S500RAT By WantHacks.zip
- SHA256 f9eace47e403fccd257952627a851f7a5405f42935c2b4565fbe3e42354dd013
Behavioral task
behavioral1
Sample
S500RAT By WantHacks/._cache_S500RAT.exe
Resource
win11-20240709-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
S500RAT By WantHacks/Plugins/Keylogger.exe
Resource
win11-20240709-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target S500RAT By WantHacks.zip
- Size 38.5MB
- Sample240720-1q1ehsxcqh
- SHA256 f9eace47e403fccd257952627a851f7a5405f42935c2b4565fbe3e42354dd013
- MD5 b641eab5c7d99d858e545a99f36ec4b5
- SHA1 ba7d9a5004a59ad397d21365ed61549cb28a8c92
- SHA512 fceb74deccf828d11f82a7fd624454aefa91e17389b39e98e17674daa4e016bb083ae7197628a8ba52145eceb7514d2899683077e688dc53598c95ddb5c68530
- SSDEEP 786432:t7UqhS1CzI+b5ck4MHc8RuboWJhZ1HYMZgUoRZXAEIy5sx5oKzn:toqhS1Cz3GkRc7sWhfqZQ+5snXzn
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/S500RAT By WantHacks/Guna.UI2.dll agile_net - Unsigned PE 48 IoCs
Checks for missing Authenticode signature.
resource unpack001/S500RAT By WantHacks/._cache_S500RAT.exe unpack001/S500RAT By WantHacks/BouncyCastle.Crypto.dll unpack001/S500RAT By WantHacks/Compression7zip.dll unpack001/S500RAT By WantHacks/FastColoredTextBox.dll unpack001/S500RAT By WantHacks/Gry73.dll unpack001/S500RAT By WantHacks/LiveCharts.Wpf.dll unpack001/S500RAT By WantHacks/LiveCharts.dll unpack001/S500RAT By WantHacks/MetroFramework.dll unpack001/S500RAT By WantHacks/Obfuscation.dll unpack001/S500RAT By WantHacks/Plugins/Audio.dll unpack001/S500RAT By WantHacks/Plugins/Chat.dll unpack001/S500RAT By WantHacks/Plugins/Discord.dll unpack001/S500RAT By WantHacks/Plugins/Extra.dll unpack001/S500RAT By WantHacks/Plugins/FileManager.dll unpack001/S500RAT By WantHacks/Plugins/FileSearcher.dll unpack001/S500RAT By WantHacks/Plugins/Fun.dll unpack001/S500RAT By WantHacks/Plugins/Information.dll unpack001/S500RAT By WantHacks/Plugins/Keylogger.exe unpack001/S500RAT By WantHacks/Plugins/Logger.dll unpack001/S500RAT By WantHacks/Plugins/MessagePackLib.dll unpack001/S500RAT By WantHacks/Plugins/Miscellaneous.dll unpack001/S500RAT By WantHacks/Plugins/Netstat.dll unpack001/S500RAT By WantHacks/Plugins/Options.dll unpack001/S500RAT By WantHacks/Plugins/ProcessManager.dll unpack001/S500RAT By WantHacks/Plugins/Recovery.dll unpack001/S500RAT By WantHacks/Plugins/Regedit.dll unpack001/S500RAT By WantHacks/Plugins/RemoteCamera.dll unpack001/S500RAT By WantHacks/Plugins/RemoteDesktop.dll unpack001/S500RAT By WantHacks/Plugins/ReverseProxy.dll unpack001/S500RAT By WantHacks/Plugins/SendFile.dll unpack001/S500RAT By WantHacks/Plugins/SendMemory.dll unpack001/S500RAT By WantHacks/Plugins/sc2.dll unpack001/S500RAT By WantHacks/QuickLZLibrary.dll unpack001/S500RAT By WantHacks/Socks5.dll unpack001/S500RAT By WantHacks/SunnyUI.Common.dll unpack001/S500RAT By WantHacks/SunnyUI.dll unpack001/S500RAT By WantHacks/Svg.dll unpack001/S500RAT By WantHacks/Tulpep.NotificationWindow.dll unpack001/S500RAT By WantHacks/Vestris.ResourceLib.dll unpack001/S500RAT By WantHacks/WinMic.dll unpack001/S500RAT By WantHacks/WinSound.dll unpack001/S500RAT By WantHacks/cGeoIp.dll unpack001/S500RAT By WantHacks/dnlib.dll unpack001/S500RAT By WantHacks/initialization.dll unpack001/S500RAT By WantHacks/lz4.AnyCPU.loader.dll unpack001/S500RAT By WantHacks/protobuf-net.dll unpack001/S500RAT By WantHacks/sc2.dll unpack001/S500RAT By WantHacks/zxing.dll
File Explorer
-
S500RAT By WantHacks.zip.zip 38.5MB
-
S500RAT By WantHacks/._cache_S500RAT.exe.exe 17.2MB
-
S500RAT By WantHacks/BouncyCastle.Crypto.dll.dll 2.5MB
-
S500RAT By WantHacks/Certificate/BackupCertificate.zip.zip 4KB
-
ServerCertificate.p124KB
-
S500RAT By WantHacks/Certificate/ServerCertificate.p124KB
-
S500RAT By WantHacks/Chrome.ico51KB
-
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/1.DAT794B
-
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/10.DAT63B
-
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/11.DAT57B
-
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/2.DAT666B
-
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/5.DAT346B
-
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/7.DAT538B
-
S500RAT By WantHacks/Compression7zip.dll.dll 40KB
-
S500RAT By WantHacks/FastColoredTextBox.dll.dll 298KB
-
S500RAT By WantHacks/Gry73.dll.dll 45KB
-
S500RAT By WantHacks/Guna.UI2.dll.dll 1.9MB
-
S500RAT By WantHacks/Important Note.txt265B
-
S500RAT By WantHacks/LiveCharts.Wpf.dll.dll 212KB
-
S500RAT By WantHacks/LiveCharts.dll.dll 148KB
-
S500RAT By WantHacks/Login.txt39B
-
S500RAT By WantHacks/MetroFramework.dll.dll 345KB
-
S500RAT By WantHacks/New Project 1.peu443B
-
S500RAT By WantHacks/Obfuscation.dll.dll 22KB
-
S500RAT By WantHacks/PLESAE READ ME 😁.txt2KB
-
S500RAT By WantHacks/Password.txt93B
-
S500RAT By WantHacks/Plugins/ActiveWindows.dll27KB
-
S500RAT By WantHacks/Plugins/Admin.dll31KB
-
S500RAT By WantHacks/Plugins/AntiMalware.dll29KB
-
S500RAT By WantHacks/Plugins/Audio.dll.dll 25KB
-
S500RAT By WantHacks/Plugins/BotsKiller.dll7KB
-
S500RAT By WantHacks/Plugins/Chat.dll.dll 456KB
-
S500RAT By WantHacks/Plugins/Clipboard.dll28KB
-
S500RAT By WantHacks/Plugins/Cmd.dll29KB
-
S500RAT By WantHacks/Plugins/DDos.dll29KB
-
S500RAT By WantHacks/Plugins/Discord.dll.dll 27KB
-
S500RAT By WantHacks/Plugins/DotNet.dll28KB
-
S500RAT By WantHacks/Plugins/Extra.dll.dll .ps1 34KB
-
S500RAT By WantHacks/Plugins/File Manager.dll41KB
-
S500RAT By WantHacks/Plugins/FileManager.dll.dll 34KB
-
S500RAT By WantHacks/Plugins/FileSearcher.dll.dll 280KB
-
S500RAT By WantHacks/Plugins/Fun.dll.dll 36KB
-
S500RAT By WantHacks/Plugins/HBrowser.dll49KB
-
S500RAT By WantHacks/Plugins/HRDP.dll37KB
-
S500RAT By WantHacks/Plugins/HVNC.dll61KB
-
S500RAT By WantHacks/Plugins/Helper.dll4.9MB
-
S500RAT By WantHacks/Plugins/HiddenApps.dll62KB
-
S500RAT By WantHacks/Plugins/HiddenProgram.dll42KB
-
S500RAT By WantHacks/Plugins/Hosts.dll27KB
-
S500RAT By WantHacks/Plugins/IconLib.dll56KB
-
S500RAT By WantHacks/Plugins/Information.dll.dll 27KB
-
S500RAT By WantHacks/Plugins/Installedsoftwares.dll28KB
-
S500RAT By WantHacks/Plugins/Keylogger.dll27KB
-
S500RAT By WantHacks/Plugins/Keylogger.exe.exe 10KB
-
S500RAT By WantHacks/Plugins/Logger.dll.dll 28KB
-
S500RAT By WantHacks/Plugins/MessageBox.dll27KB
-
S500RAT By WantHacks/Plugins/MessagePackLib.dll.dll 18KB
-
S500RAT By WantHacks/Plugins/Mic.dll84KB
-
S500RAT By WantHacks/Plugins/Mining.dll4.9MB
-
S500RAT By WantHacks/Plugins/Miscellaneous.dll.dll 85KB
-
S500RAT By WantHacks/Plugins/Netstat.dll.dll 27KB
-
S500RAT By WantHacks/Plugins/Options.dll.dll 377KB
-
S500RAT By WantHacks/Plugins/Password.dll47KB
-
S500RAT By WantHacks/Plugins/Powershell.dll29KB
-
S500RAT By WantHacks/Plugins/ProcessManager.dll.dll 27KB
-
S500RAT By WantHacks/Plugins/Ransomware.dll39KB
-
S500RAT By WantHacks/Plugins/Recovery.dll.dll 1.3MB
-
S500RAT By WantHacks/Plugins/RecoviryPasswords.dll46KB
-
S500RAT By WantHacks/Plugins/Regedit.dll.dll 282KB
-
S500RAT By WantHacks/Plugins/RegistryEditor.dll284KB
-
S500RAT By WantHacks/Plugins/RemoteCamera.dll.dll 109KB
-
S500RAT By WantHacks/Plugins/RemoteDesktop.dll.dll 37KB
-
S500RAT By WantHacks/Plugins/ReverseProxy.dll.dll 14KB
-
S500RAT By WantHacks/Plugins/SClient.dll26KB
-
S500RAT By WantHacks/Plugins/SendFile.dll.dll 28KB
-
S500RAT By WantHacks/Plugins/SendMemory.dll.dll 30KB
-
S500RAT By WantHacks/Plugins/Services.dll28KB
-
S500RAT By WantHacks/Plugins/Startup.dll32KB
-
S500RAT By WantHacks/Plugins/StreamLib.dll14KB
-
S500RAT By WantHacks/Plugins/TCPConnection.dll26KB
-
S500RAT By WantHacks/Plugins/TaskManager.dll27KB
-
S500RAT By WantHacks/Plugins/USBSpread.dll11KB
-
S500RAT By WantHacks/Plugins/User ID.dll39KB
-
S500RAT By WantHacks/Plugins/WiFi.dll25KB
-
