General

  • Target

    Debug.rar

  • Size

    10.5MB

  • MD5

    f460853864da209e045bdbb88c610ec1

  • SHA1

    f758c0c64d54e0422bc7bd58e769ab7aac454241

  • SHA256

    3addcd45642e272504aa39219d01366e7bed21db57f384fb2811c7720431a66b

  • SHA512

    fd85b8349d83f8c0bbe67cfdd8c976a0e5b13825dd4b645b1459a4f531751133e2c4d51cc7df9cbc61d60a9fe75b8e40aa2fd852941a6ae9489fc556ee4b661c

  • SSDEEP

    196608:hX6qIMhBybC4WnmvzNdJdGuvrxmlNgJ2biokyvr/sWQtRY9yqx:VEMC4nmvzNX9vVmIsmVWBn

Score
10/10

Malware Config

Signatures

  • AgentTesla payload 1 IoCs
  • Agenttesla family
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • Debug.rar
    .rar
  • Debug/Federality.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Debug/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Web.WebView2.Core.xml
    .js .xml polyglot
  • Debug/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Web.WebView2.WinForms.xml
    .xml
  • Debug/Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Web.WebView2.Wpf.xml
    .xml
  • Debug/Monaco/Monaco.html
    .js
  • Debug/Monaco/base.txt
  • Debug/Monaco/classfunc.txt
  • Debug/Monaco/debug.log
  • Debug/Monaco/globalf.txt
  • Debug/Monaco/globalns.txt
  • Debug/Monaco/globalv.txt
  • Debug/Monaco/vs/base/worker/workerMain.js
    .js
  • Debug/Monaco/vs/basic-languages/bat/bat.js
  • Debug/Monaco/vs/basic-languages/coffee/coffee.js
  • Debug/Monaco/vs/basic-languages/cpp/cpp.js
  • Debug/Monaco/vs/basic-languages/csharp/csharp.js
  • Debug/Monaco/vs/basic-languages/csp/csp.js
  • Debug/Monaco/vs/basic-languages/css/css.js
  • Debug/Monaco/vs/basic-languages/dockerfile/dockerfile.js
  • Debug/Monaco/vs/basic-languages/fsharp/fsharp.js
  • Debug/Monaco/vs/basic-languages/go/go.js
  • Debug/Monaco/vs/basic-languages/handlebars/handlebars.js
    .js
  • Debug/Monaco/vs/basic-languages/html/html.js
    .js
  • Debug/Monaco/vs/basic-languages/ini/ini.js
  • Debug/Monaco/vs/basic-languages/java/java.js
  • Debug/Monaco/vs/basic-languages/less/less.js
  • Debug/Monaco/vs/basic-languages/lua/lua.js
  • Debug/Monaco/vs/basic-languages/markdown/markdown.js
    .js
  • Debug/Monaco/vs/basic-languages/msdax/msdax.js
  • Debug/Monaco/vs/basic-languages/mysql/mysql.js
  • Debug/Monaco/vs/basic-languages/objective-c/objective-c.js
  • Debug/Monaco/vs/basic-languages/pgsql/pgsql.js
  • Debug/Monaco/vs/basic-languages/php/php.js
  • Debug/Monaco/vs/basic-languages/postiats/postiats.js
  • Debug/Monaco/vs/basic-languages/powershell/powershell.js
  • Debug/Monaco/vs/basic-languages/pug/pug.js
  • Debug/Monaco/vs/basic-languages/python/python.js
  • Debug/Monaco/vs/basic-languages/r/r.js
  • Debug/Monaco/vs/basic-languages/razor/razor.js
    .js
  • Debug/Monaco/vs/basic-languages/redis/redis.js
  • Debug/Monaco/vs/basic-languages/redshift/redshift.js
  • Debug/Monaco/vs/basic-languages/ruby/ruby.js
  • Debug/Monaco/vs/basic-languages/rust/rust.js
  • Debug/Monaco/vs/basic-languages/sb/sb.js
  • Debug/Monaco/vs/basic-languages/scss/scss.js
  • Debug/Monaco/vs/basic-languages/solidity/solidity.js
  • Debug/Monaco/vs/basic-languages/sql/sql.js
  • Debug/Monaco/vs/basic-languages/st/st.js
  • Debug/Monaco/vs/basic-languages/swift/swift.js
  • Debug/Monaco/vs/basic-languages/vb/vb.js
  • Debug/Monaco/vs/basic-languages/xml/xml.js
  • Debug/Monaco/vs/basic-languages/yaml/yaml.js
  • Debug/Monaco/vs/editor/contrib/suggest/media/String_16x.svg
  • Debug/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
  • Debug/Monaco/vs/editor/editor.main.css
  • Debug/Monaco/vs/editor/editor.main.js
    .js
  • Debug/Monaco/vs/editor/editor.main.nls.de.js
  • Debug/Monaco/vs/editor/editor.main.nls.es.js
  • Debug/Monaco/vs/editor/editor.main.nls.fr.js
  • Debug/Monaco/vs/editor/editor.main.nls.it.js
  • Debug/Monaco/vs/editor/editor.main.nls.ja.js
  • Debug/Monaco/vs/editor/editor.main.nls.js
  • Debug/Monaco/vs/editor/editor.main.nls.ko.js
  • Debug/Monaco/vs/editor/editor.main.nls.ru.js
  • Debug/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • Debug/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • Debug/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
  • Debug/Monaco/vs/language/css/cssMode.js
    .js
  • Debug/Monaco/vs/language/css/cssWorker.js
    .js
  • Debug/Monaco/vs/language/html/htmlMode.js
    .js
  • Debug/Monaco/vs/language/html/htmlWorker.js
    .js
  • Debug/Monaco/vs/language/json/jsonMode.js
    .js
  • Debug/Monaco/vs/language/json/jsonWorker.js
    .js
  • Debug/Monaco/vs/language/typescript/lib/typescriptServices.js
    .js
  • Debug/Monaco/vs/language/typescript/tsMode.js
    .js
  • Debug/Monaco/vs/language/typescript/tsWorker.js
    .js
  • Debug/Monaco/vs/loader.js
    .js
  • Debug/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/WebView2Loader.dll
    .dll windows:5 windows x64 arch:x64

    3fd78a8f50b85b627af2d0fc485b5e97


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Debug/Wpf.Ui.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Debug/api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-runtime-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-stdio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/api-ms-win-crt-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Debug/bin/version.txt
  • Debug/cd57e4c171d6e8f5ea8b8f824a6a7316.dll
    .dll windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections

  • Debug/cpr.dll
    .dll windows:6 windows x64 arch:x64

    7bc8b32667f209b178f1f0635b6ee0d5


    Headers

    Imports

    Exports

    Sections

  • Debug/libcurl.dll
    .dll windows:6 windows x64 arch:x64

    9a4ddbe07217dde8376bb7c577388155


    Headers

    Imports

    Exports

    Sections

  • Debug/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Debug/runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Debug/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Debug/ws2_32.dll
    .dll windows:10 windows x64 arch:x64

    6eee61ef7874aa59d1a3452c72e61d5c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Debug/zlib1.dll
    .dll windows:4 windows x64 arch:x64

    9434905d51e7bf5f119cc9e5ee85d0da


    Headers

    Imports

    Exports

    Sections