CS2_Bebra_Changer.zip
- SHA256 73afdd7910d8e2a80cea30f63828a9ae3cb73f024af344608730baf5c43cecfa
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CS2 Bebra Changer/PyuBCoF1HM.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
CS2 Bebra Changer/bebra_.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target CS2_Bebra_Changer.zip
- Size 840KB
- Sample240125-v15t4aceep
- SHA256 73afdd7910d8e2a80cea30f63828a9ae3cb73f024af344608730baf5c43cecfa
- MD5 3595bbf7ef40ed96c51b900dd42ec934
- SHA1 7efb3ba316fc1d55701ad0e0b7a08eb3fa1f5b1d
- SHA512 a10425bb18f051cf88173d0052d92b26e6f72e42f18ea087302a32a9facf87023dec1deb94bcf29243cc84b43cdd4fd8d3ad4589ed17329b449a87161c58d6aa
- SSDEEP 12288:KQkkD66mZGvYFULJSj9P5YmKhpLA9DWtVCwXd84PYs17Kkehsi0MSXm/omPmb50V:PUkd7LiDWtvjJ1hPiCdmPmFX/6bi8
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/CS2 Bebra Changer/PyuBCoF1HM.exe unpack001/CS2 Bebra Changer/bebra_.dll unpack001/CS2 Bebra Changer/frprov.dll
File Explorer
-
CS2_Bebra_Changer.zip.zip 840KB
-
CS2 Bebra Changer/PyuBCoF1HM.exe.exe 42KB
-
CS2 Bebra Changer/bebra_.dll.dll 925KB
-
CS2 Bebra Changer/frprov.dll.dll 611KB
CS2 Bebra Changer/PyuBCoF1HM.exe
- IMPHASH 98ac1d34184a1e652ded4134f28eeaae
- SHA256 efb25224067d604503f33039b5867896793e7e3e88ca2d792593283837119687
- MD5 064f764fd8be73761b0f92e23752f0a9
- SHA1 ca2065549043b525987690d04b02ff414565a3c7
- SHA512 080947f458bf01b00b4226a211b849dc1e1b839346bebc50ab84258fa18470172852e6557899f005611f64d25e3d6197ee0251b0a2184264c68d10ed6185d666
- SSDEEP 768:os3Tb75VkpYrhWoK8wJPJRlNhSP00oZTzvIffkRswMyJXXN2+tZGHZch37g/4:os/gPJ7NhSP00oZYffkRvMSPZdgg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteProcessMemory
RtlAddFunctionTable
Sleep
GetLastError
LoadLibraryA
CloseHandle
VirtualProtectEx
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetExitCodeProcess
GetModuleFileNameA
FindFirstFileA
GetCurrentProcess
GetProcessId
FindNextFileA
FindClose
GetCurrentDirectoryA
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetConsoleWindow
lstrcmpiW
GetProcessHandleCount
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
user32
ShowWindow
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__std_exception_destroy
__std_terminate
memcpy
__current_exception_context
_CxxThrowException
__current_exception
__std_exception_copy
memset
memmove
api-ms-win-crt-stdio-l1-1-0
fsetpos
fgetpos
fwrite
fclose
__p__commode
_set_fmode
ungetc
setvbuf
fgetc
__acrt_iob_func
fread
fflush
__stdio_common_vfprintf
_get_stream_buffer_pointers
fputc
_fseeki64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
rename
_unlock_file
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
_set_app_type
__p___argc
__p___argv
_cexit
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_seh_filter_exe
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_c_exit
terminate
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=260, version=33030,
count=2, id=259, version=33030,
count=27, id=261, version=33030,
count=6, id=257, version=33030,
count=5, id=257, version=30795,
count=155, id=1, productName=Unmarked objects,
count=2, id=265, version=33130,
count=1, id=255, version=33130,
count=1, id=258, version=33130,
CS2 Bebra Changer/bebra_.dll
- IMPHASH 73627166667abaee452427dde9391bfa
- SHA256 51440644c037cc88192872f843216f542e7d1aeca5be77db728928b334f7708f
- MD5 f60512cc22d66c5bd4fc24aa6ba878e5
- SHA1 488f5c212a09e85dc8d58f2efed6835ac828990d
- SHA512 9bd2ea264770eff70108d7f8e578533f1a625ada8daa38e3d30cef69088f50a8b12dd0ed708fd5c2ad5826ed9522571e84cad10b2178b6df4c2172d74e074636
- SSDEEP 24576:W8mF5Yfw7o/4KYrj5R0ycFBIOEU05XZznq74:zmF5E/8rjHcF2Ospnq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
640548
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
psapi
GetMappedFileNameA
kernel32
FormatMessageA
VirtualQuery
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
FreeLibraryAndExitThread
CloseHandle
CreateThread
SetConsoleTitleA
GetCurrentProcess
GetLastError
K32GetModuleInformation
DisableThreadLibraryCalls
GetCurrentProcessId
GetConsoleWindow
ReadFile
GetFileSizeEx
HeapFree
UnmapViewOfFile
CreateFileA
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetModuleHandleExA
VirtualAlloc