S500RAT By WantHacks/Plugins/lz4.AnyCPU.loader.dll985KB
-
S500RAT By WantHacks/Plugins/protobuf-net.dll278KB
-
S500RAT By WantHacks/Plugins/sc2.dll.dll 19KB
-
S500RAT By WantHacks/QuickLZLibrary.dll.dll 7KB
-
S500RAT By WantHacks/S500RAT.ico54KB
-
S500RAT By WantHacks/Socks5.dll.dll 45KB
-
S500RAT By WantHacks/SunnyUI.Common.dll.dll 221KB
-
S500RAT By WantHacks/SunnyUI.dll.dll 2.2MB
-
S500RAT By WantHacks/Svg.dll.dll 584KB
-
S500RAT By WantHacks/Terror/1.gif.gif 843KB
-
S500RAT By WantHacks/Terror/2.gif.gif 1.9MB
-
S500RAT By WantHacks/Terror/3.gif.gif 437KB
-
S500RAT By WantHacks/Terror/4.gif.gif 2.0MB
-
S500RAT By WantHacks/Terror/T.wav1.7MB
-
S500RAT By WantHacks/Thumbs.db59KB
-
S500RAT By WantHacks/Tulpep.NotificationWindow.dll.dll 28KB
-
S500RAT By WantHacks/Vestris.ResourceLib.dll.dll 76KB
-
S500RAT By WantHacks/WinMic.dll.dll 19KB
-
S500RAT By WantHacks/WinSound.dll.dll 45KB
-
S500RAT By WantHacks/cGeoIp.dll.dll 2.3MB
-
S500RAT By WantHacks/dnlib.dll.dll 1.1MB
-
S500RAT By WantHacks/initialization.dll.dll 19KB
-
S500RAT By WantHacks/lz4.AnyCPU.loader.dll.dll 985KB
-
S500RAT By WantHacks/protobuf-net.dll.dll 278KB
-
S500RAT By WantHacks/sc2.dll.dll 19KB
-
S500RAT By WantHacks/settings.xml68B
-
S500RAT By WantHacks/zxing.dll.dll 420KB
S500RAT By WantHacks/._cache_S500RAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 02c370db69059ca56ef2346846ec0a23f4e56185a9c13f50a13dd0db894e2d0c
- MD5 22e3b5c6b876c3a3195301daa78a74c9
- SHA1 120e4286764977253acf63d7db8bb33880c3f8d2
- SHA512 ce3e51c28a87cdff9c6531b8f4ac321c91a8fb2b31eb0fd03b19da8aaea4d040c755585c488c3446a5cfb843b60a8c28998f3babfc3e2bce47d4e8d6af46401d
- SSDEEP 196608:ch0y2MuVNz+KorG0y2MuVNz+Kk0y2MuVNz+KN0y2MuVNz+KLiQB7Z0/slzLIEu:ydQVNIGdQVNAdQVNRdQVNfBd+2Lk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17560062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Data\MyFolder\MyProject\Saved\S500RAT\S500RAT\S500RAT\obj\Debug\S500RAT.pdb
mscoree
_CorExeMain
Name
.text
Size
16.7MB
Virtual Size
16.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
503KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5530dff976bc0c889076b97ca695bdb97ef07f63449d32f893ed32398ed8bfe6
- MD5 3551343fab213740bbb022e3a6dcf27b
- SHA1 de67fb4f9d58db4a860a703c8d1f54ff00ff9b1f
- SHA512 e90f51053e1d4b0ea1f7458229de92174abf0781c766290da4de5cc8dfcfb730998252bf28b36ca5070978fdcea8b97f0aea6a47b875dd34173643ac0cb46c42
- SSDEEP 49152:3CTzhVM0AU5d3UOhq8hmReOUJfd5T3D+VTQlgQeCKbu9kQLO0:GwU5d3vhzhmoOmfd5rqX0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2567326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Certificate/BackupCertificate.zip
- SHA256 aa47b4b80aec3e190c16b45f72b4aa2e753bcd74edad1f3ed025db5810fb81ee
- MD5 93c67262896f554a57f40ac6a87ac5ac
- SHA1 2ce672975634c6ca5fd0ad8c025a3e6a9cff001c
- SHA512 a3ea32bfdd3d7c62a334ad5671379c8c038b38493387655085965d05c663243fa5dfba91579a227a820dad7ea5b6dd4a759f05e0753489a491e8e0aca8c2dbeb
- SSDEEP 96:JDJHsxApfocFzYGmB8tJyP9bgH+n+ZZ/OmHtdmX3sz2tu7s/jXjn:dJ1fVkGrPMMDZ8SmXDtQcn
- MD5 SHA1 SHA512 SSDEEP
ServerCertificate.p12
- SHA256 35c46a9e9dc60a74a25572e743794a31fecd08672813d349a39f2d13b01e789f
- MD5 c60e527a85f285ddc66c2fcf160b1be7
- SHA1 abcf2b6bffea9f0f30190783f6eae2434ef7a9a8
- SHA512 77a661544c2d7f2d8b870cdd503b806aea6de3a2b5aee19327c05aeef137a1df3661d249219fe73e7a300189c732efeb5d2004226c6e429fa024f1d3b1dec84e
- SSDEEP 96:Bg3dj4eUJGlzCDRcFsrRekSnag87hPSlpzPf/qesFlP:BUdce6qFsEkSajKX/qesFlP
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Certificate/ServerCertificate.p12
- SHA256 35c46a9e9dc60a74a25572e743794a31fecd08672813d349a39f2d13b01e789f
- MD5 c60e527a85f285ddc66c2fcf160b1be7
- SHA1 abcf2b6bffea9f0f30190783f6eae2434ef7a9a8
- SHA512 77a661544c2d7f2d8b870cdd503b806aea6de3a2b5aee19327c05aeef137a1df3661d249219fe73e7a300189c732efeb5d2004226c6e429fa024f1d3b1dec84e
- SSDEEP 96:Bg3dj4eUJGlzCDRcFsrRekSnag87hPSlpzPf/qesFlP:BUdce6qFsEkSajKX/qesFlP
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Chrome.ico
- SHA256 c1d85b8ffdd3726a9e61cb68d629d9e41d838c40c59cfdcda6b029d1fe7074ae
- MD5 ca95222e24944acc15a96c96cc5db7ca
- SHA1 29ba85142cf24c37ca464e6340c5e339ceee0021
- SHA512 fb4368212a65179cefd69de269e750ac45bb2030569b918c82e899a937f2b24a1d6c20f86afd1b46dc38abf9a35542e8eb158a3b4302e3b75ca1fc9ab360b94d
- SSDEEP 1536:kRdFTLxqsTJY6+r7VYo6HIGCKjYH3NWka:kRD/VO6+fh4IGCkC3cka
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/1.DAT
- SHA256 47d6894fcf10f69156dd4c2a539a6cf4d2416f381323dbeee98d726898161926
- MD5 e72ea6ee5f81b2579db75341461ce218
- SHA1 b0c52aaae5ac55227ceffc9f9dec42eea91b03d7
- SHA512 4f38f56b379f645d5a2d4ca4960968635b6b519b6f1cddda4f7eac71e9bfa68a9646354a7dd5b9555f40d3e465f2f29cecd57ee7d8f46a490d74aa8b2b2f245e
- MD5 SHA1 SHA512
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/10.DAT
- SHA256 fa20c65cede6bf713558bf0e414f143eba867200f403d81ff925a7fbb4abe27f
- MD5 e02614774c2b76fa8b2952a600d9e849
- SHA1 8854405c2cce46692665cd0c7e5ae45fcdd3cfc4
- SHA512 2de667e207584c92a25de0b6c535fce53c167f767f426e17d2aa91918ed659f7028cbede240bdc375ce494c631d84ad56aae5b32030e8197cb735097d5594189
- MD5 SHA1 SHA512
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/11.DAT
- SHA256 63989d2c823b00ba0f177c21e9bb1a630af7d78043044bab041dc2773c8fb56a
- MD5 bec83826416474dffa74487d232f4ee4
- SHA1 3094f9f958ed6322b2b3c4a8ef113bc38b83c496
- SHA512 b1edc377a36555b6b7777c92f0a1eb8275aca922fa9c88e74a7401eb940cda0e84a9014a7fa862b1257679c26525dd850947788fee17b5b83b3589977812db6c
- MD5 SHA1 SHA512
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/2.DAT
- SHA256 0c5f386d2e826aa35bd252638054cbbd29806029035132f08ee04c15d991fb0f
- MD5 9f24e6f68d81f76ddbc25cc67d2eb866
- SHA1 9efcb426dcd09c608cd0007a2032ff1f38d9af15
- SHA512 30be04433bb0b10157f0b8f9aaa59b097c0b3d782c8d2fe7d32499f9062e91b0b7f40b7f20f5c402ead5e0d91f61d530b6ca205b81446359ce7a5c5d9c6a2318
- MD5 SHA1 SHA512
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/5.DAT
- SHA256 089e38e55f1d8e995611d62edaaadfbe783744c63dfcc3654d97cd08aa202343
- MD5 08fd16348570b52c207fd2a0908b4cba
- SHA1 0be5828659c2aab82beb8af1b42a4c773a050d0b
- SHA512 02b6f93b47d8d0be4dcbdca891c6ad40b2eefb3a25c616951a851362aa19159ca2422ebc548166eb9a3f1a758e8eb6b9035014fd8be07a4b6bbcfde0b321e3a7
- MD5 SHA1 SHA512
S500RAT By WantHacks/Clients/Downloads/A82871D5B4CE1A95/7.DAT
- SHA256 1281d6bbe6daac1de8c243fd73024857094af18b05bf836f3f5c10d5064655f6
- MD5 fcc72ffb5a586e4b05b689cf89438fbd
- SHA1 2a99b6a4d2c677a2ae6252684459288cf871ece7
- SHA512 4b8b7e4e9febed4652b3ed0fe96cb23a61aab4cfac2f5b9b4b71cb975b95f36e7c41e156973a0be9a01479270a7d82eaee521a9a6140b3398e69b2ed4d32da21
- MD5 SHA1 SHA512
S500RAT By WantHacks/Compression7zip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1c167173ee4f36732bec73ac19fd774b3bd606c8c5d46cd35194093f642b711c
- MD5 cbc44e5fc144b9e998b1d98452a87c06
- SHA1 b1dd5c67f1e37bf1b40ca5abb031899a09798b1d
- SHA512 38fce2c86225115d7aa19fadb5567fbfee4a75e30a93440d0ae0ca800767ad27e3689de0a9a953f79f5bfa16aba5ad232cad4154889f510b51ef32185f6a4fdc
- SSDEEP 768:eGDJdsdPCIxoHXNo2/z/heU/FLlPRnHdytMnRixGpiLuqAdIkUlGAxrID/Pve7E9:tDJdT/9eU/FJZnvBhq7k1Xve72
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\S500RAT\S500RAT\Compression7zip\obj\Release\Compression7zip.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f9d26773e9a13779c4e1cd498ba484f31d2459df4cdfbb274919c316a8825b0
- MD5 020afdfc4f034027354b9f33fe0900cb
- SHA1 cf323c82de0ce24147033008d086a380a9f04868
- SHA512 02c97d3361a365396b6eab5d09213330609f37a6f233d86fd7cb9859d1e7622a9d81d2a9201223703f510974d42a97596b16d0945cd34ba1ecd31d3760c68ea8
- SSDEEP 6144:Z/P+T2FFt0aWXsA7m25bmxbLampiI/nlsqJLDd5eNrgs:J+TuroVmRlb4IvZeNs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
310562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\DZ\Desktop\FastColoredTextBox-master\FastColoredTextBox\obj\Release\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
295KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Gry73.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21f68f41aadfc44c994ef9a4394d910250a4c9e43f4d8c43b3015f5390014819
- MD5 b3d076f3125fa03d8f97a9fef0b42a5e
- SHA1 3f4ef3de41a8f3b7adcf79cc031fb4de12265304
- SHA512 27ab2e34c44a720a6f836d5892dcf1cb426bc20bced7e218799a7d6cf57b5e1e8719e3bb580a5d1be623e91a5e9333298541395d774bf6af4fdeacf855867f13
- SSDEEP 768:PX5Ii8RZqHCPLq6vt/3pjsK/ZvT+T84o4snonmeTz6dXJyZ:PX28CDq63pjsKtaT8nXC/TkXJi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\S500RAT\S500RAT\Helper\Gry73\obj\Release\Gry73.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf9b66e11506fa431849350c0cb58430a71e5ec943d2db9ef1b2e2302f299443
- MD5 0f07705bd42d86d77dab085c42775244
- SHA1 7e4b5c367183f4753a8d610e353c458c3def3888
- SHA512 851b1a4c470ee7fe07ce5619c16fd391428585926c5b559694a9e445633ea51ec86c74a3bbf3bce39d943c4bf714dad2fd3c4a4d0703be2333541c79a2ee97f0
- SSDEEP 24576:m8Yq6KN2liAVp0j4DuJPbTzcH7DlktjfEzgKxGgcKM8Q3xajfgY236RYgPNsP:drCqfE0KctKM8Qv6RYgPY
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
PE Signature issue
Digest
fe:92:fd:79:78:5b:a1:7b:fc:09:41:72:94:be:f3:50:c7:5a:02:fb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 4, 2020
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
2022430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Projects\Guna.UI2\Build\Guna.UI2.WinForms\build\nuget\Guna.UI2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Important Note.txt
- SHA256 397e1922d75c8cb559ddf878aafbebaddf41d86834e143b8c2a4193bfd898d57
- MD5 2eac5ed0a7d6d3968974580ce55c1a5c
- SHA1 ed43baeccbc509d827e0b61451a640195d9d3761
- SHA512 23bff6932e89d5028b51b9c718525a1d34b171da44ea3a281b416016aa36b61df9869dc49e95834ae2f5f5a58118330c08551c40ff5aafd5f23b62ae71eff99d
- MD5 SHA1 SHA512
S500RAT By WantHacks/LiveCharts.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b
- MD5 e924f79f0b5f3e79c98477d75831813d
- SHA1 64f71e20e1953b13c771d8a8e63549ad6d64216e
- SHA512 063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1
- SSDEEP 6144:d/vd0eaDQcUc0GkiTV3bkACA3AloBtefVt+aA2xgKPo1zlW1w:vaErjGkiTV3bkACA3AloBtefVt+aAGBF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
223486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Users\btord\Documents\Projects\LiveCharts\WpfView\obj\Release\LiveCharts.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/LiveCharts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca
- MD5 9642899636959b7fc89bf34a8b998a90
- SHA1 479a0254d1c9e5565c7d861bb77f54b7eae50c96
- SHA512 435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2
- SSDEEP 3072:saegvMNVoz3Vlw6/R3z3MV1IdJJGVKWHC2KdxFFT9lzo:VFJlwYMVWY65z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
158158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Users\btord\Documents\Projects\LiveCharts\Core40\obj\Release\LiveCharts.pdb
mscoree
_CorDllMain
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Login.txt
- SHA256 27fee13d59e00bca115c2362d72624316a8c7511b5b1c78893c191c8054a55e5
- MD5 0ea2714018f0d56043ab9cafb98726ff
- SHA1 da92fea194db7cca05ff23071d8a0e90fdd2fe47
- SHA512 c4cd0fa6d722f2ab8e6ea01ec30f58627d3ab08f386fb2881fae2569972277b56d49c650c43ca9cd1c84bb6caab5392d898455c2e89a834178e502c144570a21
- MD5 SHA1 SHA512
S500RAT By WantHacks/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/New Project 1.peu
- SHA256 710e84a71b6b2e817c253be41b73f3d61fd518a40678fbd7422297cc82b08285
- MD5 f56afe14318c5715476690121c6fa574
- SHA1 c5ca36b55ea653d05ee04cc4a02e1d03c2746c8c
- SHA512 406098cd799834083c764cad7e3e9ad3047a4433593c9b0a537977825e59408b7b6a7931edbd357ea28ac776bf4324c7d0f29bc047f24236715ab9b7aedd33c2
- MD5 SHA1 SHA512
S500RAT By WantHacks/Obfuscation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8cb9ede1fd8c60691503b77c3ef52b35881a2555057cb5557341cd8c89e752de
- MD5 0dac4ba4180115bcbafced522b94970a
- SHA1 d70457578f3e0db24ecab84323854c7c7a724f61
- SHA512 b27329c07ed0f671aa109cdd49d2c32d84031dc64a290f9447864aee0975cc0662179f0c684c5feacb6ca7f99b9eb483bbc74a79234c741f69efeff76ad0c87a
- SSDEEP 384:KTvtklEbiXejlVExwehhLzb5s5TbRRyLGv4Jv7ZEIbioxY:lEbiSPExZhV4BvQzZE/oxY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\S500\Obfuscation\obj\Debug\Obfuscation.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/PLESAE READ ME 😁.txt
- SHA256 0713424c7f4a1f6f401fb820242b3e80abbd1b6e49ee515259585afade70c855
- MD5 d6ff9a79abacd0096a9ca4c049ca3aa8
- SHA1 6f12f69849be1a7da81264fbd05eab686bcab85b
- SHA512 859238b9824facbe7b8b03fbca94b5395d30e226b5ef0db556c3c1d1dfd22d875f7c8a74a3adfd37366071ed9ec0af23ddf3059133c27592011359ae7e5a4637
- MD5 SHA1 SHA512
S500RAT By WantHacks/Password.txt
- SHA256 5d2610a60c22eefeaece6700d46ea93eb9d7637b32466ba8d1aae78b91478cd8
- MD5 9a60b3cf8ebdaaabbd649cb69e614539
- SHA1 a3ebeeb7b7c13438e8bec000a4251eb4be9bd43e
- SHA512 9995d9f919aef1e57c363a736089f696f6ed2d5cbd1704f5beb70f377b21c97056f3efc4cfbaf6048c5dc2bb34cd16f738e531450b50f112beda05f63acc5cc2
- MD5 SHA1 SHA512
S500RAT By WantHacks/Plugins/ActiveWindows.dll
- SHA256 3b67b9994db3b22a1ffe4c5ac7be974d1470e9892c0ce2fdc4aa1fdce6529f04
- MD5 11667dcbb0c3f4a2cabbb7e749abb8e4
- SHA1 aa265341eabf7a2b7f87aff44bcd74cd018fb5f9
- SHA512 04c6e179f11866e83d6fc931585e35314496a9df2420f3d10ef007a7f8ede282ae3ba30f704c67dc5f8702a8d7cdf8aca759df6df0d0bac4bfbbc599b5e88ba1
- SSDEEP 768:D2uI+GQ6Ztlf/Ws8NXtu8qzDi/NxnTj07Hg9RBZw/Bo:CrFZn98Ndu8qzDi/PnPcHoRBuZo
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Admin.dll
- SHA256 af2ec6aececa142de44371908980aa041ce3d51e4ccae151fcd86a7db8b2a384
- MD5 fc4a2c1fe09bad3c45b1667dbc5ee1e3
- SHA1 c8b48aeebc2701b604519860c8eb58d7d60b0523
- SHA512 dab8dda902d1e05f63a8ac9cb4afae8d204d2d678aa5a9def15495297787df3d75d21ae035cc24a80a7edd5bbd939727aa7feea217c2f4896073956e13b0792d
- SSDEEP 768:eRgZyI4Ph/U6d0vZxnrXCzt1tqvlbZQHX477fQtPS5j4p:fB4PzNil164cp
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/AntiMalware.dll
- SHA256 cd7ce00deaca14e500ab16c18164f11483a04b9e9b5ab5c6cdf87df42fefe608
- MD5 5597ca467d7b6e8ba3571c4bb052b586
- SHA1 375ae43aa132d705c392253fe08139d996a10a31
- SHA512 c8938c27019ebd1d55502ac66c21a22219f815a11640d3380c00733afa4ae850860d47c3e2a47bbd4651f3267d0d5343f484dcf36653fcde64c12215f615f382
- SSDEEP 768:kWJR0JPaDQbRvCYIVkFIY8B1VV123MhsLiYlsU:VJIbRUVJXV0l2ef
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Audio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1323a7212239513270077e07cb436af721acedb0c21c99b06c163a230baaa50a
- MD5 025864d133e416f144030cf22ea9f2c3
- SHA1 6be2cb2454335f0de00799000f65c5cee796c185
- SHA512 ccda6ef9847f89e53adaa637c7f762be22506b8b6bd2a5538b6622c33f3244f9c491e39e7df7512b5edced3d0395e4541b182f7da6a254b8891b9d64d71538b2
- SSDEEP 384:si+z4JdSCmRO5Gw5ZGuC0CWdseXGKfZ0CDzukNpLQ3s6XXLca78nOtX:7zJds45GwRC63lF27AOtX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Audio.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/BotsKiller.dll
- SHA256 44c3d6fb2e8bbc241955524bdaca1b6a90548e8769b9945cee50ba1fb35041ca
- MD5 30e2fb2bc2a5860fd32fafb285401ee1
- SHA1 57f9f8814bea72c06ca924ec08455b8aac351112
- SHA512 bfce9a9700d298fded24502775c6508cee31a7e2d65e66bb1a1c9016b1e8e7c173c7f2607e295843afda49aa02070b2e75b60e51b4b3753c4105de87edc6924c
- SSDEEP 192:JwOwaWTCJfRyRmvXHMFd2OsOGd/l4oI5/rodYHR6:JwxCJf4ZFwVhb+mW6
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dfa246c2763bf5df442a81128b3587f7bf530e4327f631cdd4dd79106738cf31
- MD5 8fc1192cf52f55ed5efb5e12210a37bf
- SHA1 dbcf714d0d9b0fe44bdfe2ee150227c2a0e7c387
- SHA512 74603de6069cc6bf02afa5cfc3ba1493240bcb7c74fcbd53219448134b79fb5ebefc1dec61ac4c6a04c56dc6d986887a4a68d87ae1dc07ba6d1d8b8afc9d480c
