Calamari.zip
- SHA256 e232359fdbaa1d46dcf56a5715a0ba4c700c93fb310f551a4a3afa912afdaed1
Behavioral task
behavioral1
Sample
Calamari/Calamari.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
Calamari/ScintillaNET.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Calamari/SynapseZAPI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Calamari/sxlib.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Calamari.zip
- Size 5.8MB
- Sample240815-lgedcswdnf
- SHA256 e232359fdbaa1d46dcf56a5715a0ba4c700c93fb310f551a4a3afa912afdaed1
- MD5 5321acff16bbe68a2942c9c655f9e4fc
- SHA1 56f82061cb7d044c89470c01e7805cb2365c0bb9
- SHA512 affb725177d76f3f8f86660f690e0d87a1a52198594334600d5c8b4a1653d6af83caaa74998e1b6c8a0e0891395acd2286cd03ecea26ea7b94694eac35279910
- SSDEEP 98304:sz+Uh4HB/jiVvRDHe4HTd2R1QXhHCUvy9eL9ZB1oY5/ZSXX0TFkGaZp3GfcWxfvo:wh4hqHRzo/6ha94B3k+uPZ5ScWNv5m
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect ZGRat V2 1 IoCs
resource yara_rule static1/unpack001/Calamari/sxlib.dll family_zgrat_v2 - Zgrat family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Calamari/Calamari.exe unpack001/Calamari/ScintillaNET.dll unpack001/Calamari/SynapseZAPI.dll unpack001/Calamari/sxlib.dll
File Explorer
-
Calamari.zip.zip 5.8MB
-
Calamari/Calamari.exe.exe 154KB
-
Calamari/ScintillaNET.dll.dll 1.3MB
-
Calamari/SynapseZAPI.dll.dll 6KB
-
Calamari/crashlogs/1812_15316.txt29KB
-
Calamari/jacked_up.mp34.0MB
-
Calamari/sxlib.dll.dll 864KB
Calamari/Calamari.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f7071d56098ef0a448b562760ea2f547e4a2f8d26fc4e456b6e6ed47445cc20
- MD5 3bb68e459405f9d621fea08fca8db99e
- SHA1 a667438af4a30700d229752df30f423f169c1186
- SHA512 69788e7b8a0a5cae8fb85f31cd63c735343b11128da1be0c71414c41973ad9246487915b24eb40436ba104a3851f0848e902f7c9cb9a084255420eff4a49478b
- SSDEEP 1536:A//X0u8/LwqNlRtXCPF9tdyB6nW6b22ehN8OIZG9Fwk0eL/qzCU27yHi+tdGtdtw:A30tT9tXCPLKB6nT6UPk0eT0w2i+ulw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
158794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Shadow\Downloads\2\Calamari\obj\x86\Debug\Calamari.pdb
mscoree
_CorExeMain
Name
.text
Size
147KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Calamari/ScintillaNET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
- MD5 9166536c31f4e725e6befe85e2889a4b
- SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
- SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562
- SSDEEP 24576:IJSShz305vgNF7/cOCPHPSVs4Eq+QTNX+cfQdS+2MMPishd/Ws5:ti0aNvoHqs4L95X+cfx/HGC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1373218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\jacob\Documents\Projects\ScintillaNET\src\ScintillaNET\obj\Release\ScintillaNET.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Calamari/SynapseZAPI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4ee4111409c6d9e9e82b846798ffd1b404d7fce49a0429421c7d5be540edcceb
- MD5 877e3d22c496d3441bb9eb54965babc5
- SHA1 73912c32638e8acb0097b59c25c62b29bc0f47cc
- SHA512 633a2fab8b13a6ca8e884917c77f0a67e6452164373b9c2fcd0ad7c5e5d329aa2a297e7adee40e047afc71d94b50ecc733783aa9a41a7630d298752ae939a6db
- SSDEEP 96:fW/SK+J1JpYmmmPbtbU1sn/32F0TLVV3wmoeVfjVH:x9myCCn/7LVV5NNj1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\tahae\source\repos\SynapseZAPI\SynapseZAPI\obj\Debug\SynapseZAPI.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Calamari/crashlogs/1812_15316.txt
- SHA256 da85797ae8f87a198dd0d30e9a2e84af5687390aab063bc0a53b7c7fce17d9ac
- MD5 d7d212e86ea2413bcf0f5d9f7a04dddd
- SHA1 d5dfdb2364a9b957c9d30fff7b80036e565c8f1b
- SHA512 6cf3c15cf69510652239679fc12f46c2c46af36433796593eccca166d6b85408cddb8e614afeda21e52e172c2eba9ae56c5e187f805ae44cd6908061ec084b21
- SSDEEP 384:jI6yLDHAUjP6yLDHAUjCkw3/uM3N27UEeZMA7DTf4sL:kx1Px1CkwuoXf7ft
- MD5 SHA1 SHA512 SSDEEP
Calamari/jacked_up.mp3
- SHA256 fd0aa203f284a09dab3b6a24118db8ed30ad5fad2591b3367111bf27eb4df617
- MD5 66ec6b7ee0786cba5a3ae13e4e4e20ba
- SHA1 612861268f56692069b60a0218826cbf8e593ede
- SHA512 6ad4182771b0e983394a4446b61eb6b43793b6db85a3e9035823b053594ae88bbd5da595b83e817b4739f2b4c5dd209546e4264a76d397c9ad71771a64329d3b
- SSDEEP 98304:Tz9Vs3NlAYgX+bHn8DqaXP8J3tqnZaAITKdNi5zAwY:TzyNCYbbHEI0ZOTUjwY
- MD5 SHA1 SHA512 SSDEEP
Calamari/sxlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 904a9329bf56d110adec486f37411831a1148934a5ca4bbff9e33a1ca8ce5bcb
- MD5 d00e1627d7536022dd81aeb27577221c
- SHA1 56a1f78e5acc89b97b02652f61a154265511ffcf
- SHA512 d7cb95dd515f1edfde7e17681563bf5b709ac06f33805ce70dbcb76aca4ee34061c5201a54e1a92d67a1fb8f59512c8a64fcbb201fc88e5536001e40489dab69
- SSDEEP 12288:EnfEbmXVMomkzPuY6TZNPERW1v+wUGx6tEhPaZLuabPIkLOh/1K9FaUQmUFv7SZR:WhziXGGv+T8wECFIMOYHUv7S/WkuvA
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V2
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
890522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
862KB
Virtual Size
861KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