VirtualFree
VirtualProtect
AllocConsole
TerminateProcess
FlushInstructionCache
RtlCaptureContext
FreeConsole
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
user32
IsWindowVisible
CallWindowProcA
EnumWindows
SetWindowLongPtrA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetWindow
ReleaseCapture
SetCursor
GetClientRect
IsWindowUnicode
SetCursorPos
GetCursorPos
OpenClipboard
GetWindowThreadProcessId
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetForegroundWindow
SetCapture
imm32
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
msvcp140
_Query_perf_counter
_Xtime_get_ticks
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Thrd_sleep
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
__current_exception
__current_exception_context
__C_specific_handler
memset
_CxxThrowException
__std_type_info_destroy_list
__std_terminate
strstr
__std_exception_destroy
__std_exception_copy
longjmp
memchr
__intrinsic_setjmp
memmove
memcpy
memcmp
api-ms-win-crt-stdio-l1-1-0
fputc
fflush
fopen
freopen_s
fclose
__stdio_common_vfprintf
__stdio_common_vsscanf
fread
_wfopen
fwrite
__stdio_common_vsprintf
fseek
__acrt_iob_func
ftell
fputs
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
strtol
atof
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_execute_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0
logf
pow
log
fmodf
powf
acosf
sqrtf
cosf
ceilf
sinf
Name
.text
Size
627KB
Virtual Size
627KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
262KB
Virtual Size
261KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=32533,
count=1, id=253, version=32533,
count=21, id=261, version=32533,
count=8, id=260, version=32533,
count=4, id=259, version=32533,
count=17, id=257, version=30795,
count=176, id=1, productName=Unmarked objects,
count=81, id=264, version=32825,
count=1, id=255, version=32825,
count=1, id=258, version=32825,
CS2 Bebra Changer/frprov.dll
- IMPHASH 35ff184ac2511a8c53d39026914ccd0f
- SHA256 ec99d23143a01ed121960f40ba76730a077be27bd38980b0fcbccf59bdf701d1
- MD5 d20153fd0a2e1c8a75665b284d286af6
- SHA1 0a8634dab54a994e09ec9e2f94fdde95215f893b
- SHA512 9222e307f4b4e82d228948bc5365cc7ffa9136f24434e9567daaebbae2f2cfec841ccdd07e11de23c5f3956d27bda1eb5ba3d7e8fa37f0ff8cfe1f8d19653403
- SSDEEP 12288:IzzIc9ZyKJM7hGIM3gVEB0CR6xn9Ns4SJhSRdumgXbv:IzU/J7U73MEB7oxn9Ns4SESr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
270364
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetProcAddress
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GlobalUnlock
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
DisableThreadLibraryCalls
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
GlobalLock
GlobalFree
QueryPerformanceFrequency
GlobalAlloc
GetThreadContext
RtlCaptureContext
GetModuleHandleA
user32
DefWindowProcA
CreateWindowExA
UnregisterClassA
RegisterClassExA
GetKeyState
DestroyWindow
LoadCursorA
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetWindowLongPtrA
CallWindowProcA
GetAsyncKeyState
ScreenToClient
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
d3dcompiler_47
D3DCompile
xinput1_4
ord4
ord2
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__current_exception_context
__current_exception
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memcmp
memcpy
memmove
__std_type_info_destroy_list
memchr
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
malloc
free
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
toupper
api-ms-win-crt-runtime-l1-1-0
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_wassert
_crt_atexit
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
api-ms-win-crt-stdio-l1-1-0
fflush
fclose
fwrite
__stdio_common_vsscanf
_wfopen
__stdio_common_vsprintf
fseek
fread
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
atan2f
floorf
fmodf
pow
powf
sinf
sqrt
sqrtf
cosf
ceilf
Name
.text
Size
264KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
265KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=6, id=257, version=33030,
count=11, id=257, version=30795,
count=152, id=1, productName=Unmarked objects,
count=15, id=265, version=33130,
count=1, id=255, version=33130,
count=1, id=258, version=33130,