General

  • Target

    2a7ca62ab3dcc82582ecde744dc92cab.bin

  • Size

    9.0MB

  • MD5

    d9281051c963355dfe9ba7a52de3ba1a

  • SHA1

    71819f94a80ebafb2893381585072befcabb045b

  • SHA256

    31ae7b285b08d037b4a7a6fd6aa01cce7657b7a96733dcf0dc58f5cf975e876b

  • SHA512

    0d43f32d089c0aa73eafbc627421d6181eeb79ac18ae5b2e4c04203a6541972eb5095a0e3fca9438b1161971452ef7551f4a5a4aeb816494b6508feeedd1a3bf

  • SSDEEP

    196608:LPRBoPoSd0nGbw0DB/iPN6NUExGpecamjIgtd8KBmwCEW4gvzgt:TRqJXw0FGN66aVM5B9qzgt

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 2a7ca62ab3dcc82582ecde744dc92cab.bin
    .zip

    Password: infected

  • 7b8eb83b50c69e286307d04e3fa86221ad0c9e04ce9be3a4c35dbfa6d08f1280.zip
    .zip

    Password: infected

  • Token Joiner-Zarduax/Token-Joiner.exe
    .exe windows:5 windows x64 arch:x64

    Password: infected

    1af6c885af093afc55142c2f1761dbe8


    Code Sign

    Headers

    Imports

    Sections

  • S.pyc
  • Token Joiner-Zarduax/libcrypto-3-x64.dll
    .dll windows:5 windows x64 arch:x64

    Password: infected

    afa8a10163b2aa7831ee0e91bbe7d929


    Headers

    Imports

    Exports

    Sections

  • Token Joiner-Zarduax/libssl-3-x64.dll
    .dll windows:5 windows x64 arch:x64

    Password: infected

    a5db4944ca4c6446f5fbd8bbdc2b1577


    Headers

    Imports

    Exports

    Sections

  • Token Joiner-Zarduax/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Token Joiner-Zarduax/msvcp140_1.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    b783879e062a97e0892b4f847ccc585b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Token Joiner-Zarduax/requirements.txt
  • Token Joiner-Zarduax/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    b06d4116da69a513992d529f84731e6f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Token Joiner-Zarduax/vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    Password: infected

    ae0bde6314fa2027b54ce04898f6ab69


    Code Sign

    Headers

    Imports

    Exports

    Sections