General

  • Target

    GlassWire_Elite_3.3.678.rar

  • Size

    100.2MB

  • MD5

    298f33ca138ba50fb22f33868160e2f8

  • SHA1

    caf0a490bed643547ec7496d2cbc33cb9826ad8c

  • SHA256

    1f9455d68c1651186d92647fb12649d52586b0b4552b36a114bfcb772017ce63

  • SHA512

    4b789f8b35f913b51979c33f90cae0d115f2b97f2fd1856deb1d656805ca968ec14cfc8c754fd55a8c822ebdd087f5bfe3e825d2dff8cf63d424c2c47ecbd07f

  • SSDEEP

    1572864:9USa1N110Xc2nATGlXyJKda1VcynOVuU3FPJh1cTODXCNmHjV7GMQAVud:2Saz11tAiJKdaVxnOVL3x/CODdR7g

Score
7/10

Malware Config

Signatures

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • GlassWire_Elite_3.3.678.rar
    .rar

    Password: 123

  • Crack/GWCtlSrv.exe
    .exe windows:6 windows x86 arch:x86

    Password: 123

    857b71eab0bd451a0f66d57166f2b851


    Headers

    Imports

    Exports

    Sections

  • Crack/GlassWire.exe
    .exe windows:6 windows x86 arch:x86

    Password: 123

    8f40bc3b0302564283e2198aea75bc63


    Headers

    Imports

    Exports

    Sections

  • Crack/Read.txt
  • How to Install.txt
  • Setup/GlassWireSetup_3.3.678.exe
    .exe windows:4 windows x86 arch:x86

    Password: 123

    f4639a0b3116c2cfc71144b88a929cfd


    Headers

    Imports

    Sections

  • $APPDATA/GlassWire/share/storage.db
  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86

    Password: 123


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    646971a3aef724d6f553f40ae84fe26b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • $PLUGINSDIR/vc_redist.x86.exe
    .exe windows:5 windows x86 arch:x86

    1a5cdbf711fee14b077e599d13fddab2


    Code Sign

    Headers

    Imports

    Sections

  • GWCtlSrv.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWEventLog.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWIdlMon.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUnlock.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUpgradeMonitor.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GlassWire.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    92fc526ad6d9674f09604104cfa57819


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    443275a6eb00ad3c85c2bc9c3fc2da3e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5OpenGL.dll
    .dll windows:6 windows x86 arch:x86

    001e5e687428b22462285c2750754dae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    079b726a4a2f3a027f09f1cb4e2ed381


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    7485e296f2ad020a3dedc3de1b20dcfc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WinExtras.dll
    .dll windows:6 windows x86 arch:x86

    6a5932ee8dcef2f266e2e0e799f280b3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • copyrights/ASIO-LICENSE_1_0.txt
  • copyrights/CURL-COPYING.txt
  • copyrights/GEOIP-LICENSE.txt
  • copyrights/GEOLITE2-COPYRIGHT.txt
  • copyrights/GEOLITE2-LICENSE.txt
  • copyrights/LZ4-LICENSE.txt
  • copyrights/OPENSSL-LICENSE.txt
  • copyrights/PROTOBYUF-LICENSE.txt
  • copyrights/QT-LICENSE.GPL3-EXCEPT.txt
  • copyrights/QT-LICENSE.txt
  • copyrights/RAPIDJSON-LICENSE.txt
  • copyrights/RAPIDXML-LICENSE.txt
  • copyrights/RECOG-COPYING.txt
  • copyrights/RLOTTIE-COPYING.MIT.txt
  • copyrights/SQLITE-COPYING.txt
  • copyrights/ZLIB-LICENSE.txt
  • driver/win-x64/gwdrv.cat
  • driver/win-x64/gwdrv.inf
  • driver/win-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win-x86/gwdrv.cat
  • driver/win-x86/gwdrv.inf
  • driver/win-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x64/gwdrv.cat
  • driver/win7-x64/gwdrv.inf
  • driver/win7-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x86/gwdrv.cat
  • driver/win7-x86/gwdrv.inf
  • driver/win7-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • iconengines/qsvgicon.dll
    .dll windows:6 windows x86 arch:x86

    e2a8abb2f62e90497419fca861c4de3a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    b127d2b5eb2d64741e8cf3a684f53083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lang/de_de.qm
  • lang/en_gb.qm
  • lang/en_us.qm
  • lang/es_es.qm
  • lang/fr_fr.qm
  • lang/it_it.qm
  • lang/ja_jp.qm
  • lang/ko_kr.qm
  • lang/pl_pl.qm
  • lang/pt_br.qm
  • lang/ru_ru.qm
  • lang/tr_tr.qm
  • lang/zh_cn.qm
  • lang/zh_tw.qm
  • platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    29ed2e73839186c2a3b5a58cddc0eb48


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/windows.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections