General

  • Target

    Wind.zip

  • Size

    1.3MB

  • MD5

    fbc114af4bbb80bfdd5a1b51b71f691f

  • SHA1

    87eebee2bb311cf2cf2e98dc6476edbbb6353bf0

  • SHA256

    c4653a0b919de064dd8ddd09b70dce7c5ebb1224a2316af9b2c111ae63f963c5

  • SHA512

    9f5957eaa963cf7e5ae3a762b0e5693c1e8a13566a26483a91daa41d2a48a0ec6cb74326ce1b8bb4732a4d30defa6782898811d76fd93e95008dbb6c475c3c8f

  • SSDEEP

    24576:X/piT5UOxsNemQDqlxxCRNCezxT91D67DkKVqNy+PhnLW2YNJ:BiT6OxsImQDqZCXDFOWImEJJ

Score
3/10

Malware Config

Signatures

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • Wind.zip
    .zip

    Password: Wind24

  • Wind/libcurl.dll
    .dll windows:6 windows x64 arch:x64

    Password: Wind24

    86466c337c0f4054f390a6d67e4d3ebf


    Headers

    Imports

    Exports

    Sections

  • Wind/windinject.exe
    .exe windows:6 windows x64 arch:x64

    Password: Wind24

    f4a328fbb9c60c7e1bd2a62c5a0780fe


    Headers

    Imports

    Sections

  • Wind/workspace/.tests/appendfile.txt
  • Wind/workspace/.tests/getcustomasset.txt
  • Wind/workspace/.tests/isfile.txt
  • Wind/workspace/.tests/listfiles/test_1.txt
  • Wind/workspace/.tests/listfiles/test_2.txt
  • Wind/workspace/.tests/loadfile.txt
  • Wind/workspace/.tests/readfile.txt
  • Wind/workspace/.tests/writefile
  • Wind/workspace/.tests/writefile.txt
  • Wind/workspace/Rayfield/Configurations/nuthub.rfld
  • Wind/workspace/Rayfield/Discord Invites/RBWHsYtbgJ.rfld
  • Wind/workspace/UQMP9VS6AJxBjr7.lua
  • Wind/workspace/cache/image1146.png
  • Wind/workspace/redz library V5.lua
  • Wind/workspace/taxibossautomoney.txt
  • Wind/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    Password: Wind24

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Wind/zlib1.dll
    .dll windows:6 windows x64 arch:x64

    Password: Wind24

    d879d2294039900ef484e0f01607f882


    Headers

    Imports

    Exports

    Sections

  • Wind/zstd.dll
    .dll windows:6 windows x64 arch:x64

    Password: Wind24

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections