General

  • Target

    TEST.rar

  • Size

    17.0MB

  • MD5

    c79830cd5e5769971d741a9d4bc7072d

  • SHA1

    08d999667a21738702aab648f2099070116186f5

  • SHA256

    646954c38a583263b563a7a7446b8561448621f2d9ec4d9a37805be016591a77

  • SHA512

    a076a1807c327deb703b3f9e712755c85a33179a5bc022497de688df44a22b7f58bd7ab88113f65810e87467687c28a99262bac8653f855219562bfb72b3767a

  • SSDEEP

    393216:AOfDRmbz5AVbe9JYxP6PN7BYRUmvqVe+uKmMZWbQgPCRtbu2V3TSX4uO1flaGswS:A2DRmZAVbe9JYsPN/mUZeUg2V3Wi0jfp

Score
10/10

Malware Config

Signatures

  • AgentTesla payload 1 IoCs
  • Agenttesla family
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • TEST.rar
    .rar .zip polyglot
  • beta.zip
    .zip
  • beta/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/Monaco/Monaco.html
    .js
  • beta/Monaco/debug.log
  • beta/Monaco/vs/MonacoNet.dll
    .dll windows:6 windows x86 arch:x86

    785d680cbd472fae503fd72ce14d28cb


    Headers

    Imports

    Sections

  • beta/Monaco/vs/base/worker/workerMain.js
    .js
  • beta/Monaco/vs/basic-languages/lua/lua.js
  • beta/Monaco/vs/editor/contrib/suggest/media/String_16x.svg
  • beta/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
  • beta/Monaco/vs/editor/editor.main.css
  • beta/Monaco/vs/editor/editor.main.js
    .js
  • beta/Monaco/vs/editor/editor.main.nls.de.js
  • beta/Monaco/vs/editor/editor.main.nls.es.js
  • beta/Monaco/vs/editor/editor.main.nls.fr.js
  • beta/Monaco/vs/editor/editor.main.nls.it.js
  • beta/Monaco/vs/editor/editor.main.nls.ja.js
  • beta/Monaco/vs/editor/editor.main.nls.js
  • beta/Monaco/vs/editor/editor.main.nls.ko.js
  • beta/Monaco/vs/editor/editor.main.nls.ru.js
  • beta/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • beta/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • beta/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
  • beta/Monaco/vs/loader.js
    .js
  • beta/Siticone.UI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/System.Buffers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/System.ClientModel.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/System.Diagnostics.DiagnosticSource.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/System.Memory.Data.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/System.Memory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • beta/UIRemake.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • beta/UIRemake.exe.config
  • beta/UIRemake.pdb
  • beta/d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    8235041cfd6fffb926142c2c78013446


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • beta/dxcompiler.dll
    .dll windows:10 windows x64 arch:x64

    86379d9f4693f2aa059197611ab2ffc7


    Headers

    Imports

    Exports

    Sections

  • beta/dxil.dll
    .dll windows:10 windows x64 arch:x64

    42e0b0387affe2aaa84bcec72eb74baf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • beta/sideloader.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections