Acc_Generator_V3.rar
- SHA256 922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb
Password
booster123
Overview
overview
10Static
static
10Acc_Generator_V3.rar
windows7-x64
3Acc_Generator_V3.rar
windows10-2004-x64
8Acc Genera...V3.exe
windows7-x64
7Acc Genera...V3.exe
windows10-2004-x64
7�3D�tn�.pyc
windows7-x64
�3D�tn�.pyc
windows10-2004-x64
Acc Genera...V3.pdb
windows7-x64
3Acc Genera...V3.pdb
windows10-2004-x64
3Acc Genera...I2.dll
windows7-x64
1Acc Genera...I2.dll
windows10-2004-x64
1Acc Genera...ui.ini
windows7-x64
1Acc Genera...ui.ini
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Acc_Generator_V3.rar
Resource
win7-20240220-de
windows7-x64
4 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Acc_Generator_V3.rar
Resource
win10v2004-20240412-de
windows10-2004-x64
18 signatures
1200 seconds
Behavioral task
behavioral3
Sample
Acc Generator V3/Acc Generator V3.exe
Resource
win7-20240220-de
windows7-x64
3 signatures
1200 seconds
Behavioral task
behavioral4
Sample
Acc Generator V3/Acc Generator V3.exe
Resource
win10v2004-20240226-de
windows10-2004-x64
6 signatures
1200 seconds
Behavioral task
behavioral5
Sample
�3D�tn�.pyc
Resource
win7-20240221-de
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral6
Sample
�3D�tn�.pyc
Resource
win10v2004-20240412-de
windows10-2004-x64
0 signatures
1200 seconds
Behavioral task
behavioral7
Sample
Acc Generator V3/Acc Generator V3.pdb
Resource
win7-20240221-de
windows7-x64
5 signatures
1200 seconds
Behavioral task
behavioral8
Sample
Acc Generator V3/Acc Generator V3.pdb
Resource
win10v2004-20240412-de
windows10-2004-x64
3 signatures
1200 seconds
Behavioral task
behavioral9
Sample
Acc Generator V3/Guna.UI2.dll
Resource
win7-20240221-de
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral10
Sample
Acc Generator V3/Guna.UI2.dll
Resource
win10v2004-20240412-de
windows10-2004-x64
0 signatures
1200 seconds
Behavioral task
behavioral11
Sample
Acc Generator V3/imgui.ini
Resource
win7-20240221-de
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral12
Sample
Acc Generator V3/imgui.ini
Resource
win10v2004-20240412-de
windows10-2004-x64
0 signatures
1200 seconds
General
- Target Acc_Generator_V3.rar
- Size 10.4MB
- Sample240416-yy81hsbe42
- SHA256 922efe7b4d690b09a100538e8031ef77597059488f8693c46f02e79de036f5bb
- MD5 627267770e3421378e82a76b53fd1b4e
- SHA1 dbab8da0c78ac6ec4baa31ddd83b93dc4ea62259
- SHA512 320250198c93b2074e090abe17ef0daa92ee281c3d910dce8de635fce7e96f8d8f369e50da9505398ef492072993b282d5e5e78da5a2c9abb107a5e65ab0cea9
- SSDEEP 196608:VJpWC8XiWjTbI8IxI46xtNSxLhKaLuM6W+mPhX2xaEwM4hvmZQN0d5:VvErjTbBdtNaA0uM6qXXEF44GOd5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/Acc Generator V3/Guna.UI2.dll family_agenttesla - Agenttesla family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Acc Generator V3/Acc Generator V3.exe
File Explorer
-
