Moon-Predictor-v2-main.zip
- SHA256 7c466c3a0668cc8ac5a189a374d8e8544c05d53f12c7f84516a5fa5b0ded8244
Behavioral task
behavioral1
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Moon-Predictor-v2-main.zip
- Size 15.3MB
- Sample240816-d1rtsssgne
- SHA256 7c466c3a0668cc8ac5a189a374d8e8544c05d53f12c7f84516a5fa5b0ded8244
- MD5 37ff9f227cba62bc3c853d4b2a356ccf
- SHA1 d5cb38fcb55f1b24ad27bc8d72c990735c0909f2
- SHA512 f43c7dd84ab6d52a5e3a434d639ce2545a4e52c1aa262f51bb4725ca2ee24017c04b776d43f544fa10eb2474feba1f7a5d46c0224f358cd166a2183b6d77043a
- SSDEEP 393216:IvRsHxZ/P5383bl0qUrNoto4sdS2KyzjXbDxCRVHv+wR0:02RZn53iGqc6tondVKy3rlCRtv/0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- An infostealer written in Python and packaged with PyInstaller. 1 IoCs
resource yara_rule static1/unpack002/Creal.pyc crealstealer - Crealstealer family
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll agile_net static1/unpack001/Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll agile_net - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
File Explorer
-
Moon-Predictor-v2-main.zip.zip 15.3MB
-
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll.dll 516KB
-
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll.dll 2.3MB
-
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe.exe 14.2MB
-
Creal.pyc28KB
-
Moon-Predictor-v2-main/Moon-Predictor-v2/README.md822B
-
Moon-Predictor-v2-main/Moon-Predictor-v2/keys & pastebins.txt1KB
-
Moon-Predictor-v2-main/README.md1KB
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a3f02ad6a8f319b352f4ab3222bd57d9699882db065fb344b9828243b1d0015
- MD5 8cd9953ff0283305f3998f6893c7d244
- SHA1 db906639e1b164bb813e3e94e548a4c5549bd36e
- SHA512 3121712026e63ae2c9df423c24511249895e773a5e56f3fd19dff89eefe58042c990afcd7ffba21bf9f181045b9b4d9f439c7e69114f0f9282adbd707558e133
- SSDEEP 12288:MykYXttq4mBpDetgo3DcHGF2HcvHWUSA9uN:iYi4Xt7zcHGFxI+uN
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Digest
5c:77:06:b1:6d:99:75:73:11:ed:06:41:47:14:c8:c3:c0:0b:e3:a1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Sep 14, 2018
SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
08:f8:b2:43:88:63:93:78:21:d1:77:24:80:3c:cf:30
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 7, 2017 - Nov 12, 2018
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
525670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\bunifu\Desktop\Bunifu Framework\Projects\Master\bunifu-framework-winforms-repo\Obfuscation\1.5.4 - secured\Bunifu_UI_v1.5.3.pdb
mscoree
_CorDllMain
Name
.text
Size
506KB
Virtual Size
505KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9143707613cfa106fc4d7177e6e9f8a544738989b6167cd6578101f1bdb0927a
- MD5 b7cf1039d089511ff4594d0796dc966b
- SHA1 e41d50c48f5381da01ed43967d1024fdaaeedd81
- SHA512 6627a7a810c78a94ff1d52b14d071f8aabd71a2e6b521d2fcea7d865d94f5bcb1dd890f1b93b292035b20127507e32c11c215268e00510e5bf28c6132a4ce2a4
- SSDEEP 49152:DpR548WTt9kUHdvAmZL0Th+1n9fr2flQChRigKw1:54JErh0gz1
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
PE Signature issue
Digest
3d:df:5d:b2:b2:94:91:23:65:b9:71:e0:f4:06:2f:b5:3d:76:c3:5d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Jun 22, 2020
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
2390294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ilham\Documents\Visual Studio 2019\Projects\Guna.UI2\Build\Guna.UI2.WinForms\build\.net 4.0\Guna.UI2.pdb
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
- IMPHASH ba5546933531fafa869b1f86a4e2a959
- SHA256 07266653b14ff50a02d0be770e90e102d766cede26e92bd43eb61255c5931fca
- MD5 11afed49123fd774af33550dae13777a
- SHA1 f02c2409c589f76a1639cef002dda5f7f538e98d
- SHA512 303d1eae5e242b0c831bf235705e57d0cb92c65387d7fe7279da364100f402c2212f48972cb6dbb64c951c704ebbd7af2081164bc8884b79064d2ba15e16fd55
- SSDEEP 393216:Hu7L/qdQusl7Q+q9RoWOv+9fav+NNxDnDz:HCLydQu2QdborvSiv+DxDD
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
42656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31937,
count=1, id=258, version=31937,
Creal.pyc
- SHA256 3e9335ab8087295cf9d53b203d0003970ad18578b8bf57cbdef37840c120ea32
- MD5 370838c72bfe99c475b4a67a24d2b989
- SHA1 3b6373953963700a546dcc5d3d7a0e31c78ddb93
- SHA512 27c8679b87bb181de9377514f85550e8ea1d0146bc872ec05aeca2dda91241bdbdcf9606be05170467619e568d0c6d93763ff7738ebc01d84952b32f8fa628b3
- SSDEEP 768:rxbnr6B2MgyUI4AC9Vq71Qmf6AgehmSsLrrFHVFHMHCWn:1brbtvSCAgeR8HMHPn
- MD5 SHA1 SHA512 SSDEEP
-
An infostealer written in Python and packaged with PyInstaller.
Moon-Predictor-v2-main/Moon-Predictor-v2/README.md
- SHA256 f417646ebbbe5a20e9ce6d61dc101285a3f3f6a9825d18e89fff643dc4f167cd
- MD5 bb3194842a44349ef4d088b892b0b604
- SHA1 e05dfd52e09303ed29ead3cfc5fde786065ed928
- SHA512 d6165341747837fe2613b4982b41bdf444629d741fd7778993ee93a292a1e2664cafb7582d35503476907ed2b077caa1c146f3266712c57d5edefa2ed1aabd15
- MD5 SHA1 SHA512
Moon-Predictor-v2-main/Moon-Predictor-v2/keys & pastebins.txt
- SHA256 3b12f3e496cfe49cd04f343e9cbe9b1df995e300ddd3480a6a0c2b3d9bd399f8
- MD5 0f263441109f01d9030b133447b69ef4
- SHA1 863c1c754db24afa7307f0ce7b6a34843e9dc028
- SHA512 19b97c58b6c7da769d0d5bca17d1d7c945f7490749f6624ce22eda1882803bb84a80f07fd726616ce7fe03dacb3c0730d7c60a082951eb2d20a95dd6d4f7f4f4
- MD5 SHA1 SHA512
Moon-Predictor-v2-main/README.md
- SHA256 957adc7f48441c002cc653452755b4b3a5aa90d0a5740fb97e83e646a179618c
- MD5 1dfba5f607e58b75a1e52f824cc0fd63
- SHA1 5251484e4ba429287bf7397ecda1eca20b4e10f1
- SHA512 06144dd9094a5ac775dcae1486a5c2948f80e4a1eb5084302ae80ed8b108124cb7a41d242fc8e28c30d96a68f3a9ce231c79b51b1f396940b6346eafc2a86fbc
- MD5 SHA1 SHA512