Overview
overview
1Static
static
1f/Red Lotu...].html
windows7-x64
1f/Red Lotu...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1f/White Lo...].html
windows7-x64
1f/White Lo...].html
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
f/Red Lotus - γ-γπ·πγ-γ - γπΊγπ³πππππππππ [1081576512106536960].html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f/Red Lotus - γ-γπ·πγ-γ - γπΊγπ³πππππππππ [1081576512106536960].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
f/White Lotus - DFIR courses - black-lotus-campaign [1177322117302341742].html
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
f/White Lotus - DFIR courses - black-lotus-campaign [1177322117302341742].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
f/White Lotus - DFIR courses - blue-team [1152680804288311307].html
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
f/White Lotus - DFIR courses - blue-team [1152680804288311307].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
f/White Lotus - DFIR courses - jwt-attacks [1150542999332331532].html
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
f/White Lotus - DFIR courses - jwt-attacks [1150542999332331532].html
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
f/White Lotus - KAPE - Manual - manual-parsing [1057990251907383326].html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
f/White Lotus - KAPE - Manual - manual-parsing [1057990251907383326].html
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
f/White Lotus - Kape - Modules - evtxecmd [1058863474178003046].html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
f/White Lotus - Kape - Modules - evtxecmd [1058863474178003046].html
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
f/White Lotus - Kape - Modules - ezparsers [1058855998850334760].html
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
f/White Lotus - Kape - Modules - ezparsers [1058855998850334760].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
f/White Lotus - Kape - Modules - filesystem-2 [1058865730604519486].html
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
f/White Lotus - Kape - Modules - filesystem-2 [1058865730604519486].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
f/White Lotus - Kape - Modules - indxripper [1057892546216460368].html
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
f/White Lotus - Kape - Modules - indxripper [1057892546216460368].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
f/White Lotus - Kape - Modules - jumplists [1057990719018647642].html
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
f/White Lotus - Kape - Modules - jumplists [1057990719018647642].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
f/White Lotus - Kape - Modules - kape-magnet [1059020870691065887].html
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
f/White Lotus - Kape - Modules - kape-magnet [1059020870691065887].html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
f/White Lotus - Kape - Modules - magnet-edd [1059021870734790777].html
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
f/White Lotus - Kape - Modules - magnet-edd [1059021870734790777].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
f/White Lotus - Kape - Modules - pecmd-sof-elk [1058861458642976919].html
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
f/White Lotus - Kape - Modules - pecmd-sof-elk [1058861458642976919].html
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
f/White Lotus - Kape - Modules - recmd-batch [1058860156454174850].html
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
f/White Lotus - Kape - Modules - recmd-batch [1058860156454174850].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
f/White Lotus - anti-forensics [1122106819377106984].html
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
f/White Lotus - anti-forensics [1122106819377106984].html
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
f/White Lotus - databases [1138541259695345674].html
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
f/White Lotus - databases [1138541259695345674].html
Resource
win10v2004-20240226-en
General
-
Target
f.rar
-
Size
552KB
-
MD5
8994428a36e84f0f4a958e490c4e3dec
-
SHA1
0bc866830fb82d79dfaa4784e5bbdabe4251f948
-
SHA256
6c269d134f3eb63b0f0416f8baece32420f343f9b6d728cbe6402fd56cd5fcb9
-
SHA512
dc7b2edbd45d1868536bb808bafb1ff3a2d0cb94d56bc14440a815800e3a031f42edfce22d97c62c69bc3f891e0e7a669de722bcb8242f8e3aa09baad5944433
-
SSDEEP
12288:0+57CEblsjHGSkuqAsJsawNkC35Y9wzYm/TzFl+eZ9dHxS:0+hCEbgmSkdJSFe9C10
Malware Config
Signatures
Files
-
f.rar.rar
-
f/Red Lotus - γ-γπ·πγ-γ - γπΊγπ³πππππππππ [1081576512106536960].html.html .js polyglot
-
f/White Lotus - DFIR courses - black-lotus-campaign [1177322117302341742].html.html .js polyglot
-
f/White Lotus - DFIR courses - blue-team [1152680804288311307].html.html .js polyglot
-
f/White Lotus - DFIR courses - jwt-attacks [1150542999332331532].html.html .js polyglot
-
f/White Lotus - KAPE - Manual - manual-parsing [1057990251907383326].html.html .js polyglot
-
f/White Lotus - Kape - Modules - evtxecmd [1058863474178003046].html.html .js polyglot
-
f/White Lotus - Kape - Modules - ezparsers [1058855998850334760].html.html .js polyglot
-
f/White Lotus - Kape - Modules - filesystem-2 [1058865730604519486].html.html .js polyglot
-
f/White Lotus - Kape - Modules - indxripper [1057892546216460368].html.html .js polyglot
-
f/White Lotus - Kape - Modules - jumplists [1057990719018647642].html.html .js polyglot
-
f/White Lotus - Kape - Modules - kape-magnet [1059020870691065887].html.html .js polyglot
-
f/White Lotus - Kape - Modules - magnet-edd [1059021870734790777].html.html .js polyglot
-
f/White Lotus - Kape - Modules - pecmd-sof-elk [1058861458642976919].html.html .js polyglot
-
f/White Lotus - Kape - Modules - recmd-batch [1058860156454174850].html.html .js polyglot
-
f/White Lotus - anti-forensics [1122106819377106984].html.html .js polyglot
-
f/White Lotus - databases [1138541259695345674].html.html .js polyglot
-
f/White Lotus - forensics [1138139271505649704].html.html .js polyglot
-
f/White Lotus - in-progress-stuff [1139251555049156719].html.html .js polyglot
-
f/White Lotus - kape - Targets - antivirus-compound [1057977764025741322].html.html .js polyglot
-
f/White Lotus - kape - Targets - appcompatpca [1058871575367139349].html.html .js polyglot
-
f/White Lotus - kape - Targets - execution-evidence [1057985390075711600].html.html .js polyglot
-
f/White Lotus - kape - Targets - filesystem [1057981265485234236].html.html .js polyglot
-
f/White Lotus - kape - Targets - recycle-compound [1057983273646706758].html.html .js polyglot
-
f/White Lotus - kape - Targets - sans-triangle [1057987421939179567].html.html .js polyglot
-
f/White Lotus - kape [1057891128306839574].html.html .js polyglot
-
f/White Lotus - methods - anticheat [1157396389622460577].html.html .js polyglot
-
f/White Lotus - methods - everycheat [1157392188003602493].html.html .js polyglot
-
f/White Lotus - stuff-stuff [1076556334457180271].html.html .js polyglot
-
f/White Lotus - things-ill-watch-so-that-you-kids-dont-have-to [1138146858305339472].html.html .js polyglot