Dropsy.zip
- SHA256 da572139b38004255e8c34ab37fb62cc781c39965cb03ec7fb67d28359c3f997
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AnyDesk (DROPSY).exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
AnyDesk (DROPSY).exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
how to use.txt
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
how to use.txt
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Dropsy.zip
- Size 7.5MB
- Sample240723-nhefvstakd
- SHA256 da572139b38004255e8c34ab37fb62cc781c39965cb03ec7fb67d28359c3f997
- MD5 ed00b3df9ab11b8d8c67aa92939918c7
- SHA1 812cab3fc1d89dc1d3c6bc5135941e3421425e98
- SHA512 7c87bcc57f2c945adc5cf7005cc56d3434368b57b8676046f4d6568edad7a3ceb643ee612984d3f7b9a6615015ab4314430a0bf2e3d12a28704d5e567ab3ff3e
- SSDEEP 196608:TbE/MVfhLSU0TchVqcfAE5boa7Jk7bIlWj5vPECiLUbfgcI6KlV:TbE/6FSUzhVqcfr5kjbIlA3EC5bfgas
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/AnyDesk (DROPSY).exe
File Explorer
-
Dropsy.zip.zip 7.5MB
-
Dropsy - Copia.zip.zip 7.5MB
-
Dropsy - Copia - Copia.zip.zip 7.5MB
-
AnyDesk (DROPSY).exe.exe 8.4MB
-
how to use.txt86B
Dropsy - Copia.zip
- SHA256 6f39f863b9ea3c0591d7100ac9be547013efa149aad14e250515deca47493144
- MD5 0d43c63b847f151456f61786b829e22a
- SHA1 c39d45e4c88a2fe390670dca36c42bbe8d6e6457
- SHA512 57a0e4cfdc348a33ccff05d4209709454972bb63ead20c18eff46905360a85ed8c726c8978810b7f7779941dbc56d8b48ae7be59bce1d7a45b4d722442826c1e
- SSDEEP 196608:jbkTW1LD5cuu7cdlcKLimbJueRbkPbKNMrXrRk84V+thSic6oVn:jbkT2FcuJdlcKLBbwbbKNwlk8XthSuU
- MD5 SHA1 SHA512 SSDEEP
Dropsy - Copia - Copia.zip
- SHA256 8993b87bd1124921bc7ecfb16988757f85072278a9c1a5090c3fadcc474316a5
- MD5 13ff4a42f3e843c38b0299ae23504fee
- SHA1 9b2e63e22c313f1f5affe3f612ee0f30f11f2032
- SHA512 96222325f7c55961e61ddcd30f67a693197c23531b82714dad43977f8deb8c4ad2ae028ee65b00081ccc6fc22361c9be0f1c7bc4ff1072d549aa713bd05b7341
- SSDEEP 196608:obatIzZPhoIodcrXINckxXK83ludbQnidDXzSMQfmV5N1:obate5oIJrXINvxaRbQnIDSMZV5N1
- MD5 SHA1 SHA512 SSDEEP
AnyDesk (DROPSY).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f0c95b09ead49d1fe42e25f6d4f8bbcd3492d28c8f508e45e59feb31f4011c3e
- MD5 473a3c8d7f09e0c24ceedcb639fc3d93
- SHA1 df560493b628b30b43e9ed71e1c419a9465690f6
- SHA512 28e7d47cc85633742139e2188161f1104190e6259eb3b4f274fb3cc7a1a91b6f9a37c804c7a744b4b2feba77b6b6e5c3bcf67aa22a9e29d69152202d9337aa53
- SSDEEP 196608:abstwhbd7KSM/cVBP6uYLDYKFlhbstwhbd7KSM/cVB:abstahKSzVBSrL0ObstahKSzVB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2691580
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.negroni
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.negroni
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
233KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
233KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
179B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
233KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
239KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
how to use.txt
- SHA256 7a633ca1a14158cd7d78473e6a592bca4200235a4baf6e95fb13be00776a77fd
- MD5 ddd34eefef3c42dbfb673c8296aa3717
- SHA1 789071a25f3d139d435ed68b5edfe4501b06b114
- SHA512 38be8d1fcea4452a37ec4de005cb67de87194c0e413d68b99b1384260f91e7dca7deb6fc29879d530ebc7152081be44e797de2d05f82bfcb7a14381b08fc9a42
- MD5 SHA1 SHA512