Resubmissions

09-09-2024 11:30

240909-nmmb9sxgle 6

09-09-2024 11:29

240909-nl2qkavgkm 6

General

  • Target

    Zorara2.4V2.zip

  • Size

    20.1MB

  • MD5

    9bb1e73c0b4e04d6a40dc1ee30b5c65d

  • SHA1

    91fcb83bb9861603a136e5f63bb4aa05cbfe0c0a

  • SHA256

    b972896caf4b255120b134929b297eb7ab80f4250e4e54c1809584d0a8f0433d

  • SHA512

    3de1a6b498a1371fd6f63228dd013c52599cab5820ba1b81c8d851bc736e49d618cf479207bc39e1b096f65c050baf272288911a3034c9c4054642817beff9cb

  • SSDEEP

    393216:n//YOuZen7/YzZWZCTKW9d4Bs5SsjXZCUdqQqhcpmJAe:/1uZnzZWQdks5FZiQtcJV

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • Zorara2.4V2.zip
    .zip
  • Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Zorara.dll
    .dll windows:6 windows x64 arch:x64

    1918dd44e1d0953258810b897966c79b


    Headers

    Imports

    Exports

    Sections

  • ZoraraUI.deps.json
  • ZoraraUI.dll
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • ZoraraUI.exe
    .exe windows:6 windows x64 arch:x64

