Static task
static1
Behavioral task
behavioral1
Sample
FluxTeam.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FluxTeam.zip
Resource
win10v2004-20240802-en
General
-
Target
FluxTeam.zip
-
Size
3.5MB
-
MD5
d54ba02d1dc5d2657fc8815ccbc5dbd7
-
SHA1
ce2eb1548f7e7f415f1f8697b2e8c106dfa7fd06
-
SHA256
26f3f32217643e86c2f281572ceb22258bb8f9620b09703cc8ad497bf41cb781
-
SHA512
68c05a55ed06e825c16b9e80d07f4884cde72171f0853fa74aab3776ff1b8e8491236bdeb6886589c22d6a922c036a59f142beca5404d6fe65e0ffd5d20feba3
-
SSDEEP
98304:QhYgt6wasLrZw/D7vnxUF1bc+mz9Hv66O:QhDtkf6boHvo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FluxTeam/bin/API.dll
Files
-
FluxTeam.zip.zip
-
FluxTeam/FluxTeam.exe.config.xml
-
FluxTeam/FluxTeam.pdb
-
FluxTeam/Guna.UI2.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:dbCertificate
IssuerCN=Sobatdata Root CANot Before23/10/2019, 05:22Not After22/10/2025, 17:00SubjectCN=Sobatdata Software0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before29/03/2022, 00:00Not After14/03/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
53:fe:48:3a:4e:3f:2b:3b:e3:71:7e:2b:07:d1:02:37:21:e1:7a:86Signer
Actual PE Digest53:fe:48:3a:4e:3f:2b:3b:e3:71:7e:2b:07:d1:02:37:21:e1:7a:86Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Guna.UI2.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
FluxTeam/Monaco/Monaco.html.js
-
FluxTeam/Monaco/base.txt
-
FluxTeam/Monaco/classfunc.txt
-
FluxTeam/Monaco/globalf.txt
-
FluxTeam/Monaco/globalns.txt
-
FluxTeam/Monaco/globalv.txt
-
FluxTeam/Monaco/vs/base/worker/workerMain.js.js
-
FluxTeam/Monaco/vs/basic-languages/bat/bat.js
-
FluxTeam/Monaco/vs/basic-languages/coffee/coffee.js
-
FluxTeam/Monaco/vs/basic-languages/cpp/cpp.js
-
FluxTeam/Monaco/vs/basic-languages/csharp/csharp.js
-
FluxTeam/Monaco/vs/basic-languages/csp/csp.js
-
FluxTeam/Monaco/vs/basic-languages/css/css.js
-
FluxTeam/Monaco/vs/basic-languages/dockerfile/dockerfile.js
-
FluxTeam/Monaco/vs/basic-languages/fsharp/fsharp.js
-
FluxTeam/Monaco/vs/basic-languages/go/go.js
-
FluxTeam/Monaco/vs/basic-languages/handlebars/handlebars.js.js
-
FluxTeam/Monaco/vs/basic-languages/html/html.js.js
-
FluxTeam/Monaco/vs/basic-languages/ini/ini.js
-
FluxTeam/Monaco/vs/basic-languages/java/java.js
-
FluxTeam/Monaco/vs/basic-languages/less/less.js
-
FluxTeam/Monaco/vs/basic-languages/lua/lua.js
-
FluxTeam/Monaco/vs/basic-languages/markdown/markdown.js.js
-
FluxTeam/Monaco/vs/basic-languages/msdax/msdax.js
-
FluxTeam/Monaco/vs/basic-languages/mysql/mysql.js
-
FluxTeam/Monaco/vs/basic-languages/objective-c/objective-c.js
-
FluxTeam/Monaco/vs/basic-languages/pgsql/pgsql.js
-
FluxTeam/Monaco/vs/basic-languages/php/php.js
-
FluxTeam/Monaco/vs/basic-languages/postiats/postiats.js
-
FluxTeam/Monaco/vs/basic-languages/powershell/powershell.js
-
FluxTeam/Monaco/vs/basic-languages/pug/pug.js
-
FluxTeam/Monaco/vs/basic-languages/python/python.js
-
FluxTeam/Monaco/vs/basic-languages/r/r.js
-
FluxTeam/Monaco/vs/basic-languages/razor/razor.js.js
-
FluxTeam/Monaco/vs/basic-languages/redis/redis.js
-
FluxTeam/Monaco/vs/basic-languages/redshift/redshift.js
-
FluxTeam/Monaco/vs/basic-languages/ruby/ruby.js
-
FluxTeam/Monaco/vs/basic-languages/rust/rust.js
-
FluxTeam/Monaco/vs/basic-languages/sb/sb.js
-
FluxTeam/Monaco/vs/basic-languages/scss/scss.js
-
FluxTeam/Monaco/vs/basic-languages/solidity/solidity.js
-
FluxTeam/Monaco/vs/basic-languages/sql/sql.js
-
FluxTeam/Monaco/vs/basic-languages/st/st.js
-
FluxTeam/Monaco/vs/basic-languages/swift/swift.js
-
FluxTeam/Monaco/vs/basic-languages/vb/vb.js
-
FluxTeam/Monaco/vs/basic-languages/xml/xml.js
-
FluxTeam/Monaco/vs/basic-languages/yaml/yaml.js
-
FluxTeam/Monaco/vs/editor/contrib/suggest/media/String_16x.svg
-
FluxTeam/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
-
FluxTeam/Monaco/vs/editor/editor.main.css
-