- SSDEEP 6144:CtBlKJ+p4JX0cZsaB6N83r2y/plBWnxfID/uKNlNQ7fOiLXyCrxO9w+KQqxe/tT:CVKTkcZBB6NKbBWnxfIvNr4siQqx4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
472838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
454KB
Virtual Size
453KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Clipboard.dll
- SHA256 4ffd6a2c22293204ff1d9ea606d5398ac0286a2ed4a3f251eb0f248bb90ae6de
- MD5 b0ba61981f5f7b8ec9929e240b81e6be
- SHA1 36cac974e67146631bdeb0d89d5602c1b9120c66
- SHA512 84b228da4074545bd18df46c1dca268069066132d6f7b27a5a62ba9b770402030f4c7fcf73c980565f0b1aa47fb13f0d1fd012e06bb213580fe9bda1a650a8fd
- SSDEEP 768:7q23iUSHtiLxhdEvgtEGcJsU21J5+xa7QPXYt24XhdT9m:CHtijO2HZU2bsISI24xdM
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Cmd.dll
- SHA256 8a87fc821f1c3f6931cb7f908a247fcc2f83ff97b72d95519ad87f924c21b532
- MD5 79da3973167c94db5eb3248d570a059b
- SHA1 86eea216c64e84ad1f1189587320eb7c1e2230d9
- SHA512 97174313d64bae3069bfe9cdd226c9f19221c9c0d408b0ba7431d29e78422aec8cb8adfaf1931a653723b9fce40e447a48d411b1684c566d8253356b1ce6da6a
- SSDEEP 384:J10x7JfgKLW1DfAZJjCVNuUCTL9lYzUp51n9AsjFeKYSEkzrQ/KJWC+efBTQQN:r2JqBqJjBNpX/jUkmLuJTd
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/DDos.dll
- SHA256 4adf534e3a7ab6b52c273e31bb25261bd11b421fc081879f910ec8f534945826
- MD5 530b896b08efbcf8d31a3525c7f3e306
- SHA1 7095c06aa3773e92a58522ee17684bf222589ac1
- SHA512 d0e39def94795c2471c2fd5cfeb3fc86b46c4242df093a4562a2629eadbc1de7a116503878df57ac884565252017a4fa7c475678b7971b68e7f660007e9372a8
- SSDEEP 768:BeCWvMP+oqoI2uKV8ThO7Hn5lC4w8Yi5F6XKOO:BeCpPfqoI2ucEO7Z31Y4gm
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Discord.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a43095314d5e32db307eef638d2f5afea7dd40ff6acda24fc28ce0c1632cb6a
- MD5 b591cff18fd7344243cf8a4eca624a65
- SHA1 29f9134bb33d429d27b87e6f2112b6753e1dcae4
- SHA512 ae1aa8db37182a4b8ee06249da6304c1c105adf06b2091cf24b3e79ad1d6d1a6eaab12bf059cd86deb04b7084d563a25d5bbef6ddf7857c1a34fc0e0032664fc
- SSDEEP 384:HfzPwa/ppmIwuCfMeSmfbQFFVBdseXG3cGh+JaL6lkSggL5XxXIUdwmuJpSVmlY2:HhGIwhPgh0Jd+5XxjwmuJpSV/I7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Discord.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/DotNet.dll
- SHA256 86b808d7fc05a7c0f81791e19850ab312ce0a8d0c73ab6e57bd759c56fd4e7fb
- MD5 7bed5f9fd85dbd250423c7f2e7b0f0f4
- SHA1 633b27de3913bb1d6efbe2b32df4663138af2137
- SHA512 c74224c22b6931ffd11cdbe48d8c83765747e6a27a89ec0f511b128e5e3d1753d80a0116cc14654ddeb0237138a92fdc0392987650c936126384331e5e86de59
- SSDEEP 384:J8iguvx9gxoqVzbsJqsUAAYld3wVQd/SplkPLppWNu4oksAzkhojvE0ChR4YooQw:WiBfu0vr6/kPLfWN/oks5SvEfhR4YoM
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dae673b838de497c1aa8a558d4dd5963d90e8b21538cb0d9adce585ef6fbc915
- MD5 17db58471bf45715ba46b5af7920d676
- SHA1 0ab236a6d554597dac8fc40fc3e1a29f905c0275
- SHA512 29432c0d19be6ae8c8ab68ab1a7c4007d502222b329f9a0bfb994427f182028aeeacc199dd27334cdc0adabbdee7a07a3d24826ed67b05711c2370a4b7395265
- SSDEEP 384:0hfLE8JhqmxGhnGOheE6qCtdKudseXG5JN2ahDkz7R3bu6jUwv5YacMvvp8D5K8:wQ8hxGWCkQuMPkv5YdAva9IKqbnMK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Extra.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/File Manager.dll
- SHA256 d92054c707c046d206b0067a789b822bba65a53fe6052ff174f9d3743053f6c1
- MD5 409f91cda95ea16ac662853af480c082
- SHA1 8e896a81bbdbec745adf493ebf3ac6c0407476fb
- SHA512 166ae3ee24ca1c504b6307d68fe7a4440bd2798ab258327b886ba6a7b9d62ce2f5d34ba45cde4be401d5c5888b45da37bd6588a10fc3a6e81a9e2769e24f6f02
- SSDEEP 768:+AlPMf7Ob86SpiS2JRLYggY697aabVlDtukF9f:+KMf7t92/LYG6Nuy
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 50f93055604c7418fa0e5536afd0b4d535db752b5e7edf588cbc14c1570613a1
- MD5 dab76ee6ff2548a9bd45c0e582f4d90a
- SHA1 70b0e615c1728aa8198dd4be4899fd883bffa1d9
- SHA512 431f38a2b08c5d9f9914a05eca7a32084b3b33d473cedb91904776417c49d8599ec81c905a857a118e8d6b39a200accd14b1c21a35b1faea760084fd75967501
- SSDEEP 384:V/fLIMFZcuWQHBVugXvYhXmovTuC/Jn/KddseXG/htVhD8mouoFFAEFuc0oOJPtp:9pBQ2ovTZ/kdczcFhntYtny1l1E
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a91d0552200064646768b1fcd393568ca6144279ef0543aee6a74c4d11c34f49
- MD5 a186a27b6e893b60bf236120a6a329a7
- SHA1 9186d71d524f2716c7ad3e934e134aa68366006e
- SHA512 f5acc60bdcf71eea700af6c6372e68d58cac1008a6fc2850dcde1c59310cb84527725740f646be4a146adde6f0878781101670ce922c3566b34262da857aa847
- SSDEEP 3072:OUI94v0G+OSJqB7OOaJOqX8s28ccc9k16uLWcSCSLeNYcEeI/KQ73WmbaC4nRZkp:YKWOaG4X5S9k1zbB6YF6X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
292330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
278KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2b25c33a033bdc85ea4db8c3ea89bbfc7d1a1dd80d21a1835bba5672759efdd9
- MD5 e07004ec43ed994b9a11999145f5a43a
- SHA1 00cba09ae5a38dcfdbac1a8cff9cd1fff2c0b3e7
- SHA512 39948577cf0185ffbda3c2757c7fa746e41a169ca7fa0a3718cc564fbbec439b047bc540fbd5ac59908965424ef11f6564d9795b101bfc58656247e76b0c88f5
- SSDEEP 384:T7fLviWK1Xr4GtVmEc6BktslnlrqKQdseXGtrR52bhimwy0Xprnhc4r/f7rpVqKX:fGXFEGtMqS2lnhQk95Z3nhXrLDUCE+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/HBrowser.dll
- SHA256 41c6c5a8ebb41572e4903908a23080c1ecd7386ae0131f4fe87f2a8e14df336a
- MD5 f8e8db566e4ad2924b8973ea2218f2c6
- SHA1 550e9886e568470634bb188d5168b884de8ad533
- SHA512 8f7d90e5945c7df3b700c88896171b228478d56ee30d92b26e60c52d1bd0fcbdcd8bccfcfeb83d94781b978e8279050107e12bdc75e15b89c31bd31af748c923
- SSDEEP 1536:VfZXWU5S35MH8h4EjhFjyUitZobiXSrk/jg:VfZXL5mMwJjhMUumbq2k/jg
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/HRDP.dll
- SHA256 63e05c9a64641ce9ce3620293be5e1cf5d8afe8d91982375f7e466e1450b30a4
- MD5 4f3be09a3f000e5d717d698819311000
- SHA1 5e809e1be7858bff5e01adf20565a4985edca219
- SHA512 5a8fa8e0d0bfdbc81b91081bb8789da97a606d267432b4d09e888ef89356ec954057136e590cc7db6be125195c0f2ad1568116f56f47bcd7f581739effc292a8
- SSDEEP 768:Bb3CzsCncWFVqOs0wXLAxpR+l9z85Z7gYe2xxSgTlNiIae+EgkbE:BTCQCntT3bwXLAxM10Z75QgTlNiIH+E0
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/HVNC.dll
- SHA256 6ec1d49bfa973b66338c934bb8fda569a043dcb6e2227b8ab981b78b487f7f35
- MD5 720a634bae36d002f4b09121a82416c4
- SHA1 7c34ada39645c8d063c6bb62af391e29638a6bac
- SHA512 4f926ad7a5d1d242449fcdc6c8fa8e55cb98adca418b30840e9e2c7da2e1102cd5faaf130e5834622cc55fdb3c6a2efcc9913abf1b1ee913dc78b89fb771801b
- SSDEEP 1536:yVqfjO1mo9BnOSqyHUTbZ92DrsZxbCNqDx9HFuLrqQD7fXpLPCsWcx:ysfaA8BjCZ9SqbUqNFELrqipPYi
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Helper.dll
- SHA256 6e64b6d381f2563c2abba6579fd0f25a931064ac2af4504f54b15f7349a36c5f
- MD5 8223e618f64eaca49051c29a29dda4a1
- SHA1 1f580c7a25335d598f4e90f8a959c9e7c945f9da
- SHA512 ee513d55d2030b709c4392947b9e89cf855cbdcee17826e1b36d1a9a927a41345035f5799b21c9643aa2e0f801443a03b5b328239ba4724a01f2e77d4e79146c
- SSDEEP 98304:d469N4aCilxKh8P82fnQuTmI22YBvYImca1B4IU6ZRxvRbz:FX4aCif/uIEAIna1B44RxvRbz
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/HiddenApps.dll
- SHA256 77ec9e338acbcced0cd5fae1556ca26ec8d4c493062d27b19f5760938c99e8a9
- MD5 1f85a383f7dfd4b2ad5a231f46bf3533
- SHA1 2cda68c2949471a4e943de65c0b807b0c3288d75
- SHA512 8b17f93a0205f7ea991e147600c647647c3ab3c04bc73701c78abbc483723d8628fd1551818ea0db5a49be875f033be42fe0e763e15fca39cdfe303bf9797232
- SSDEEP 1536:eo3uBLB+Q3rsppzCJWofDmA0wILW/KXRvIHvXBvZ3cjfd:e6uBgzEPkwILW/KBv2FxG
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/HiddenProgram.dll
- SHA256 15cc6b2862bae083dc2d6b1c160689e1390a2365aeaa6e70a933e968fbb05dfa
- MD5 e70990638797ad79f862180b9d06b53c
- SHA1 927db245fd7ae3680256b3de2182a23f92bd4495
- SHA512 ba30a39735878d710fc91888c5878c58899e212d9e7faa97602aa945306c6b95351be799141acbf12fba1e81ab1fd6dcddc372229024003011595398aece68bf
- SSDEEP 768:9KzzyvoqveS5gxa+cmucfIM3hPnfWpGDmIyAPYrRW2d0Pkrrf8eRiGcYX3:9kywq/as3mL1FfgGDmIyAA1WB5eIGcC3
