General

  • Target

    koko-buyer.zip

  • Size

    8.8MB

  • MD5

    369487240f448b2c34b12dd6692ce090

  • SHA1

    e51229dd29b05fe7eb34d1ec2fe996e660e4449f

  • SHA256

    75871bf3e84303f113e5a89f36d4b3d46dd2a8cdd6146c4d1e1a11cd1835dd46

  • SHA512

    f04c478b66eabe0b44eb3f707dea87f04329cf4d17a3a51ee2b5059d5313c05ddeb43e0a059f7fc5564bf4659ba21ceaf7d0e2b1245f407e1f9a351f567bda5d

  • SSDEEP

    196608:BSOjfJRBf4/CX/G/9IvA25DEHx7IARQeP217YinLnMiZsiFFWTC9dbg:B5jfN4/C+qvrE1ae+17vP8TC3g

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • koko-buyer.zip
    .zip
  • koko-buyer/@i love girls.cfg
  • koko-buyer/hwid.exe
    .exe windows:5 windows x64 arch:x64

    1af6c885af093afc55142c2f1761dbe8


    Code Sign

    Headers

    Imports

    Sections

  • �$b�_J�.pyc
  • koko-buyer/koko.exe
    .exe windows:6 windows x64 arch:x64

    3c599510d0d79bb3b3c0d812797316dd


    Headers

    Imports

    Sections