FluxTeam/Monaco/vs/editor/editor.main.js.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.de.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.es.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.fr.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.it.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.ja.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.ko.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.ru.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.zh-cn.js
-
FluxTeam/Monaco/vs/editor/editor.main.nls.zh-tw.js
-
FluxTeam/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
-
FluxTeam/Monaco/vs/language/css/cssMode.js.js
-
FluxTeam/Monaco/vs/language/css/cssWorker.js.js
-
FluxTeam/Monaco/vs/language/html/htmlMode.js.js
-
FluxTeam/Monaco/vs/language/html/htmlWorker.js.js
-
FluxTeam/Monaco/vs/language/json/jsonMode.js.js
-
FluxTeam/Monaco/vs/language/json/jsonWorker.js.js
-
FluxTeam/Monaco/vs/language/typescript/lib/typescriptServices.js.js
-
FluxTeam/Monaco/vs/language/typescript/tsMode.js.js
-
FluxTeam/Monaco/vs/language/typescript/tsWorker.js.js
-
FluxTeam/Monaco/vs/loader.js.js
-
FluxTeam/Siticone.UI.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:aeCertificate
IssuerCN=Siticone Root CANot Before05/02/2020, 06:42Not After22/10/2030, 17:00SubjectCN=Siticone Technology03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate
IssuerCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before22/10/2014, 00:00Not After22/10/2024, 00:00SubjectCN=DigiCert Timestamp Responder,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10/11/2006, 00:00Not After10/11/2021, 00:00SubjectCN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0Signer
Actual PE Digest34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
FluxTeam/bin/API.dll.dll windows:6 windows x64 arch:x64
dfd11645eb4732c0409f51f0532c3683
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\llama\Downloads\compiler-src-main\compiler-src-main\x64\Release\incognito-luau.pdb
Imports
kernel32
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??Bid@locale@std@@QEAA_KXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
__std_exception_destroy
memcmp
memcpy
memmove
__std_exception_copy
_purecall
__std_type_info_destroy_list
memset
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
strchr
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fflush
ungetc
fsetpos
fwrite
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf
_get_stream_buffer_pointers
fgetc
setvbuf
fgetpos
fclose
_fseeki64
fread
fputc
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_errno
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_invalid_parameter_noinfo
_configure_narrow_argv
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
strnlen
islower
isdigit
ispunct
isalnum
isxdigit
isalpha
strncpy
isupper
isgraph
toupper
strpbrk
strncat
strcspn
isspace
strspn
tolower
iscntrl
strcpy_s
strcmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
_aligned_malloc
api-ms-win-crt-math-l1-1-0
asin
log2
acos
fmod
tan
log
atan2
cos
ldexp
frexp
tanh
pow
cosh
log10
modf
sin
atan
round
sqrt
floorf
sinh
_dsign
exp
floor
ceilf
ceil
api-ms-win-crt-convert-l1-1-0
strtoull
strtod
atoi
strtoul
api-ms-win-crt-time-l1-1-0
clock
_time64
strftime
_localtime64_s
_gmtime64_s
_difftime64
Exports
Exports
RBXCompile
RBXDecompress
RBXRawCompile
Setup
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 195KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
FluxTeam/workspace/.tests/appendfile.txt
-
FluxTeam/workspace/.tests/getcustomasset.txt
-
FluxTeam/workspace/.tests/isfile.txt
-
FluxTeam/workspace/.tests/listfiles/test_1.txt
-
FluxTeam/workspace/.tests/listfiles/test_2.txt
-
FluxTeam/workspace/.tests/readfile.txt
-
FluxTeam/workspace/.tests/writefile
-
FluxTeam/workspace/.tests/writefile.txt