Acc_Generator_V3.rar.rar 10.4MB
-
Acc Generator V3/Acc Generator V3.exe.exe 10.0MB
-
�3D�tn�.pyc1KB
-
Acc Generator V3/Acc Generator V3.pdb7.9MB
-
Acc Generator V3/Guna.UI2.dll.dll 2.1MB
-
Acc Generator V3/imgui.ini118B
Acc Generator V3/Acc Generator V3.exe
- IMPHASH 1af6c885af093afc55142c2f1761dbe8
- SHA256 8197d0f4445d4094afc8488590c2a598e450a322f44416a78aff5e358c8d3206
- MD5 014a00e1f0474d0f6b15822839c036bf
- SHA1 f1912c658c6a4b284aea87b38c22db89b640b8c0
- SHA512 75dea86d850a18bf990c239856c6c98f6c7943b1d65fa9695308b02cff7fad42bac40f5ebb620ed7db7ecc3adc4def39b4e55d60a431642f6993aec9c77ba14a
- SSDEEP 196608:PzO+sxfNKurErvI9pWjgU1DEzx7sKL/s1tySEQAkjUWlRH2Wm:CXxfsurEUWjhEhn01tv392Wm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
booster123
Minor OS version
2
Major OS version
5
Entry point
49968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetCPInfo
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=4, id=253, version=33030,
count=40, id=261, version=33030,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=33135,
count=1, id=258, version=33135,
�3D�tn�.pyc
- SHA256 b90ce81cd680150a8d97270f001e147d57ecd71a43fdac5c32ffa125b74504d4
- MD5 d47e321dd7e3908895a65b65675cfa63
- SHA1 eda183dff1a41101aee92d3763a69e105c2039b4
- SHA512 af4656d2faf3f5647c4714549689b807dc70bab5cad9bb65cdf0f1976db89c3cdaef889dd46043b746522bcc1a1972df6da2f49fe758d4c1bdb83f619ed37685
- MD5 SHA1 SHA512
Acc Generator V3/Acc Generator V3.pdb
- SHA256 7f7e08ddb501da24713f589e02a21479e088f41611c666e0f432ff1160ac5822
- MD5 5cbc73d0f33ed7ae7c5c343f38a51878
- SHA1 f0ccbc14720d9f440364bf70bd2850cf97d2485c
- SHA512 a1254ef5df619197820e766da9dc63326a3edc3f8c486fa9c3c32e3749fb9c66e00341cb6d5b0bf8390139b9d05a82bda566505822e09b1f41d12680926b24d7
- SSDEEP 98304:x4+LSnRUbtojIn6XOMImQ76FmKDEtLZE4CB1yCb2wBmIwo4N2pks9KPZaeLHGQrd:Vn6ksAjrgrkX
- MD5 SHA1 SHA512 SSDEEP
Acc Generator V3/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579
- MD5 b429ae86c5be521bc8ca3b164cec3acb
- SHA1 387560073ff5a1f2191abc6f75fc34532bbb6dd2
- SHA512 eae65de53da50708983ed8ebf9e1e3dd5f9aea95a354d272e199bb59517f62bfe35f0df7a37d81ab0423d0d6d29304fa70284c731bd54023e446b2c19bacafb1
- SSDEEP 24576:DgWuftU4WrNOA6sM6kXxMfNmnjk/c5NrH0UUoo2QkJXVSItH5ppoO0KzJ6nFwHQL:DA+NOpXm1mnj0cP+DkhMAiawnFV
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
Password
booster123
PE Signature issue
Digest
5e:00:a7:1b:7e:46:57:12:de:98:da:e3:8d:91:ea:26:6d:ef:71:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2226574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Acc Generator V3/imgui.ini
- SHA256 eaebd6f4feeef11eece1885cb63f039085ab5e6c97c0d7d8e5d3a4973a409a5d
- MD5 771e6363ab5ba0bb16cefac43fea153e
- SHA1 2441fa4a38b6b24a80989857ce15112a7528a319
- SHA512 a8b133016a9832fafc5ecff66b73bede8187ef0aeebf25f8e550214047438eed2c79209314a27f8a91d7f2115418237b30016c98793b69411a8c7994b9964d79
- MD5 SHA1 SHA512