    6a91eb82bfd19d2706c7d43c46f7064e


    Headers

    Imports

    Sections

  • ZoraraUI.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-66DDADE0-2C9C.pma
  • ZoraraUI.exe.WebView2/EBWebView/Crashpad/settings.dat
  • ZoraraUI.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
  • ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
  • ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
  • ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
  • ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
  • ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001
    .gz
  • f_000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/Code Cache/js/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/Code Cache/js/index-dir/the-real-index
  • ZoraraUI.exe.WebView2/EBWebView/Default/Code Cache/wasm/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/Code Cache/wasm/index-dir/the-real-index
  • ZoraraUI.exe.WebView2/EBWebView/Default/DIPS
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_0
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_1
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_2
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_3
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_0
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_1
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_2
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_3
  • ZoraraUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/EdgeEDrop/EdgeEDropSQLite.db
  • ZoraraUI.exe.WebView2/EBWebView/Default/EdgeHubAppUsage/EdgeHubAppUsageSQLite.db
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Rules/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Rules/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Rules/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Rules/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Scripts/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Scripts/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Scripts/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension Scripts/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension State/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension State/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension State/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension State/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/Extension State/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/ExtensionActivityComp
  • ZoraraUI.exe.WebView2/EBWebView/Default/ExtensionActivityEdge
  • ZoraraUI.exe.WebView2/EBWebView/Default/Favicons
  • ZoraraUI.exe.WebView2/EBWebView/Default/GPUCache/data_0
  • ZoraraUI.exe.WebView2/EBWebView/Default/GPUCache/data_1
  • ZoraraUI.exe.WebView2/EBWebView/Default/GPUCache/data_2
  • ZoraraUI.exe.WebView2/EBWebView/Default/GPUCache/data_3
  • ZoraraUI.exe.WebView2/EBWebView/Default/GPUCache/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/History
  • ZoraraUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Login Data
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network Action Predictor
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/Cookies
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/Network Persistent State
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/Reporting and NEL
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/SCT Auditing Pending Reports
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/Sdch Dictionaries
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/TransportSecurity
  • ZoraraUI.exe.WebView2/EBWebView/Default/Network/Trust Tokens
  • ZoraraUI.exe.WebView2/EBWebView/Default/Preferences
  • ZoraraUI.exe.WebView2/EBWebView/Default/PreferredApps
  • ZoraraUI.exe.WebView2/EBWebView/Default/README
  • ZoraraUI.exe.WebView2/EBWebView/Default/Safe Browsing Network/Safe Browsing Cookies
  • ZoraraUI.exe.WebView2/EBWebView/Default/Secure Preferences
  • ZoraraUI.exe.WebView2/EBWebView/Default/Session Storage/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/Session Storage/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Session Storage/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Session Storage/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/Session Storage/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index
  • ZoraraUI.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index-dir/the-real-index
  • ZoraraUI.exe.WebView2/EBWebView/Default/Shared Dictionary/db
  • ZoraraUI.exe.WebView2/EBWebView/Default/SharedStorage
  • ZoraraUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/Top Sites
  • ZoraraUI.exe.WebView2/EBWebView/Default/Visited Links
  • ZoraraUI.exe.WebView2/EBWebView/Default/Web Data
  • ZoraraUI.exe.WebView2/EBWebView/Default/heavy_ad_intervention_opt_out.db
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/000003.log
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/CURRENT
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG.old
  • ZoraraUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/MANIFEST-000001
  • ZoraraUI.exe.WebView2/EBWebView/GrShaderCache/data_0
  • ZoraraUI.exe.WebView2/EBWebView/GrShaderCache/data_1
  • ZoraraUI.exe.WebView2/EBWebView/GrShaderCache/data_2
  • ZoraraUI.exe.WebView2/EBWebView/GrShaderCache/data_3
  • ZoraraUI.exe.WebView2/EBWebView/GrShaderCache/f_000001
  • ZoraraUI.exe.WebView2/EBWebView/GrShaderCache/index
  • ZoraraUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_0
  • ZoraraUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_1
  • ZoraraUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_2
  • ZoraraUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_3
  • ZoraraUI.exe.WebView2/EBWebView/GraphiteDawnCache/index
  • ZoraraUI.exe.WebView2/EBWebView/Last Version
  • ZoraraUI.exe.WebView2/EBWebView/Local State
  • ZoraraUI.exe.WebView2/EBWebView/ShaderCache/data_0
  • ZoraraUI.exe.WebView2/EBWebView/ShaderCache/data_1
  • ZoraraUI.exe.WebView2/EBWebView/ShaderCache/data_2
  • ZoraraUI.exe.WebView2/EBWebView/ShaderCache/data_3
  • ZoraraUI.exe.WebView2/EBWebView/ShaderCache/index
  • ZoraraUI.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings
  • ZoraraUI.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings_2.0-0
  • ZoraraUI.exe.WebView2/EBWebView/Variations
  • ZoraraUI.runtimeconfig.json
  • bin/Background.mp4
  • bin/Monaco/index.html
    .html .js polyglot
  • bin/Monaco/vs/base/worker/workerMain.js
    .js
  • bin/Monaco/vs/basic-languages/lua/lua.js
  • bin/Monaco/vs/editor/editor.main.css
  • bin/Monaco/vs/editor/editor.main.js
    .js
  • bin/Monaco/vs/editor/editor.main.nls.de.js
  • bin/Monaco/vs/editor/editor.main.nls.es.js
  • bin/Monaco/vs/editor/editor.main.nls.fr.js
  • bin/Monaco/vs/editor/editor.main.nls.it.js
  • bin/Monaco/vs/editor/editor.main.nls.ja.js
  • bin/Monaco/vs/editor/editor.main.nls.js
  • bin/Monaco/vs/editor/editor.main.nls.ko.js
  • bin/Monaco/vs/editor/editor.main.nls.ru.js
  • bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • bin/Monaco/vs/loader.js
    .js
  • bin/editor.lua
  • libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • runtimes/win-arm64/native/WebView2Loader.dll
  • runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/win-x86/native/WebView2Loader.dll
    .dll windows:10 windows x86 arch:x86

    72229ff546c74d09d9030ca49ce61b31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • workspace/.tests/appendfile.txt
  • workspace/.tests/getcustomasset.txt
  • workspace/.tests/isfile.txt
  • workspace/.tests/listfiles/test_1.txt
  • workspace/.tests/listfiles/test_2.txt
  • workspace/.tests/loadfile.txt
  • workspace/.tests/readfile.txt
  • workspace/.tests/writefile
  • workspace/.tests/writefile.txt
  • xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections