Full Tool Scan VPS.zip
- SHA256 95991984767349d93e902eba0487e74688ea5678a92d75a8b50a0852bd215b28
Overview
overview
10Static
static
10Full Tool ...PS.zip
windows10-2004-x64
1Hit Sender...ib.dll
windows10-2004-x64
1Hit Sender...ib.dll
windows10-2004-x64
1Hit Sender...er.exe
windows10-2004-x64
10Hit Sender...rp.dll
windows10-2004-x64
1Hit Sender...er.dll
windows10-2004-x64
1IP Scanner...er.exe
windows10-2004-x64
7ScanIP.pyc
windows10-2004-x64
3KPort Scan...V3.exe
windows10-2004-x64
10KPort Scan...e4.dll
windows10-2004-x64
3KPort Scan...i4.dll
windows10-2004-x64
3KPort Scan...k4.dll
windows10-2004-x64
3MassScan/Input.txt
windows10-2004-x64
1MassScan/M...UI.exe
windows10-2004-x64
3MassScan/Packet.dll
windows10-2004-x64
3MassScan/_config.ini
windows10-2004-x64
1MassScan/masscan.exe
windows10-2004-x64
3MassScan/msvcr100.dll
windows10-2004-x64
3MassScan/w....3.exe
windows10-2004-x64
7$PLUGINSDIR/final.ini
windows10-2004-x64
1$PLUGINSDI...ns.ini
windows10-2004-x64
1MassScan/wpcap.dll
windows10-2004-x64
3NL Brute 2...te.exe
windows10-2004-x64
10NL Brute 2...gs.ini
windows10-2004-x64
1NL Brute 2...pu.exe
windows10-2004-x64
10ScanIP.exe
windows10-2004-x64
7ScanIP.pyc
windows10-2004-x64
3UsefulRDPScript.exe
windows10-2004-x64
7nVNC/bin/config.conf
windows10-2004-x64
3nVNC/input...ds.txt
windows10-2004-x64
1nVNC/nvnc.exe
windows10-2004-x64
7password.txt
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Full Tool Scan VPS.zip
Resource
win10v2004-20240729-en
Behavioral task
behavioral2
Sample
Hit Sender/AxInterop.MSTSCLib.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Hit Sender/Interop.MSTSCLib.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
Hit Sender/NLBrute Hit Sender-Checker.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Hit Sender/RestSharp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
Hit Sender/SkinSoft.VisualStyler.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
IP Scanner (Thay thế cho MassScan chạy trên Guest hoặc không có quyền Administrator)/IP Scanner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
ScanIP.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
KPort Scaner/KPortScan V3.exe
Resource
win10v2004-20240729-en
Behavioral task
behavioral10
Sample
KPort Scaner/QtCore4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
KPort Scaner/QtGui4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
KPort Scaner/QtNetwork4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
MassScan/Input.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
MassScan/Massscan_GUI.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
MassScan/Packet.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
MassScan/_config.ini
Resource
win10v2004-20240729-en
Behavioral task
behavioral17
Sample
MassScan/masscan.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
MassScan/msvcr100.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
MassScan/winpcap-4.3.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/final.ini
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/options.ini
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
MassScan/wpcap.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
NL Brute 2/NLBrute.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
NL Brute 2/settings.ini
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
NL Brute 2/tối uu VPS ram cpu.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral26
Sample
ScanIP.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
ScanIP.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
UsefulRDPScript.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
nVNC/bin/config.conf
Resource
win10v2004-20240709-en
Behavioral task
behavioral30
Sample
nVNC/input/passwords.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
nVNC/nvnc.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral32
Sample
password.txt
Resource
win10v2004-20240709-en
quasar
1.4.0
Office04
128.199.64.220:4782
a6aa1ddd-3810-492e-8728-facd9d5ede65
CB9F9A0F270F5BD4211B4E21054ED956F7A81814
Client.exe
Logs
3000
Quasar Client Startup
SubDir
| resource | yara_rule |
|---|---|
| static1/unpack001/Hit Sender/NLBrute Hit Sender-Checker.exe | family_neshta |
| static1/unpack001/KPort Scaner/KPortScan V3.exe | family_neshta |
| static1/unpack001/NL Brute 2/NLBrute.exe | family_neshta |
| resource | yara_rule |
|---|---|
| static1/unpack001/NL Brute 2/tối uu VPS ram cpu.exe | family_quasar |
| resource | yara_rule |
|---|---|
| static1/unpack001/UsefulRDPScript.exe | upx |
| resource | yara_rule |
|---|---|
| static1/unpack001/IP Scanner (Thay thế cho MassScan chạy trên Guest hoặc không có quyền Administrator)/IP Scanner.exe | pyinstaller |
| static1/unpack001/ScanIP.exe | pyinstaller |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Hit Sender/AxInterop.MSTSCLib.dll |
| unpack001/Hit Sender/Interop.MSTSCLib.dll |
| unpack001/Hit Sender/NLBrute Hit Sender-Checker.exe |
| unpack001/Hit Sender/RestSharp.dll |
| unpack001/Hit Sender/SkinSoft.VisualStyler.dll |
| unpack001/IP Scanner (Thay thế cho MassScan chạy trên Guest hoặc không có quyền Administrator)/IP Scanner.exe |
