TT ViewBot v3.7.zip
- SHA256 d46fea1913a10aa5cd4d1a7815b44bb93750bc06e2673857a0c314704a518a59
Password
ttbot
Overview
overview
10Static
static
10TT ViewBot...sts.py
windows7-x64
3TT ViewBot...sts.py
windows10-2004-x64
3TT ViewBot...xie.py
windows7-x64
3TT ViewBot...xie.py
windows10-2004-x64
3TT ViewBot...ent.py
windows7-x64
3TT ViewBot...ent.py
windows10-2004-x64
3TT ViewBot...rt.exe
windows7-x64
10TT ViewBot...rt.exe
windows10-2004-x64
10TT ViewBot...tup.py
windows7-x64
3TT ViewBot...tup.py
windows10-2004-x64
3Behavioral task
behavioral1
Sample
TT ViewBot v3.7/Data/Lists.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
TT ViewBot v3.7/Data/Lists.py
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
TT ViewBot v3.7/Data/ScrapProxie.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
TT ViewBot v3.7/Data/ScrapProxie.py
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
TT ViewBot v3.7/Data/UserAgent.py
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
TT ViewBot v3.7/Data/UserAgent.py
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
TT ViewBot v3.7/bot_start.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
TT ViewBot v3.7/bot_start.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
TT ViewBot v3.7/setup.py
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
TT ViewBot v3.7/setup.py
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target TT ViewBot v3.7.zip
- Size 266KB
- Sample240827-precws1bkd
- SHA256 d46fea1913a10aa5cd4d1a7815b44bb93750bc06e2673857a0c314704a518a59
- MD5 e46d36d1360b8457c032b66c6daff409
- SHA1 bdfc45dc35f9d373e50cb537b87a8f8e5320ca47
- SHA512 3d82ea94f04cb8ef973ca41eec465aa6e61710523fd2dab6c993ae25f8ef464f80700047f878452ea790bc57780b94a002425e6b076e3537bca2da1637a6fcb3
- SSDEEP 6144:k97VDohTUgnNiQeDveFdGnP710V6A2F8f7kE8ISFqRaVZSV5Ve4HPc:k9hDoBUI9ebeFu710VsCQEsFqRVe4vc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PureLog Stealer payload 1 IoCs
resource yara_rule static1/unpack001/TT ViewBot v3.7/bot_start.exe family_purelog_stealer - Purelogstealer family
File Explorer
-
TT ViewBot v3.7.zip.zip 266KB
-
TT ViewBot v3.7/.gitignore2KB
-
TT ViewBot v3.7/Data/Lists.py2KB
-
TT ViewBot v3.7/Data/Proxies.txt412KB
-
TT ViewBot v3.7/Data/ScrapProxie.py8KB
-
TT ViewBot v3.7/Data/UserAgent.py1.0MB
-
TT ViewBot v3.7/LICENSE1KB
-
TT ViewBot v3.7/README.md1KB
-
TT ViewBot v3.7/bot_start.exe.exe 197KB
-
TT ViewBot v3.7/setup.py941B
TT ViewBot v3.7/.gitignore
- SHA256 fcc9443ae95fc4cfd56aed31937d8060e03212a92707615fed5ee59e0b38def6
- MD5 da211c7c93bf4e8861af1dc2616c9548
- SHA1 eb7d1ec41dbdbf2a89c4c62000b0f6b8313d8c15
- SHA512 75c7e19808d263a91d226722d36f5c93cfa02607557977abe10e6c79714e012c98182fabb048e630ec647c937246a29deb5a888419cc00cb4b195c378918b7de
- MD5 SHA1 SHA512
TT ViewBot v3.7/Data/Lists.py
- SHA256 b21702251cf0e88c166088d4e08294b2b0c2f961da8056ac48c735243d554279
- MD5 58b844082767dd40b291276087b6323b
- SHA1 41748aed3409eeb4be7a8d53b98a81fcfff2323d
- SHA512 f50268442358d511424d649603ce701cda7bb885cdfe005c8fbcdbde2b47784102b7196438d664ef4c32b5c317ad9e9b8ec7f1ed741d3aef399f378149c61547
- MD5 SHA1 SHA512
TT ViewBot v3.7/Data/Proxies.txt
- SHA256 23725e00d9dacec4e1fdc3c2a2fb7d20743873a1f9cf9d66d0cd0069e70cb0b3
- MD5 479410925b7fca43cfd87c5867cc65f2
