General
-
Target
Rose-Stealer-main.zip
-
Size
930KB
-
MD5
9c13b67e2671d562b26b6ff77c0f624d
-
SHA1
7b27addf0d5cc37baaa813a5f2eeb8c3143fe669
-
SHA256
05cf783422e6e1f4009d64fbaf4ad7dfa6592aca29cd1f9e297a64ad0a2c479e
-
SHA512
c84327d7cd29d90fcce571f6458b99eabeddb9929ff0f396715fefbead9abbed8f37a464c201c891febcee92eb4ec64822a11460c85499f08421dec00117abc7
-
SSDEEP
12288:xlABH9WpFvxRlu49E2U2pXdz0E7Vx8lKQTv/xDryJQzElz1j3VD9bLPWBJQsGrYj:H+kpFJbu4nXn8zXRWaAh5D9bLW37Gr9I
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/Rose-Stealer-main/resources/utils/upx-4.1.0-win64/upx.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rose-Stealer-main/resources/utils/upx-4.1.0-win64/upx.exe unpack002/out.upx
Files
-
Rose-Stealer-main.zip.zip
-
Rose-Stealer-main/.bandit
-
Rose-Stealer-main/.deepsource.toml
-
Rose-Stealer-main/.github/ISSUE_TEMPLATE/bug_report.md
-
Rose-Stealer-main/.github/ISSUE_TEMPLATE/feature_request.md
-
Rose-Stealer-main/.gitignore
-
Rose-Stealer-main/LICENSE
-
Rose-Stealer-main/README.md
-
Rose-Stealer-main/build.bat
-
Rose-Stealer-main/docs/CHANGELOG.md
-
Rose-Stealer-main/docs/FEATURES.md
-
Rose-Stealer-main/docs/KNIGHT.md
-
Rose-Stealer-main/resources/assets/builder.png.png
-
Rose-Stealer-main/resources/assets/rose.png.png
-
Rose-Stealer-main/resources/assets/roseloadingscreen.mp4
-
Rose-Stealer-main/resources/data/injection.js.js
-
Rose-Stealer-main/resources/data/obf-injection.js.js
-
Rose-Stealer-main/resources/data/requirements.txt
-
Rose-Stealer-main/resources/source/dev/xmri.py
-
Rose-Stealer-main/resources/source/old/InjectX.py
-
Rose-Stealer-main/resources/source/old/_file.py
-
Rose-Stealer-main/resources/source/old/_random_string.py
-
Rose-Stealer-main/resources/source/old/_roblox.py
-
Rose-Stealer-main/resources/source/old/_startup.py
-
Rose-Stealer-main/resources/source/old/_webhook.py
-
Rose-Stealer-main/resources/source/old/antivm.py
-
Rose-Stealer-main/resources/source/old/block_sites.py
-
Rose-Stealer-main/resources/source/old/browser.py
-
Rose-Stealer-main/resources/source/old/config.py
-
Rose-Stealer-main/resources/source/old/discordc.py
-
Rose-Stealer-main/resources/source/old/games.py
-
Rose-Stealer-main/resources/source/old/ipinf.py
-
Rose-Stealer-main/resources/source/old/knight_rat.py
-
Rose-Stealer-main/resources/source/old/main.py
-
Rose-Stealer-main/resources/source/old/ransomware.py
-
Rose-Stealer-main/resources/source/old/rose_rat.py
-
Rose-Stealer-main/resources/source/old/sysinf.py
-
Rose-Stealer-main/resources/source/old/tbsod.py
-
Rose-Stealer-main/resources/source/old/uac_bypass.py
-
Rose-Stealer-main/resources/source/old/webhook.py
-
Rose-Stealer-main/resources/source/old/xmr_miner.py.py .vbs
-
Rose-Stealer-main/resources/source/rose.py
-
Rose-Stealer-main/resources/ui/builder.py
-
Rose-Stealer-main/resources/ui/msg.txt
-
Rose-Stealer-main/resources/utils/comp/cert
-
Rose-Stealer-main/resources/utils/comp/post.py
-
Rose-Stealer-main/resources/utils/comp/sigthief.py.py .sh linux
-
Rose-Stealer-main/resources/utils/obfuscation/blankobf.py
-
Rose-Stealer-main/resources/utils/obfuscation/obf.py
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/LICENSE
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/README.md
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/pycloak/main.py
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/requirements.txt
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/setup.py
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/tests/in.py
-
Rose-Stealer-main/resources/utils/obfuscation/pycloak-main/tests/out.py
-
Rose-Stealer-main/resources/utils/old_build/rose_builder.pyw
-
Rose-Stealer-main/resources/utils/rosedec/README.md
-
Rose-Stealer-main/resources/utils/rosedec/decrequirements.txt
-
Rose-Stealer-main/resources/utils/rosedec/decrypter.bat
-
Rose-Stealer-main/resources/utils/rosedec/rose-decrypter.py
-
Rose-Stealer-main/resources/utils/unblocker/unblock_sites.py
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/COPYING
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/LICENSE
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/NEWS
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/README
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/THANKS.txt
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/upx-doc.html.html .vbs polyglot
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/upx-doc.txt.vbs
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/upx.1.vbs
-
Rose-Stealer-main/resources/utils/upx-4.1.0-win64/upx.exe.exe windows:4 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 542KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 885KB - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Rose-Stealer-main/setup.cfg
-
Rose-Stealer-main/tox.ini