| unpack001/KPort Scaner/KPortScan V3.exe |
| unpack001/KPort Scaner/QtCore4.dll |
| unpack001/KPort Scaner/QtGui4.dll |
| unpack001/KPort Scaner/QtNetwork4.dll |
| unpack001/MassScan/Massscan_GUI.exe |
| unpack001/MassScan/masscan.exe |
| unpack001/MassScan/winpcap-4.3.exe |
| unpack003/$PLUGINSDIR/InstallOptions.dll |
| unpack003/$PLUGINSDIR/System.dll |
| unpack003/$PLUGINSDIR/nsExec.dll |
| unpack003/$SYSDIR/pthreadVC.dll |
| unpack001/MassScan/wpcap.dll |
| unpack001/NL Brute 2/NLBrute.exe |
| unpack001/NL Brute 2/tối uu VPS ram cpu.exe |
| unpack001/ScanIP.exe |
| unpack001/UsefulRDPScript.exe |
| unpack001/nVNC/nvnc.exe |
| resource | yara_rule |
|---|---|
| static1/unpack001/MassScan/winpcap-4.3.exe | nsis_installer_1 |
| static1/unpack001/MassScan/winpcap-4.3.exe | nsis_installer_2 |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detect Neshta payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=259, version=30795,
count=191, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32420,
count=40, id=261, version=32420,
count=17, id=260, version=32420,
count=9, id=259, version=32420,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=32538,
count=1, id=258, version=32538,
Detect Neshta payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=150, version=20413,
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=272, id=1, productName=Unmarked objects,
count=37, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=198, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=150, version=20413,
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=123, productName=VS2005 build 50727, version=50727,
count=1927, id=1, productName=Unmarked objects,
count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=472, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=150, version=20413,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=793, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=95, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Jun 25, 2010
count=18, id=125, productName=VS2005 build 50727, version=50727,
count=34, id=110, productName=VS2005 build 50727, version=50727,
count=99, id=109, productName=VS2005 build 50727, version=50727,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=121, id=1, productName=Unmarked objects,
count=4, id=113, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=156, productName=VS2010 build 30319, version=30319,
count=12, id=158, productName=VS2010 build 30319, version=30319,
count=20, id=170, productName=VS2010 build 30319, version=30319,
count=2, id=171, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=137, id=1, productName=Unmarked objects,
count=82, id=174, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Jun 11, 2011
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=1, productName=Unmarked objects,
count=490, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=85, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=52, id=175, version=40219,
count=184, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=153, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=72, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=42, version=8803,
count=4, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=44, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Mar 1, 2013
count=19, id=125, productName=VS2005 build 50727, version=50727,
count=34, id=110, productName=VS2005 build 50727, version=50727,
count=99, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=133, id=1, productName=Unmarked objects,
count=5, id=113, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=19, version=8034,
count=54, id=1, productName=Unmarked objects,
count=5, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
Mar 1, 2013
count=2, id=126, version=50327,
count=23, id=125, productName=VS2005 build 50727, version=50727,
count=34, id=110, productName=VS2005 build 50727, version=50727,
count=128, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=149, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=113, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=11, version=8047,
count=24, id=14, version=7299,
count=111, id=10, version=8047,
count=7, id=93, version=2179,
count=136, id=1, productName=Unmarked objects,
count=20, id=10, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Detect Neshta payload
Unsigned PE
Checks for missing Authenticode signature.
Quasar payload
Unsigned PE
Checks for missing Authenticode signature.
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=259, version=30795,
count=191, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32420,
count=40, id=261, version=32420,
count=17, id=260, version=32420,
count=9, id=259, version=32420,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=32538,
count=1, id=258, version=32538,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=152, version=20115,
count=35, id=171, productName=VS2010 build 30319, version=30319,
count=18, id=158, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=1, productName=Unmarked objects,
count=151, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,