General

  • Target

    Internal X.zip

  • Size

    3.0MB

  • MD5

    bb5a564394f1588303c97f4abccc81fa

  • SHA1

    5d833d684778f5614730614a89f8758061cfc022

  • SHA256

    bcc0c27bccf5131af04baf1845841742846e95cbbeb9af48d645d2971771fd2b

  • SHA512

    0bfb44aa7a527e63766332e887055b9add859305dd773bf44915bd2858839c6406079d94784d15457f42c939096435d5fa13b2b1863f540df20cd8dc80849d34

  • SSDEEP

    98304:EKGMYE06gh/TA8pstEe2xIB0+ToxF8+/2DTuqdMkFH:/YHGoxTDxFjeDFrH

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • Internal X.zip
    .zip
  • ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Loader.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Loader.exe.config
  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    3a1f9d973bff43051a3daf411f707362


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections