General

  • Target

    RR_NUKER.zip

  • Size

    14.2MB

  • MD5

    adfa1a787c08b064e0ba166e48195187

  • SHA1

    c540a5fdf6e9d8d6df4295c7fdaf1d5c98b0e5d6

  • SHA256

    a6e4194595a1add060d260ed040194e08f3ed627c916766329b61db1d7a5f173

  • SHA512

    dce317456608a1f50a4d4f85c621f705c386ddd531d4b9f3e9d875b8246448fd8ebd181f8367a9e6f8b4da09a8d48b9552deb1e322512c7c46938045cd78748d

  • SSDEEP

    196608:HlSC8RWUiJ45Ju2oHlPgqjLyKDT7nibMKs3uBXIj9WVRw9CiI5lu1LgcOm+nGg:FSCNZd2hUT7nZKs3uKAVmClE1Lz+Gg

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • RR_NUKER.zip
    .zip
  • RR_NUKER.exe
    .exe windows:5 windows x64 arch:x64

    1af6c885af093afc55142c2f1761dbe8


    Code Sign

    Headers

    Imports

    Sections

  • �W����.pyc
  • _internal/VCRUNTIME140.dll
    .dll windows:6 windows x64 arch:x64

    7f07fd94e5bb907093556781cc464017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_asyncio.pyd
    .dll windows:6 windows x64 arch:x64

    9d434eba59ce931bdee5b38eec4b196b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_bz2.pyd
    .dll windows:6 windows x64 arch:x64

    d0a62ab71a2b2ca69c6aba1f0a37fcdd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    e716aa549ea6dfb7b233942c7f07ff87


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_decimal.pyd
    .dll windows:6 windows x64 arch:x64

    c8876e9e8ae3bb7e4abb8348fe33f03e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    02e7e9437b7e711286b4b21f873e174b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_lzma.pyd
    .dll windows:6 windows x64 arch:x64

    c39c7a021b2adfc11bb34f105f70355e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_multiprocessing.pyd
    .dll windows:6 windows x64 arch:x64

    ad5e2bc3f4742dadfaf9e74afc91a9f0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_overlapped.pyd
    .dll windows:6 windows x64 arch:x64

    48664681fdde7330197ca0b81cd0888e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_queue.pyd
    .dll windows:6 windows x64 arch:x64

    d39104d594ed5774205f94197c63bfbc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    332065e5d19d708832b034da27e5571a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_ssl.pyd
    .dll windows:6 windows x64 arch:x64

    320b5938e789045797776388b51c1253


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/_uuid.pyd
    .dll windows:6 windows x64 arch:x64

    368b62645c11988f8173cf8bdd0fea25


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/attrs-23.1.0.dist-info/INSTALLER
  • _internal/attrs-23.1.0.dist-info/METADATA
  • _internal/attrs-23.1.0.dist-info/RECORD
  • _internal/attrs-23.1.0.dist-info/WHEEL
  • _internal/attrs-23.1.0.dist-info/licenses/LICENSE
  • _internal/base_library.zip
    .zip
  • _collections_abc.pyc
  • _weakrefset.pyc
  • abc.pyc
  • codecs.pyc
  • collections/__init__.pyc
  • collections/abc.pyc
  • copyreg.pyc
  • encodings/__init__.pyc
  • encodings/aliases.pyc
  • encodings/ascii.pyc
  • encodings/base64_codec.pyc
  • encodings/big5.pyc
  • encodings/big5hkscs.pyc
  • encodings/bz2_codec.pyc
  • encodings/charmap.pyc
  • encodings/cp037.pyc
  • encodings/cp1006.pyc
  • encodings/cp1026.pyc
  • encodings/cp1125.pyc
  • encodings/cp1140.pyc
  • encodings/cp1250.pyc
  • encodings/cp1251.pyc
  • encodings/cp1252.pyc
  • encodings/cp1253.pyc
  • encodings/cp1254.pyc
  • encodings/cp1255.pyc
  • encodings/cp1256.pyc
  • encodings/cp1257.pyc
  • encodings/cp1258.pyc
  • encodings/cp273.pyc
  • encodings/cp424.pyc
  • encodings/cp437.pyc
  • encodings/cp500.pyc
  • encodings/cp720.pyc
  • encodings/cp737.pyc
  • encodings/cp775.pyc
  • encodings/cp850.pyc
  • encodings/cp852.pyc
  • encodings/cp855.pyc
  • encodings/cp856.pyc
  • encodings/cp857.pyc
  • encodings/cp858.pyc
  • encodings/cp860.pyc
  • encodings/cp861.pyc
  • encodings/cp862.pyc
  • encodings/cp863.pyc
  • encodings/cp864.pyc
  • encodings/cp865.pyc
  • encodings/cp866.pyc
  • encodings/cp869.pyc
  • encodings/cp874.pyc
  • encodings/cp875.pyc
  • encodings/cp932.pyc
  • encodings/cp949.pyc
  • encodings/cp950.pyc
  • encodings/euc_jis_2004.pyc
  • encodings/euc_jisx0213.pyc
  • encodings/euc_jp.pyc
  • encodings/euc_kr.pyc
  • encodings/gb18030.pyc
  • encodings/gb2312.pyc
  • encodings/gbk.pyc
  • encodings/hex_codec.pyc
  • encodings/hp_roman8.pyc
  • encodings/hz.pyc
  • encodings/idna.pyc
  • encodings/iso2022_jp.pyc
  • encodings/iso2022_jp_1.pyc
  • encodings/iso2022_jp_2.pyc
  • encodings/iso2022_jp_2004.pyc
  • encodings/iso2022_jp_3.pyc
  • encodings/iso2022_jp_ext.pyc
  • encodings/iso2022_kr.pyc
  • encodings/iso8859_1.pyc
  • encodings/iso8859_10.pyc
  • encodings/iso8859_11.pyc
  • encodings/iso8859_13.pyc
  • encodings/iso8859_14.pyc
  • encodings/iso8859_15.pyc
  • encodings/iso8859_16.pyc
  • encodings/iso8859_2.pyc
  • encodings/iso8859_3.pyc
  • encodings/iso8859_4.pyc
  • encodings/iso8859_5.pyc
  • encodings/iso8859_6.pyc
  • encodings/iso8859_7.pyc
  • encodings/iso8859_8.pyc
  • encodings/iso8859_9.pyc
  • encodings/johab.pyc
  • encodings/koi8_r.pyc
  • encodings/koi8_t.pyc
  • encodings/koi8_u.pyc
  • encodings/kz1048.pyc
  • encodings/latin_1.pyc
  • encodings/mac_arabic.pyc
  • encodings/mac_croatian.pyc
  • encodings/mac_cyrillic.pyc
  • encodings/mac_farsi.pyc
  • encodings/mac_greek.pyc
  • encodings/mac_iceland.pyc
  • encodings/mac_latin2.pyc
  • encodings/mac_roman.pyc
  • encodings/mac_romanian.pyc
  • encodings/mac_turkish.pyc
  • encodings/mbcs.pyc
  • encodings/oem.pyc
  • encodings/palmos.pyc
  • encodings/ptcp154.pyc
  • encodings/punycode.pyc
  • encodings/quopri_codec.pyc
  • encodings/raw_unicode_escape.pyc
  • encodings/rot_13.pyc
  • encodings/shift_jis.pyc
  • encodings/shift_jis_2004.pyc
  • encodings/shift_jisx0213.pyc
  • encodings/tis_620.pyc
  • encodings/undefined.pyc
  • encodings/unicode_escape.pyc
  • encodings/utf_16.pyc
  • encodings/utf_16_be.pyc
  • encodings/utf_16_le.pyc
  • encodings/utf_32.pyc
  • encodings/utf_32_be.pyc
  • encodings/utf_32_le.pyc
  • encodings/utf_7.pyc
  • encodings/utf_8.pyc
  • encodings/utf_8_sig.pyc
  • encodings/uu_codec.pyc
  • encodings/zlib_codec.pyc
  • enum.pyc
  • functools.pyc
  • genericpath.pyc
  • heapq.pyc
  • io.pyc
  • keyword.pyc
  • linecache.pyc
  • locale.pyc
  • ntpath.pyc
  • operator.pyc
  • os.pyc
  • posixpath.pyc
  • re/__init__.pyc
  • re/_casefix.pyc
  • re/_compiler.pyc
  • re/_constants.pyc
  • re/_parser.pyc
  • reprlib.pyc
  • sre_compile.pyc
  • sre_constants.pyc
  • sre_parse.pyc
  • stat.pyc
  • traceback.pyc
  • types.pyc
  • warnings.pyc
  • weakref.pyc
  • _internal/libcrypto-3.dll
    .dll windows:6 windows x64 arch:x64

    40bce6a23883072a66c68006f08e105c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/libffi-8.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/libssl-3.dll
    .dll windows:6 windows x64 arch:x64

    d7b4c2840f7d9940b920a4860e6a80b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/multidict/_multidict.cp311-win_amd64.pyd
    .dll windows:6 windows x64 arch:x64

    1f1d6572a871e8a013b796e8365b088c


    Headers

    Imports

    Exports

    Sections

  • _internal/pyexpat.pyd
    .dll windows:6 windows x64 arch:x64

    cfa32f0abc6ae85c4b2078212640c054


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/python311.dll
    .dll windows:6 windows x64 arch:x64

    5714829f48aacde8f83e3e5f0ead1f49


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/select.pyd
    .dll windows:6 windows x64 arch:x64

    fc4f7d736924aa67a1bd7b7b80894df9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    bb6f6d951dbdd290ecf382ca57459172


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • _internal/yarl/_quoting_c.cp311-win_amd64.pyd
    .dll windows:6 windows x64 arch:x64

    c8aad050a232d2f0641684b8c4d0c78a


    Headers

    Imports

    Exports

    Sections