- SHA1 af0baeafb8614455a111f206f21fe59178b8417d
- SHA512 fc78d7aa7b857850f4599cd9a209daeb386d7e2ecad1e3b5dd81befae97d2c8f94001d91260fc3468236b4729a9ff4a36d78422c24024a2a5caa178b347220a1
- SSDEEP 3072:KN8g/BwMNyWrUMLmshrPlwDS4MYXLr0RrC:AWMx0ePy/
- MD5 SHA1 SHA512 SSDEEP
TT ViewBot v3.7/Data/ScrapProxie.py
- SHA256 8fd6afc4c92b8c65eb96a7493e559c83449578fcf178e20d9d126b411eead5e5
- MD5 005e6b6cd75e6fd6040731c64494e537
- SHA1 86f24fc5aad569829e0651bdcd607168c19c58f6
- SHA512 a16848eda731c6e7591b94a7291095a19fca11ecdd2e4b1e55306f28b288bc473f2bad97bb505c0c8fd4d3a7e7227103427ac5aed1bf6bd3b21f6bce3e785931
- SSDEEP 96:QSGcG6lghWnE559ZlWoxKMk59Vp+pvey9t9c9xsRvRxY1K7DpCgkTli:P659ZwoxKMW9Vp+pmYHexscU9j
- MD5 SHA1 SHA512 SSDEEP
TT ViewBot v3.7/Data/UserAgent.py
- SHA256 8ec04b593bbf03b344809ebca690dcec7bc082bccd0e28d3b4931b371ab044c9
- MD5 0c9b29e6b8291144a8a1c7b190accbe5
- SHA1 a5946876fb6de43a28c9b3d3b783c755f74f41f1
- SHA512 cc8ad93051da8b447064d4c3dbaab624b8fa4516874358a1dfe2d52ac03a87f104b6cae8b036c42c87c7d9b1946138d9a0f4f7f5ed2db62b0a771901e1ec5cfe
- SSDEEP 384:UKxzhaSY5IiEgeBLPxKQheqwF3zdU49rdobwjkH6g6QcOHcoR8AnaREHszt3Y3fO:e
- MD5 SHA1 SHA512 SSDEEP
TT ViewBot v3.7/LICENSE
- SHA256 98dc91fe998ed0c083e5f54bd7b4b86455db81cbe0f90833d6eb1c029f4c49b8
- MD5 92cd1aa46af18db848c738b5381d5776
- SHA1 c641b7693442a778b4103b633e533efdc8f62f4a
- SHA512 00468089eb4186f41ced4518f0dcf43b7defdd06a6100e7a3758c6b2639a1c6bc5be3ea0daa9cb6cd9b663d6aac14bd330899d10bf61fdfe1aafc4a54bef93b9
- MD5 SHA1 SHA512
TT ViewBot v3.7/README.md
- SHA256 04ac4efd3bba8ac958cd3a73fef70715703c62f8deb962d12b13249c7b2ae3f6
- MD5 a7a864f27133423e30394af410cb4782
- SHA1 b8d68d24ac5f3e77ded17db50a0da503f052ddcb
- SHA512 3948d046f0d49116a2112f229cb273a91cfd217b9b5aefe9eec5a5954bf5377be4cb05984b1313a3ea4deb847084ed84f2fb3f987dc14e1752b85088e8c1ba50
- MD5 SHA1 SHA512
TT ViewBot v3.7/bot_start.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c4174541aa2cef599aee7a376e5de3393446f0018a850fcf1c6658da9692bed5
- MD5 9c29f4415a735c3d9ee26ca06385d502
- SHA1 127b2d6c2e63bf3ff6fb8fb055a272e088fd851d
- SHA512 ac2cf91b4ef1dc72c10d5affa83305aa011b733ffc7ce10b87efe8e91d2a9dda72a52a3806f8a20e6bd02a1873677d74a793d5359c8e235bf64fdd23946927d6
- SSDEEP 1536:cHc9JW77pHtDEOFYPUh7N9H/sPafochTLZ61tISqS9HwRXBuS7pR72BfLJFBLbbI:ayy9HwSLZ6vTjHwBBybvIJe9
- MD5 SHA1 SHA512 SSDEEP
-
PureLog Stealer payload
Password
ttbot
PE Signature issue
Digest
0e:e5:90:4c:ce:a6:8f:0a:7e:98:8a:66:32:47:94:a0:14:a1:2c:95:7d:3a:4d:9d:70:74:2d:8f:88:03:c1:e7
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 11, 2024
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 8, 2024 - Apr 10, 2027
Subject
CN=Dummy certificate
Serial Number
01
Issuer
CN=Dummy issuer
Timespan
Jan 1, 2013 - Apr 1, 2013
Minor OS version
0
Major OS version
4
Entry point
84862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
103KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TT ViewBot v3.7/setup.py
- SHA256 1291ef03e04110780a294bb9608358901fb86ea235840fbd49ffe7beeb6c4da4
- MD5 eda4ba41910e22351b9181d552cf3b1c
- SHA1 bf2fa5977b13b6ae80a4a1915d8025f75eca16fd
- SHA512 1f6bcfd592c408acc45ec680ca78d01f15ed5ff3a7aaa632410923f4b661de671d9a5db6dd14b1695dcad37979b053df2d9d3067be8d5a51687bc583fda89ed2
- MD5 SHA1 SHA512