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Hosts.dll
- SHA256 31042de9a4004297a03ac9714e15657376de104fb6099cfecae2306da4717ed0
- MD5 f001d98b90208d1856ff30323e9e7974
- SHA1 720dcdefbe7b2a95f505535e8140acd3e72e8097
- SHA512 34007a073ec6ddfa4d0e334cb923c8aa7eef793ec211565990ce812609de859a390ef18f27706e4a4efa456e0787c08805a04cef22c6620fb06e17558b3f477d
- SSDEEP 768:Y+5DD6OrEz78BDLplFxe4JhScRhF4+BOmSHzLGt4:b5DmdYPHF0I8aD4+BOmSy4
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/IconLib.dll
- SHA256 7804ba869e67a8bd8270461ae75b6d38970c6d855e12f1fea0dfd8713b6f6934
- MD5 af8154cc71e57761a39743861b244870
- SHA1 929150541747ace403732e884d4679831c372a32
- SHA512 0392ef618ea7e92ff8075a30df7097b9aed6ec697cc33ab6db8d67d3d856c5d6531b0f548f1e6ac57788e5e7662729fdbf44f6f5575052f05742dce25654fecf
- SSDEEP 1536:PM4Yb9YM9LQz8h9YOzJdRebvvuln+EaJswp9YZaiybm:Payy0UNtebXuxed9fiyS
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Information.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9fbfd1036e579edc9498625e86c45743e4ad8ecf5960f4a87a9402ba1236448f
- MD5 a7670d3509baa51af6566b93b185b854
- SHA1 2b322b936eea3dd5414efe589acab3cb49dfe9b2
- SHA512 34999ca9b71de6ed4a3cc99177ee472bf90af9282a095d2cf6b05f17e896f518b46382aee021b540f5422c0997680023206b1281013c468a72116cb646a89882
- SSDEEP 384:BRfL6mS8ayvHxy63m+tDZdseXGEXNhDYLuA7InXxtXciyxVM6d0PALKz9G+mZ9:nBS8x72+1ZTaIn3siOvePALKs+m3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Information.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Installedsoftwares.dll
- SHA256 a44723ca98059a803723e8830eb6424fcb3a2237026138560bd64f8864343c1d
- MD5 6b20c7f7fa597e22e2bb592e82997672
- SHA1 a414507b7cc5fc0bf234a41c9688745f4401af6a
- SHA512 7372394cd38efeb171c73d32c0f03785822c3cfdba2b2720aae6181705bdc6e6c0c80effaa444686588f334294ac9e262015b931c076cea04a94682b4fb73d10
- SSDEEP 768:jEaIhpiKJP2WcFfJ5xnFqK0heZuGRjTpIUdj:jbI3imFaHxnG45lIkj
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Keylogger.dll
- SHA256 e3723e369f8462661d6b6ee497c2a56bcb4ff607ea49d472b2e7addd47ba8cb6
- MD5 1ceb5aefddbd0aa596a9bd691444df2b
- SHA1 571dfadc3ab4bcfafca8eca6cb358ef3b931c43e
- SHA512 3a50eb4425285903698bc559a67bf5e9320601ba6f4b53794de9d919d57cf02ceec63c4d7e7d91ab329486a5506a014b988dad7b60a11138ef39c6972ae4fdaf
- SSDEEP 384:JmsVjKdtr8FP7H8kCsu124UCJi88el1gJb5R7EwCf4dzOXV+OefTtgEYXuj6++7u:tjJpCsDhS+ef2b5uwlk7exHYe+LaUc
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Keylogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a17a5bf35d8b784c3111632ba7e0c30a2c1a9c2c95b549235affc16d6d055477
- MD5 4f846f2117c4eab285289b0090521b1e
- SHA1 e25287c39bad32159417c5f0bf798625b6beff45
- SHA512 fd946b5f7c3c7d32f226897283de7ba3b4a4ecc2919c363877f1258cd24ed1a52bce53af2fe4ef34c4ac30d00fc456fd4e1593b79c37f7c22211f2c4f6092e5e
- SSDEEP 192:irtmcuq65SoDxi4maEYbRzmEsLkjgv5JHT1eJYHcwY7fazB+LEi:irtlF60GE9rUhVsLF5p1rYydmE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Keylogger.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Logger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94
- MD5 3717491f7b1a90aaa5f271ab14147a9b
- SHA1 bced873bf58c79d2787d8ea501e7888b260d36f6
- SHA512 c45dae23e4fe7524aba823a834b6882572d4de10034291b81236fe6a44457e4d8fbc935b1d673b6b83260925f76ba1a0ae156eca4626b795f10b1a1e4f327a31
- SSDEEP 384:KyQLebQc3aImZ5mzk2yKajPdseXGLN0phDbuAyso4bNmLaNDNCsQKbQr1jIC8:/i/bbUyPMeBbI1AQ50C8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Logger.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/MessageBox.dll
- SHA256 a0bdb472748cb019b15d900e4a7a5197250200465876a08bd7ccd8ec8dfcbbfc
- MD5 79fdd86c4531f11fe13a2aec4ac34be7
- SHA1 a791297d899d457eb815e7e8776c85b5cbda4cf9
- SHA512 88b45b751d6bdbf77d7a028e59edf700cdd227010f743ce1a6f787ad8def4a374bf3e8041c461d5d9e16094b43298bca316f76bd3dd172732732d3d3b550b54c
- SSDEEP 768:wOW7AM3cm9/An1iEDK5i3H+smcHeHE6ve/29LQm:wd7D/AnXDK5Iquepvhh
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/MessagePackLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 007a50a1275964e14abecc461549ae495147417d601c5900f3105330bb2e4a4f
- MD5 aff009b639ba8794200e91f7ea8915d9
- SHA1 772ad6e739b1c85e09a3c2e0dc50797a8352ee71
- SHA512 2f68cf7805c8360d343c97ffd734c7f277e5949b7ca74e2a5a39c821eadc32415bf1c737b9d424003b5040260c9fdf6ae4eeba14378a2f9f8ddcdd23aa42bfc6
- SSDEEP 384:itmuRruSxseXG+PgWuULvlxX/Db1NSChgqz:iUudV/llxd8qz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\MessagePack\bin\Release\MessagePackLib.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Mic.dll
- SHA256 3552b2b551ce7380f3be589575b951c3faf2d875e1f521dff8595027f287dfb5
- MD5 751a28c1688167319c4b5934466636d4
- SHA1 89e09680f89b3c04ef3e93bdf91d68b90e86a060
- SHA512 1d756452e8f11e3f6f030969f2e2ed8f514944a269d40d0c1b2fd8be746ab360ec1b225d0be4ae290e27954da04c4f204996af055e86bf731dce271ef6123be4
- SSDEEP 1536:MkoEH00txd3laphEoro5+SYi4ekCuMGOkwT+zNVRxp1qmY2UWQ8N:MXN0tblEhNoDzRKk8UTG
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Mining.dll
- SHA256 6568872f9eb4bd561806630819b5e46b7056fcf75e22e0fc2f1e92e5149d9282
- MD5 85a03e407c91f79be7672fc3151e324b
- SHA1 48d6f457c645e7de459725bc7bc0e2326d0bd8a5
- SHA512 cb5b71b11a19bf2af2f5bee4cb37da7f4515f45c42c0e8432ceb92ccf47e2e082ab21a4278551d6d6baa0aa71c435cc0da58c289b8b3cdc1665cd1d33e77372c
- SSDEEP 98304:yrI/bzN+izHkWasmhhuReDHABNtG0i+VpOlf47/dcxk3zJfaJwiy4K4K9VGMRRfw:8igixarvLo1ikOsVcxYfa4TRRfw
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 588ed6232c93d2e18a40051b02b6e0b0c2ce252b897667d5c6134166206c7396
- MD5 8ed27058380bfe4ed4b7a761209ad623
- SHA1 4787a6d8d7a55f214d953a37718f942155e800ba
- SHA512 c31450e4f33eaee44e59711129ca4c1207724bcbf2f79c39e077589fee0151f123aed8d95ed2ff9519b0faf2fd1befd4ec1aa9f5698c501351124be7711822e1
- SSDEEP 1536:IsOZ2/gahPUvCOco3CVp8inOm3O4pj+amjzTt+IdjEl:IsOZ2juCOnSVpZ3O4pj+aOzdK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 479371c859f9e18a38b0832cc49b817cbec3970d1820badd5e274a7809afdeea
- MD5 f0da85bd2bda4f27567910b80481b920
- SHA1 4363e72fdd4de82b36ba248c899c3bcbb02399be
- SHA512 237020ab90c043b34053eb551c4e2bc8bab1243e545e747e433dbec409caff289c424cc60a3068eeed0a101d3b5181d74bee6f7155b35439193b9ba018396f90
- SSDEEP 384:3VOeeN9i/cmrHm2kRpaeFZFXO4JA2oh93dseXGXh0gReDmYuDeFjSoB4Sk7DEY3:Fci/tGPraU7eWA2oPz3TB4P7R3+V+I
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0460389a3845a271ba5d65b30b66c57458f2373d75aad94e92416d772d06df5d
- MD5 0fd19be97a94b00e440d14b06449cf92
- SHA1 c0ce1911fe5ddd5d9b9446b16df6c51a555e5415
- SHA512 1049d90236b43a617ee3ede56ed175a39d1bf090ad1469f9edf71d91fdd7267b1aacdd3303a1ead11785aed2bc31dbb9fb1b2f15461cc793c7ab7c8b8f31e9f5
- SSDEEP 6144:50ZHTjm66pzzevOqsdHUIByYF3ykIGL/ec:50x6Jy2TB7UkIS/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
391770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
375KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Password.dll
- SHA256 b847228618df406225bc42d2675cc31bee9e8af99987681698261e1b6c5b88c9
- MD5 247a3855d1d6814e7e201968bc7751f6
- SHA1 6c327ce2516f6835591789bb8666e82a3ae01852
- SHA512 29d13e3d92da39c8227432925572f2a7880ecb5c9dee65d8d15e85246d0512276ec0d93f3af61a153861a08847fd055bad6797f13e576dbaedcf85fcd7b8fd28
- SSDEEP 768:z31CNPKw0QIf0dYIqB7yE2L4yv0rEbT6Q9uHYoBSUoZRaPmevE43LQCxgKRgmG:zFCNP10JIqB7yXlv0rE/5sBq03ZgKRK
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Powershell.dll
- SHA256 4f9c3025a4e588cb646362d288bb47b3a5d99ebdcd7e9fe3b2e4abdb2b0a6839
- MD5 fc6d64e8bfa7d8c02e0d13f2667add48
- SHA1 f53e7331fe2d90de0c5e4a77d47f1d6c7c918962
- SHA512 b3c51eca839f3dfa840f60e5f6901d6961d9cd16e683d58c82a0fcddd958a9e0068190a207c9edfad2856250d772adb2c269bd7a7aac06d8c456eec238213a7e
- SSDEEP 768:5291m2h+c1kL/dQhjEG0yHoEr4oKlbk3JyGRYs6XsddsWv:p7cgsEG0yH9hAk3JIsCsddsWv
