General

  • Target

    Glasswire.v3.3.678-ShadowC.rar

  • Size

    100.1MB

  • MD5

    85a7ad3ba76014c32df9fb8111cb296d

  • SHA1

    85e86c9b44969de72b7808a8bd5d826dc2e843a7

  • SHA256

    e17c9dee276ae0886bfc148fdf02f3d6eee8b8e2ba7d5421e277ee525eb032cd

  • SHA512

    6d85d2dbed11572676b1ff2eed107e6df0ad475aff60c4eec76c9599eab96ccaa206147ebe58b6208c71c4e58c5c73be8f10b484fe0bbb0a44dd3a30e1117e4c

  • SSDEEP

    3145728:x0SU7EJvrl7+C3AoNg35Zg12fC5snjxHMsyNtQOJh1Gq:+voJvrlJ3Aoym12KsFHEPh/

Score
7/10

Malware Config

Signatures

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • Glasswire.v3.3.678-ShadowC.rar
    .rar
  • !!!Readme_first!!!!.txt
  • Crack/GWCtlSrv.exe
    .exe windows:6 windows x86 arch:x86

    857b71eab0bd451a0f66d57166f2b851


    Headers

    Imports

    Exports

    Sections

  • Crack/GlassWire.exe
    .exe windows:6 windows x86 arch:x86

    8f40bc3b0302564283e2198aea75bc63


    Headers

    Imports

    Exports

    Sections

  • GlassWireSetup_3.3.678.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Headers

    Imports

    Sections

  • $APPDATA/GlassWire/share/storage.db
  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    646971a3aef724d6f553f40ae84fe26b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • $PLUGINSDIR/vc_redist.x86.exe
    .exe windows:5 windows x86 arch:x86

    1a5cdbf711fee14b077e599d13fddab2


    Code Sign

    Headers

    Imports

    Sections

  • GWCtlSrv.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWEventLog.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWIdlMon.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUnlock.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUpgradeMonitor.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GlassWire.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    92fc526ad6d9674f09604104cfa57819


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    443275a6eb00ad3c85c2bc9c3fc2da3e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5OpenGL.dll
    .dll windows:6 windows x86 arch:x86

    001e5e687428b22462285c2750754dae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    079b726a4a2f3a027f09f1cb4e2ed381


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    7485e296f2ad020a3dedc3de1b20dcfc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WinExtras.dll
    .dll windows:6 windows x86 arch:x86

    6a5932ee8dcef2f266e2e0e799f280b3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • copyrights/ASIO-LICENSE_1_0.txt
  • copyrights/CURL-COPYING.txt
  • copyrights/GEOIP-LICENSE.txt
  • copyrights/GEOLITE2-COPYRIGHT.txt
  • copyrights/GEOLITE2-LICENSE.txt
  • copyrights/LZ4-LICENSE.txt
  • copyrights/OPENSSL-LICENSE.txt
  • copyrights/PROTOBYUF-LICENSE.txt
  • copyrights/QT-LICENSE.GPL3-EXCEPT.txt
  • copyrights/QT-LICENSE.txt
  • copyrights/RAPIDJSON-LICENSE.txt
  • copyrights/RAPIDXML-LICENSE.txt
  • copyrights/RECOG-COPYING.txt
  • copyrights/RLOTTIE-COPYING.MIT.txt
  • copyrights/SQLITE-COPYING.txt
  • copyrights/ZLIB-LICENSE.txt
  • driver/win-x64/gwdrv.cat
  • driver/win-x64/gwdrv.inf
  • driver/win-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win-x86/gwdrv.cat
  • driver/win-x86/gwdrv.inf
  • driver/win-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x64/gwdrv.cat
  • driver/win7-x64/gwdrv.inf
  • driver/win7-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x86/gwdrv.cat
  • driver/win7-x86/gwdrv.inf
  • driver/win7-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • iconengines/qsvgicon.dll
    .dll windows:6 windows x86 arch:x86

    e2a8abb2f62e90497419fca861c4de3a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    b127d2b5eb2d64741e8cf3a684f53083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lang/de_de.qm
  • lang/en_gb.qm
  • lang/en_us.qm
  • lang/es_es.qm
  • lang/fr_fr.qm
  • lang/it_it.qm
  • lang/ja_jp.qm
  • lang/ko_kr.qm
  • lang/pl_pl.qm
  • lang/pt_br.qm
  • lang/ru_ru.qm
  • lang/tr_tr.qm
  • lang/zh_cn.qm
  • lang/zh_tw.qm
  • platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    29ed2e73839186c2a3b5a58cddc0eb48


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/windows.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Join Telegram QR.png
    .png
    • https://t.me/cracksurldotcom

  • Join Telegram for more.url
    .url
  • Read.txt
  • Start GlassWire Service.bat
    .bat .vbs
  • Stop GlassWire Service.bat
    .bat .vbs