Scorpion-Premium_Generateur.rar
- SHA256 26c686e04dfd913161d239e2cb51ceb87bd5d68422f7555aa5f8d9eb1873997e
Overview
overview
10Static
static
10dddd/Guna.UI2.dll
windows7-x64
1dddd/Guna.UI2.dll
windows10-2004-x64
1dddd/Gén�...um.exe
windows7-x64
3dddd/Gén�...um.exe
windows10-2004-x64
10dddd/LogIn...xi.dll
windows7-x64
1dddd/LogIn...xi.dll
windows10-2004-x64
1dddd/theme.dll
windows7-x64
1dddd/theme.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
dddd/Guna.UI2.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
dddd/Guna.UI2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
dddd/Générateur Scorpion-Premium.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
dddd/Générateur Scorpion-Premium.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
dddd/LogIn Theme Dll By xVenoxi.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
dddd/LogIn Theme Dll By xVenoxi.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
dddd/theme.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
dddd/theme.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Scorpion-Premium_Generateur.rar
- Size 980KB
- Sample240329-vjss7sdf43
- SHA256 26c686e04dfd913161d239e2cb51ceb87bd5d68422f7555aa5f8d9eb1873997e
- MD5 3b2cb314b5b5baa26d127294e057e748
- SHA1 07046b1266adf3030dcbf39afbd25f9ffb395eab
- SHA512 f77f36fb72b15dd88aa7e1595e6ed042ab5ae6be90b8ab8ff59700122495eecf48ffc66ccc86fceb5d41f885d82d5bf6150fbce5a73b69cb064da8800cc82b4d
- SSDEEP 24576:6dp6aQMljxgBEKi9J2nKd123qH/3WzCJ6ZmcFA0qwJiFMp2Fq:6doaQMlj+a5R16qOzRZr7qwyMUg
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/dddd/Guna.UI2.dll family_agenttesla - Agenttesla family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/dddd/Guna.UI2.dll unpack001/dddd/Générateur Scorpion-Premium.exe unpack001/dddd/LogIn Theme Dll By xVenoxi.dll unpack001/dddd/theme.dll
File Explorer
-
Scorpion-Premium_Generateur.rar.rar 980KB
-
dddd/Guna.UI2.dll.dll 1.9MB
-
dddd/Générateur Scorpion-Premium.exe.exe 1.1MB
-
dddd/LogIn Theme Dll By xVenoxi.dll.dll 115KB
-
dddd/theme.dll.dll 84KB
dddd/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 836e1cc306eab0817a10c613a9c99d4dcbd604624b8b90f551d410dc164eef82
- MD5 83e9df5d534f50280251d662861bf476
- SHA1 d2ecd37e462b3c6fa763341a12f9de74326cb646
- SHA512 af38cfbd5fb866662afa4548011ba2d262cd70ff145fe4118db3322a9ea243bd9d8dc9cdfc62a246df014949a94d159bcd47a8f8f04010b93c963511a7e6a72a
- SSDEEP 24576:+5lxrKZ9DHFoXP/Jt/A1IKKPZANZuwgHQ/jz41RMIK24:Av/CIRqwRMIK24
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2033198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dddd/Générateur Scorpion-Premium.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f760af630a93cd72a6580ffbebaf7eea6912255435b48f4e7dc4a696c0d3662
- MD5 c7936aa7c0ed1759dbaa45ed4e13a548
- SHA1 1b7cec2a815a93e7d0f5d6480d9dbdd30953245f
- SHA512 88b0d35114f3a6ed167774062f6d7d89125d61a3132b72d41c8293eef940a05ac8d487ebb5659d6b4ff6616967c3e27d5e9698c84680e948fff7d1df0915b930
- SSDEEP 12288:oo+H5nseophtd5FJgeF9CMIXSvIlclxXSvIlclHXSvIlcl:odMhlFnC5cl5clbcl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1138698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
[i LN
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
[i LN
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
651KB
Virtual Size
650KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
265KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
B56422AA
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dddd/LogIn Theme Dll By xVenoxi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04d7e61f6102a9cfb7e262211880d1a2ac89ad5edf30cf4d28ac5e1444ee4c97
- MD5 f3a5fd717a0782c88641cdec9e66ea64
- SHA1 0128f6577dab38a097606e483f962ef98fa085cb
- SHA512 6bc88a3dac591420d97e39b0541bae115c8266401dbf54ca5623fcf9b3c0c25d5dbc9e20f08597a20fa5913266547846a867f071d4adbedcb2377ef8cad997b5
- SSDEEP 3072:Anv5NgCErhIh8PPKYnVobmgJzf/aDVt3WEl9mRzaqBnpm13KGfo74diqiRMoQd:ex6Y9H7fMoQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\xVenoxi\documents\visual studio 2013\Projects\Theme Dll By xVenoxi\Theme Dll By xVenoxi\obj\Debug\LogIn Theme Dll By xVenoxi.pdb
mscoree
_CorDllMain
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dddd/theme.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e9011d9fed685da012d9f5baee15872805e52bf73e2b8aa06b2792d20370d653
- MD5 3103fe8ace86424086d97285f12af135
- SHA1 741b237c0fa0098ef3aad6b6b48e7a377afff621
- SHA512 733575743e937bce17e4144d312e2d41ebf6953d40875215cce22be9106b870ee10aa186ff58fd40e6a0cbf262c0dda9f8245acac2962b538da286128135bfde
- SSDEEP 1536:tMjk8q1YWWEyMR0xkOs6nwhyycoWMQo9sjWCd8I730iGGaccPPio:tMjk8q1YWWEyMRWkOBnwhyyc3MQoWjWd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
80382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Josh\Documents\Visual Studio 2012\Projects\theme\theme\obj\Debug\theme.pdb
mscoree
_CorDllMain
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