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e7d1a49c2c1ebce3b465f5a97d1771bd7681a263b676b0311a3ad9e58b87e1f9
- MD5 97a477186db32bb9020166069dbc25bc
- SHA1 bb1eea629845e6adfcc8620eb80027c8ad145942
- SHA512 1e17734ff635b555888e686c5fa6bd8e86568bf45885c407bf2afbb96c95864781cd2274f99322df0d3683b5df504148f941dcc689e50d6b829db5a4f01e021e
- SSDEEP 384:qH5CDlBVSGumXg3eg9cZNvPR11+RIdseXGdR26ZDWl9fEZ5QDGSqunLIJuIeJgnY:qH5Cx2aXQeOkFyiEY7M/Griz2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\ProcessManager.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Ransomware.dll
- SHA256 60f7196f410261d0deab7233c0c524fd1e5d4621d561097ba945c10a63843f04
- MD5 2df5afade779e392d23991978322423a
- SHA1 4beff3a50cc06d27f4311e96790cc63da1e9320f
- SHA512 d2e5406b41819a11415ac73f217c71e88e4c6b42e9c2bb798e41870afd4e88402eaba7ee87e28017c8468ece8079ab471bcf76e342854598955bebf63eb570b7
- SSDEEP 768:pHo+xL6ggpwYf7s4eBNiFxSMngvAFG7qHlHpq8dHu0HT6+weVXsK:pI+co4x3yAQ7qHfqULH2ZYsK
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d446330954f19467b8e8b09b4773781c54292c2a3dbdeab27619baac0664074e
- MD5 902c646c9cfad54cb1271b8d4db4ce10
- SHA1 96776a4cbe93a5e1a8a4b52a4a03172a27429a59
- SHA512 f3c7437888ca312ac5b617d0f574839a740735abfeaf07817e0baa62a372f84f16b932aa4d6ba60e8f040b2ba9a4bc45b2c7ce05a0a1a471a18b5aae17fd3d76
- SSDEEP 24576:31lec1oJ/S8f+I9pADW+mmVrbseOr1Pr4A3Px:31cZV+I9GEmVrbseg4A35
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1331326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/RecoviryPasswords.dll
- SHA256 b4d1bc9bf68489845d167a5135a7d159c0009c5a68a4a4b31b2bbeb43eb3abbb
- MD5 844beb02119cbeda33eae152f4e408ff
- SHA1 fdc8322667e918c03d9d2f73d1f54de24c0a6841
- SHA512 dae1ce67f735859ddadff37e583b3de57618769d7d03cbcd2be7ff8e801ac411448e1fa36cb4eae7edbba3a0309acee5ac5109ad1ed4c81b0a9571c6722143af
- SSDEEP 768:/Uky8zFS62+C046brJs1DQw5/xqvpMqJ1osk1o99msa1sWp+IFlSW1I3nZ:ckySF++Ct1DBqvpMKosk1ob0sW8ISW1w
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e9445775af2f2377469ccf463ffae76290f74ad6bfa324cbb0b156d971bc32b
- MD5 f5f2798e0ea216d11aedb8257b7cdfe8
- SHA1 d8974a91f8c37a6096aba1c58f891533590a0718
- SHA512 d8148ada3a46e37f78ff40d23565cd020eaf65b9e62ddaf0be0ee1397966601f3452cdd8a6b655c52998919aaefce78fed804a3561322befcbb127e1bcc44e4b
- SSDEEP 3072:3Zv9We0TJcowFLHKlXX3WqGdHvIPI0oipjM+o6jI1innUOx9ttpXCC6CpVpn/qI1:JseF/MoYjt00nnzXCxorty
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/RegistryEditor.dll
- SHA256 cf7e65f195c87ec3a3693229576daf1f0678a2f32ae764f1ed1944b8004a30e5
- MD5 f24d9fd573f2bfbf20b816558fa3a6ec
- SHA1 69a7e2bbe161cc80880efcdde81b1eced0fad108
- SHA512 f03afaf96d39b6fced109b86d1b12da275a4cc5c87bc32023fdc4cae914ff397793806288a952e3c3b45c0d4da4e12dfec83ebca39019d58d2b8c3647dc2542a
- SSDEEP 6144:1MsJVtXxufBu8QDIjFdgHYZTv0nCk7Ldh+fWabKQKD8qmTrYjnz+5b:jVXxkBu3DIjzVZpkdTabe8hYK
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4cbce783aff5305afd5e15e60f077ac5dd2b9d40effacf1089d766c02e7fa112
- MD5 59361cf454809302313c7a4c2403ba0d
- SHA1 37b02bb2c79452e105ef27dba2bde7bbce82cf94
- SHA512 4101a25ce5b6951d035f48560560e552f7b252911bd62503867e0ca4f9cd870b48f2400e1cc3a7126eb9d4cf85fe7d6d765cb2afb695de8ccca610f0dfac9320
- SSDEEP 3072:K03z44qqYY2fCjjFFjjpHNUU22UUKfEqzWfmGcb2ZqIpQzpPhz4g1kzV:h44qqYY26jjFFjjpHNUU22UUKfEyIpQ8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
117778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5bb6b6c1c4a1bcd5b53739f455fa06dc79b05a58c24dda17aebdb19700abf89d
- MD5 f75278e1fbfa2def4723a73daec54547
- SHA1 5dbffd558e99dbbe66d06efd3fa40f98d66db6cb
- SHA512 1d779ad89fcb5dfc07da5e19f3583740907a2286454413535b9d87943252d89dfda56b675cec302e29986f316eac48f93f7e6edf612d7632931cc55567505e57
- SSDEEP 384:visLVw2bJSO7b/5rDK8mvrYLBllgBuaH8Qu1pwi2dseXoAakghD4B0AIug4IzPTr:6Ylg3voTB52cjyOT1UuvuzhC4yb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d360a46eca2f0721cb7b7080fabc41595d9acf25aa787ce76f8dd091a6d8049
- MD5 f83d9cf1d492d2c87e25c4584b0e2691
- SHA1 531d83bf531368142fdaf370c30f146ec6bd951e
- SHA512 110c500c23d53abf76eda9addc232479aa6a6d37251a06572144a53ad871ed9a87b9e02d9df9b75654487a72fa0e51be94a2540639a7e176dda572fdfec23b3d
- SSDEEP 192:jbBTOv+EgIRtac3iIs8YviqeOLUVw1z4ra2ZHouB/By0t/WJIGWl9Puyi:/IvpAcJOLUqFkP/By0RX9Pa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Plugin\ReverseProxy\ReverseProxy\obj\Release\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/SClient.dll
- SHA256 a4a90a2bee9d9f882dfdb6d249c64b9875ba311163cadc19a0d6a05beb9dd81a
- MD5 abce8d20ca714bc04cad8a4a070931fd
- SHA1 cf109433c23645468f55ac434c554f369d87c954
- SHA512 ce2a34aa753fddc92dbb2894031b4f0765dade02530f41b5c2e8ba7cab4b5267524dbdb5ce174ce6418590533e49242b8c3c63aacedff05df65943142246d90f
- SSDEEP 768:JbHYbqQWujUnAR+wZjWgBwzAWjqL2SoAfgcgy3k:JbOqyjUAR+0WgBwsWjU2SoAfgcZ3k
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 072d48161b09b35ea7f698a4dd7708005e2c39ce96fde8dd140da5d3ff900c54
- MD5 38b26e87939cb40613f0aa2fce3372af
- SHA1 e455e64391ca14d08f1b85b9747c38c661be3b54
- SHA512 7d357ff9a1a3024a79ae1408249eb9941af1a50f21cc81f500404d811bce9f82adf0eabb953896d132dda97a3b3afea409fff39135f8a60c034204b28121e6c1
- SSDEEP 384:2MVWIGMyhPDe3Mm0xoQ1z8MRnuSugdseXGV/nNhiU7eukZRXYhNczlFILQBCujLH:Yxen06Qd8MRRugMCz6azGetz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14be9c3ff0aaccd55a2fc7b17fe63009ae3a746c28623efd8a7e66150f715a32
- MD5 dd61babbbe5c58e8c7c87a1795ff63a6
- SHA1 f6d2931d2c11a57cc12c2f8bd059e6b4cbba44b9
- SHA512 724be458c812a8b3f0911418f273622f8a1a2aee7fc8ea52e072fd5be673293b867b551a3b79008729bcd83098619d69cb57468d61af415054f1e97bf43737fd
- SSDEEP 768:lwh1vfIOJKapaELei6rMkmYL5tHBDS+Jm/:lDEUrBmGnU+m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\PandorahVNC Final\Venom RAT = HVNC\Venom_Development Gay\Binaries\Release\Plugins\SendMemory.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Plugins/Services.dll
- SHA256 37f53853483d4aa397388e123263505d5c6a08155e7b4fd07af3d9f3304449f2
- MD5 6dbd16a3a98626e7b0859981c2679753
- SHA1 869a07ef27bd6e8dfaf10e93e3d492b4d4a6c804
- SHA512 04384291cfbabbb14d66616ea415d959b53dd8fb6c9e4ab405d12c7a71348ddff0fcca8b116e1f3ac604253221d54098a26ca28c9eb404132d95072365c2a669
- SSDEEP 384:JyrEeWekViigns6t8VAInDMktJ0dnUH809+KGxUty1g07VPzBBqMK9MSc2ks6XMc:orNfkKnHIIB0Q2eVP1pK9i2gDGYiFi
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/Startup.dll
- SHA256 b83fd2bcefbbcd1e3240e27b4c138678b1f88e9ec6267acd533fba925eee8bc8
- MD5 12cdf380df0305129c98ff50a5a2c508
- SHA1 2c40b5ea0cd8c38a2b0b8635d655354e0be6e142
- SHA512 65e3a71344879e86a2e2d5a0f2440b24de264883e8d3b4b9967a86cb5fc221dc4a27d5e8e5d7b4a86a1126102ffdf4c9b885236befe3718c9dfe6bcafe10b561
- SSDEEP 768:CTDL1PYXZoKUJKVw/DxFNQ2EfHom9otgzXOKmCB39:CH50UUm/DurAm9otgLOdCBN
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/StreamLib.dll
- SHA256 d67e7c5cb612120862642af153d7ae17cd77b1f4f043f8c26f62b6c1b0d6caa8
- MD5 a7c24c07c9a9b624eadf69ea51c2f063
- SHA1 19c74b4bd0ea43a695d2e14c6b5babaf979fe6a4
- SHA512 677ca0855353149a4c9a8c0bcab85dd59ba10846c82fad6ed210d7880ec6e2fa834f93c746685c8d6c32d0bda10c15e67186e49fdbe16e741e80e68909ea61e7
- SSDEEP 192:JiszHFgegSEJ3uE1i7VshFzB9eMYyG5tqPcVui+VeBL68QOiaGe8OK+4Flt0XYtj:Jlz97nVsfF9zY5wkLwbNezQDsC
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/TCPConnection.dll
- SHA256 9aeabf416db99b69c8e9173ec4818fb5858b252604e216f038f71c37e066abad
- MD5 4498c02a6fc89dd9ef5ce78a5cfc19ef
- SHA1 a86d63069c6364ce80d2b5139c84ecd00a54f7eb
- SHA512 e8bb8b147f3c4128e7682223dada284cd87d1f83a2191188213e12937ae27fb5ef0717eaf226bc425cd7805c4c87012a31750fa5ff73e57051bd6da7587a2d14
- SSDEEP 768:XFcwSUGrtjQVienSaC+XMpmT/qbQ6L/KRJN1aiZIRVCUE:XrAGkaYpmWpL/OVZmK
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/TaskManager.dll
- SHA256 5958e69420de42bf6c1b3d42d43f26a4186c3a376c3ea3eb8e1deee4a380bc95
- MD5 3f29390d8cec06922b7e4a62b09b4a80
- SHA1 a6683bbc0a759336fa750878abda852c07dcb89d
- SHA512 2245ec91beeed54013bbac51bd657264463e406343a643886dd976afca0bbea8180c55c53f19ee391d92fb0310ac2ee938ed55c75d11ed1ef870cd2b426a6f6a
- SSDEEP 768:DnnslheXXyryYvxdyb9utxAMYwaqa83F3iqZZPgJQ:bslSX0bvybotiMYZEiGb
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/USBSpread.dll
- SHA256 dc325b03f2375abd8ae4d40aa146431fca371baf291c01b79d732160384f5fbd
- MD5 e0cf144616d27108b6a529f20a3a51d9
- SHA1 78fe4ed6869999c5eb29fe42f88ec82fce7c5d45
- SHA512 e5f46d541f25076bcf297dc3b24be3fba329a23bfb313aa56b0b9045f1a87df98c4471b4c27f82560eed41315658bd6bc960b1289212c175d0be39dba23e5ced
- SSDEEP 192:JN/shRLtDyaIsduOe5aiTFPHLRVO22i/Zt7sgKs7yx8xtOOfyK51VRsrdRzAKz4f:JN/KDNOakP9P2i/Zt7soyIfnVREdRzri
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/User ID.dll
- SHA256 7cf520cecdf08ffe81df9544e03eebf376fc39ec9608b9d8b9e0b9e0e124aea9
- MD5 0268797e0c36da78c66240a016495453
- SHA1 11da329cca8e43367d009d737387faa01a61776e
- SHA512 54d8d5377a40fde43cb0e2d0f4cc06d51cc68735be166a0b745eea67170c297496b36f60d5e3b3269ac810f7db4bb08d7f7491feac84826620730c8a4b78669f
- SSDEEP 768:i3Yu/xD1ZRWrOYBQikanTv1vd2Lzt8ylxajaqG8XSP7mKtsRs:iPHqCYGi5TvU8mxsaqWP7J
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/WiFi.dll
- SHA256 7fb3f3b38b7022a426b61a3a2b49a19571a88f634064f62a74a39ccff2d6acca
- MD5 5468a8e412c5a9dd3f493cbb56549dbc
- SHA1 86cd2e8de054c19e53bad2f4520c90914859452a
- SHA512 ca82d2a92ac495aea7768f5fba13f3d22ae57ab15b1a99cd7582c78d37710d49eebe51601716a5a21e4ac62da6857b9318dd9ed93c336251af39064a94681eb5
- SSDEEP 384:JN8ZVZe4YEwWda/b6ZfqpTasRZWRYqrrdRvLo9OfQaEMIQP0/dVuvB2RptIe2GZ0:zWVwPEDs/x2NL6kQnV/FRptI+a
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Plugins/lz4.AnyCPU.loader.dll
- SHA256 b60e10911329f935ff50797a642258f83f31306a07f2cab292764d78cbed08da
- MD5 dced286e1f02fa08c6f15926c60e25e7
- SHA1 192c4d3165c56cdf5107beb7e6572a11cabf884a
- SHA512 e79d3d4116ac3c7296063ffd4dd3133280a9069dc9b0a2ba1ed0063d5785e0653a2346f30399cc517c804b44196e64d1d759a5a243463a581918ea94157aa8d6
- SSDEEP 24576:Jufmxpul9TZUlTNTEB/O8ogrQPs737zeSG:J6pdUBN32X3eSG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
S500RAT By WantHacks/Plugins/protobuf-net.dll
- SHA256 8578a7befdec6ba672ac711c72903a68efcfc3713dc82ca40de7532ea031ca3a
- MD5 1f8539f5bdbd9dbb21de26696ca03b3b
- SHA1 b880cb20f4dd9317a107ab65381ba6a313bdce2f
- SHA512 7f967fe5bce9ebb15c78f76365b9c615b3d838a5c9387d2f923278ace1441e3c9a538f51c6b7c3f0d6aa4c5b00c566c5f34beeebfb314a2625d749c49cb3c79d
- SSDEEP 6144:YsuxK7S8f3wV7sEa2At7mlATT6tHN1POXMHMfL9R:YsuxK7Bf9NBT6tt1PO8HMfL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
S500RAT By WantHacks/Plugins/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e72ffd501ef33e454e369aacfb39d1a1325ed132135f7f8a007c44fc4b554b64
- MD5 f8ce280fc2b16762802e7d8b1799e9c4
- SHA1 e73800699dd7ce099f6e71db602be062acd5cf8a
- SHA512 ca5135f64a60dbab2a4e711685466947a697925e0a0cda52a8021b0cd3844b3293a946bbcbc16d34b9bb2c693a0bcf061821ce158d7c1f3f01bfd965ab351717
- SSDEEP 384:DhJ5QORem+gHzdgvxm3Ar8g1/OKpu1Wcq/kLTiIn30icum:n5QHLmB4bl8n30ic9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\DZ\Desktop\SRC S400 RAT v 1.0 by FC\sc2\obj\Debug\sc2.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/QuickLZLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84010ec684909d229dae5c004f83a3b4d103a7e6f7169c9668be42916196d39d
- MD5 c2c2fda4de7694638f7db9251d9f5b3f
- SHA1 067c2716157f81eb0dee221b8284826ecc999438
- SHA512 1fe1aef9178452e500bc4698574ca604bdc634868914f042ae78aaeb26de266dff1ddcf2a31c154a18870514025ed5ec394c185215887db1fc090ba6e4471ac4
- SSDEEP 96:Vo8kCURbgvm6xActMpN/zLZLaKmpaqGp+YT5Z5sBGqVoRxi1kVCUdcyQAaE:qnVbgvm6OcGJNaKqGphTnyQxzi1kzop
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\DZ\Desktop\QuickLZLibrary\obj\Release\QuickLZLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/S500RAT.ico
- SHA256 8ed36454cc6dc56529858b6171f3cd440975aaf167e5d05169ab4b92a748a710
- MD5 b43e9f8f5da163f11d182008bd6a58a5
- SHA1 7ad200a21c4abb429a07640fbb44680d891754a6
- SHA512 8a27a4b743ab5a059da9dacb3af3534a3adddde7e74dde203bae7769ed048a13c41cf05a2f4476e2d9e698a1893847bb2613d5780548a4237c7158480fc3d508
- SSDEEP 1536:KjcA888+8hooBbKftPKaHEWemYkkaJRJzh:2wNkCaHEnJaX
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Socks5.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39b5c1092cb7cd2ca9a8704f37b5d97c5d104cbb6ca4b164e15ff27616bb47d6
- MD5 bcc07553084bda379f68d386fe4886ad
- SHA1 4e575358c91f0cc1abd91e6d574336e6118abb85
- SHA512 a4877e98db5489f6b459ac777cdce6abfc9889105ea3c449f2231c85347f97b90e1853c8c9e0b8fde4834e75ef8990b131f2f8b862bd74d19efea79a35afb75a
- SSDEEP 768:Ca6RgXQvsxcn7GHvRUy3y8MUtiITnwp4TEINV:ChqO7GHvRUuVIIL847/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\MyFolder\MyProject\S500RAT\S500RAT\Socks5\obj\Debug\Socks5.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/SunnyUI.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d975bc4711655e6fd2361ae9b056c617051f616ced5b46ce7772255a85712441
- MD5 17cbdd9e4cb0ede2fad8c08c05fdaa84
- SHA1 74bc0ea3e8bd64c6752b6c0adac1bfe2b313416c
- SHA512 1948c20585ecb9984cd9452a74bcb75e81c35ca37f0cf0e1d3f211ad71b9e40c215f4784af7803cec9baef9984f682a32817a85806aefad21830b13b6a0a6a4a
- SSDEEP 3072:hhZAZ8ZfGPuMDFy6EDinwGGcupdEmyiQ959xNoxcG9tS1lPHx:vayAuMDtdnwldgffqcH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
186818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Sunny\source\repos\SunnyUI.Common\SunnyUI.Common\obj\Debug\net40\SunnyUI.Common.pdb
mscoree
_CorDllMain
Name
.text
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/SunnyUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4208c9293c5684d2fc3c8f5a269a1120adee32fbd2766bbb73410aab2d491b7a
- MD5 af527b22b92a23c38a492c5961cf2643
- SHA1 15106adfa13415287b3e9d8deba21df53cb92eda
- SHA512 543cce9b5e4c9558bf0bd0da9d6af8c1ad2f7d62e2d65a9aa4e3af9e4840ce6fb6bbe8952bd20f6f1e3a6d3b5e5e5b3417a60b6d955bfa4e23a653262677b49c
- SSDEEP 24576:oZzlUptCXkpfdvNCPKJf8sleX7wIU8CdSjvXUg8w5n2WB+kM64p9zgQvRu9Pv1wc:oZzlUpt0k7xF4XsI5CSj8g7/+kI5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2333738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\DZ\Desktop\SunnyUI-master\SunnyUI\obj\Debug\net40\SunnyUI.pdb
mscoree
_CorDllMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Svg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f1386d1d6623687bd96861980f648a0cb5fd5beef703bd03ae02e212caa650ed
- MD5 11a5dc656950ab0017d3e323a6ec34ee
- SHA1 d644575902b40542101d228a53c9cd1d376d6dad
- SHA512 5cc372cb773ced22935b37d5465a79f634b119281e3627c1d1b9134871bf7c0d33a47a05e5bff379d4d890ce8b8928da6b74be45a5ab63bc4277b382b8ee930e
- SSDEEP 12288:SiyGYk4VMy6CmUigYSxx9V1jnQxZdlCG3pFb6KtXX2nrfSNT6v2q6w:SiDYkgigYSb9V1jnQxZdlCG3pFb6KtXS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
593514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\SVG-master\Source\obj\Debug\Svg.pdb
mscoree
_CorDllMain
Name
.text
Size
572KB
Virtual Size
571KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Terror/1.gif
- SHA256 b08e529104ac66137b3fc1aa663dd28992ff0db479cec8ba1718f21f735c6844
- MD5 0244b50aa8791c954d86951bc047dd9a
- SHA1 5d67611e41083e7105ebbe3ac5155536f1f3e11f
- SHA512 0df82cae43551c31aa25663cb3e600c3f05c50fbb18daa8bcd01f77e61fa3358e70d4f222d0d2592c7efc58572abf27b580139944a9d87e8cdb74ab0fdb698c9
- SSDEEP 12288:EB4UXHDO3hLp2Cyxk2xC1Br1A+aWsLLSfdOzcNtDnEXJR77WKMQ9BSWjJk:EpXy3aCek2e1A+V+WfTtDE5RnWYHC
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Terror/2.gif
- SHA256 023e0b1e7e2cb17903330396d1b7872dfb98d6c404a10cb9cbc7918a2a15285e
- MD5 baaaa574ded9e0a53a8f38c0a78eb032
- SHA1 8b725b71a2adb0a8c8c08d7cc5f316be8939fb4c
- SHA512 161694118e3b98d4aed3d1d97e06d4b120ccdc72e8761a1fe08fddfd7ed6525990cb82556d526957db4e499ee6052c9686237d29de1c2ce33f126e1ba95d2c57
- SSDEEP 49152:UDwciSkBAyHQTsaJVTF25Y0WXPWW788DaFJ5Zj0FesYEH:UL1JVTX788DaTKN
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Terror/3.gif
- SHA256 93ffdbedd1b8c64efd5e51ec1f86ee0a955c5b3d57974787165531ba25935ca4
- MD5 3a0657de77e0a480e3e05aee5994f90f
- SHA1 c8f4e956ef8ddc1734c26c02c0a76c707a5607c0
- SHA512 33cfe3de294385a4b3877216bf01630f1829c03c909fd30f9d63d21923b8af65ba058311d1cbec0a59ad97320bce38c4ff51cb27b39a3ac1472216cc5c36c078
- SSDEEP 6144:Kh0sSlVcwyDqg4XKQsYHd/ymN3TMzNxhakiLICMH3PBHNdQhZ:KW/SwyDh4XKQsId6aQxniLYH3hHQj
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Terror/4.gif
- SHA256 aba240f69a55f95f4ccd8c50483bbda8d7847b7920d4c2493f7b1d5fe5831144
- MD5 1dc969cef2abe0e22020f739185a9a20
- SHA1 eb0adeb571cf455b24080a5e7f0ba55f9c9d0f0a
- SHA512 93e5fce549e46a91501ac7b8937ab9977fa610c5ad1341f16c63bd08dd2c32fc24b2c0f14a2acd69bdd9f2e2663b6aa139a0204c4bb38f2076a03d3572c20554
- SSDEEP 49152:wM4COTrzpKTWUut1H7tLzCHeIE6czg9dfc:wM4hvzGWXxJCH3bk
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Terror/T.wav
- SHA256 f180310f04b2d44a9c5d25c2333423febbf53f0a62d5583f304145c69a69d8b6
- MD5 a4cd36f6b756bc0e764142510653506b
- SHA1 4a8a4365159287ac9d2bdab002a6315b181fb2dc
- SHA512 c48cf17d758e4069a87833a1c5da10b66efb5e2e126cc911dafe907aba41e3b412d64d295c1aa61244013850046fd60c11cf75a1b3260da01da22f776b35c223
- SSDEEP 49152:tfex0fWIsbpkSMDXogpWvdSYjUHiN+rHXzmC+:Jex0eIsbp3MDhgVNQHiNuXiJ
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Thumbs.db
- SHA256 91f56498738637e7359ce244ddc9280bd866df4f007c70e9688ffb4ebb7827db
- MD5 cbdbce320edbadc3b763a060d7f0b8fc
- SHA1 6ac8dc9ac2da272d5eb47f2df4e365d4f78738da
- SHA512 afcd3fc85a529c35f7b10303ce83850d1bbcc7e9efc8ffebe2b2842441ee8430aca112e34e8f3faf06f27bb6e149019f93727303a2bde17ef38f611f688239a8
- SSDEEP 1536:JkWs4wl2FudZcPHPa4lsrQeUy9sePRDTqyhpOUmy:JZ42PPvZs3vCeP9qmpx
- MD5 SHA1 SHA512 SSDEEP
S500RAT By WantHacks/Tulpep.NotificationWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a21009898bda6a9fd598f34e5177adc602cf0d777bc4899e6c10b2e940667149
- MD5 5e900a99ea361e4d0baeadb104ac7c8f
- SHA1 efc3655f383cce6fd25ba51f6ddf1ded3d705788
- SHA512 1abd166e3a3ae6fe0fdebffb73c480899597131b24674b672c93dda90de299577d081f3f692293d1fd53d090d2983240774f50f671a48ea8768b9ca053ca3a00
- SSDEEP 384:CBGt+WXpKeuokwNwArkyZVUUMB2zLg2JDtSC2sRBxaySYRjsUdPwzPwLPwpPwJP3:8ApzV7+Hy5dBxv1Rf5q4DH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\projects\notification-popup-window\Tulpep.NotificationWindow\obj\Release\Tulpep.NotificationWindow.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/WinMic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa8d7a078c13ee06d781dd2978f60dacb6df8414d678aa52254e100b2b076ffe
- MD5 001817cb1db39e38efb32123cc4deeaa
- SHA1 527297a8744ab230b04025203b637fb819039d16
- SHA512 fa4c16cc892b8c6c55ee8d95e1dd8909e9f31a70d87944f09f23b4fb8f94e2581086b91958b67bb72dfa8c9b9eda9dbfa2c2e6a2c9677a70abbe3fb626f75479
- SSDEEP 384:UX6YI9/TWGAXcacj6i/i2auXiYbGhraS/7v3qBmdpP:T/TWYi2pvGhrf/7q0P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\MyFolder\MyProject\S500RAT\S500RAT\WinMic\obj\Debug\WinMic.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/WinSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84ddf212c192026d19ec817a7fdb0e821b2288b6f50f022332c4368abd1745b0
- MD5 c645289085617399cd51b0f6983440e9
- SHA1 49ef2ac5d9faf28a4ba092d7e6c2e5420bb4c6e7
- SHA512 1b46de53bb7508d09ea28452cbdd3b417479e55c8d5d999c301bcd3edfa070bfbf0d629a3f48603d950ea0eac3455bd04ab2988c72dc526aacb87446f3b99f22
- SSDEEP 768:TsQ6PMTqP55RJToYHVi1lNBqje0dTEJ5fnmbIP7mPOEuRolZ1i27v9SsneTbfMeq:ndGEJVn8+tRolZpSsevE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\DZ\Desktop\New folder (5)\WinSound\WinSound\obj\Debug\WinSound.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d3d849446b99e7e4b10cfb76f35351ea6cfd0c6af1bbfa0b30af51416abca0d
- MD5 aac45c09e589c34f38a169e917d21b11
- SHA1 c5b28a69458b22808521c58591ebe8cbe5c0a341
- SHA512 93835eeff562984eed07c720b20ff87f891eff3cf9fc9bd7fae4c120e7879afbff3b15f1576d7c81a967a74e225706b7e4ab5b70815976e5849dfe276ce359d0
- SSDEEP 24576:iy6PGgxRbNwkr0DLqf1U90rDmtv7fnXet:MW60GflS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1149562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net35\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/initialization.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a027b6b344e5a637bc8377fe58166273d2b76e92ff8c66bd505d46c21fe3b21b
- MD5 3aaae3cec15b86693ae9fb8e1507c872
- SHA1 ed8d0a139c609eb886482718ec2ecf96cbbe8c84
- SHA512 407558e01ade1832bb021b5af0209e7a6bef98ab35b9f4723a1add48362bd13f566697a8fb41af48c0bb15ca13585f9c09ac8d5da0feb322798c778b09cf4463
- SSDEEP 384:5muuVal38uSRbuvJ84AzLrYaVcZSBa2i3OFvyKJsBQ8aY:5muialsDLjLrLV2S0uJsBQ8p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\MyFolder\MyProject\S500RAT\S500RAT\initialization\obj\Debug\initialization.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/lz4.AnyCPU.loader.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6f327812dd62cebbd8ab20b58b0fd3150800199e45b87c0fc8aa569ca7c27e69
- MD5 c42e778fcd5838b83704a6ddabb60c39
- SHA1 d47ee0ebbdc412badfb373207aec889798790a93
- SHA512 12bc07cfdb826475e66e5a1a3ff6b265baa50e840191cb027146de8d17a0001163b9678e3f7723cdfabaa7b3f93dcca81be86d9c90eb9f266ddd3819a2357101
- SSDEEP 24576:wc2OYBjTIRL0Q+jDWi8IO6Lls0Uh/z5TyF0Nqxa7+s4EeL4pT:wjjTIRL0Q+jDWi8IO6Lls0Uh/z5TyF0R
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1014802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\lz4.net\lz4.AnyCpu.loader\obj\Release\lz4.AnyCPU.loader.pdb
mscoree
_CorDllMain
Name
.text
Size
983KB
Virtual Size
983KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f01d9f2ed07e630ec078efa5d760762c3c8ad3b06e9e8a9062a37d63d57b026
- MD5 9fbb8cec55b2115c00c0ba386c37ce62
- SHA1 e2378a1c22c35e40fd1c3e19066de4e33b50f24a
- SHA512 da0211d1c9ba0a59616bc15de80a1fed62b0405cad3b11ae4220ef1488c7837634aad67cbc8b484621a2a6288ef5e424cd816a2523bdb6167abcab76f3ac1a04
- SSDEEP 6144:1kWu4n53u8Q5w+8yxIxM2NUpwMTRHslVz:G4n5e8kXOMkUp9GlV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e72ffd501ef33e454e369aacfb39d1a1325ed132135f7f8a007c44fc4b554b64
- MD5 f8ce280fc2b16762802e7d8b1799e9c4
- SHA1 e73800699dd7ce099f6e71db602be062acd5cf8a
- SHA512 ca5135f64a60dbab2a4e711685466947a697925e0a0cda52a8021b0cd3844b3293a946bbcbc16d34b9bb2c693a0bcf061821ce158d7c1f3f01bfd965ab351717
- SSDEEP 384:DhJ5QORem+gHzdgvxm3Ar8g1/OKpu1Wcq/kLTiIn30icum:n5QHLmB4bl8n30ic9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\DZ\Desktop\SRC S400 RAT v 1.0 by FC\sc2\obj\Debug\sc2.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
S500RAT By WantHacks/settings.xml
- SHA256 635d94a260135b0b2ed1369deb48a39f328c71a0a1fd558513af03b38068426f
- MD5 b7496efc4e90bcf9e7f2a4a01aab5678
- SHA1 a1bc2dc843d080f8252d6f53b11c1fa606e586f8
- SHA512 bfa3d5898b6b70021d2b7306fe4b0495cf402eb710a2a707927d478d6e44c051142efbd5968ceb2ef22a713a08fdc4e2105138bdfe4ffedf3f3ea9535c239f68
- MD5 SHA1 SHA512
S500RAT By WantHacks/zxing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6314d5da3a64d191d0cbe0e73cc53fb87c4c118306549237c13eb097e930dc03
- MD5 ce9aaa0fbc6a2bbf063b044537db1dfc
- SHA1 0d2f94a52de141eeeb456c350ede8e70619fa300
- SHA512 679bc2a87557990608930547384d33c625217e5b1cbcb32794305a0245ee0198fba5ac1cbb7bd1d66a6dfacd8a8bb34ae581e4d17fcc06f1d2978ced3edf3eb8
- SSDEEP 6144:Sg3IbR8j0pDfMYlaYcQCDbcx97ONPCP1+aApF7RaXUU5iYMVBaBF:ShFrEs4Q2bcx97ONPCP1+aAptRaXSBa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
425774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\ZXing.Net.0.14.0.0\Source\lib\obj\Release\zxing.pdb
mscoree
_CorDllMain
Name
.text
Size
408KB
Virtual Size
407KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