y/workspace/items.txt
  • Photo Y/workspace/roadtogrambys.json
  • Photo Y/workspace/roadtogrambys.txt
  • Photo Y/workspace/rostruct/cache/release_tags.json
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/.gitattributes
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/README.md
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/extension.toml
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/img/midi-folder.png
    .png
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/package.lua
    .js
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/roblox.toml
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/selene.toml
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Assets/ScreenGui.rbxm
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/App.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Controller.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Preview.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Sidebar.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/FastDraggable.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/FastTween.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Input.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/MIDI.lua
    .js
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Song.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/TaskScheduler.lua
    .js
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Date.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Maid.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Promise.lua
    .js
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Signal.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/TableUtil.lua
    .js
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Thread.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.client.lua
  • Photo Y/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.meta.json