Craxs Rat v5[.]1 + Loader[.]7z

Resubmissions

25/09/2024, 18:01

240925-wl2pkascre 7

Sharing

Copy URL Twitter E-mail

General

Target

Craxs Rat v5.1 + Loader.7z
Size

206.4MB
MD5

6f578d84712cd7126e0b6f5bc3c48b6c
SHA1

84320a8e007caae8a16eb6f24395e7945b6417af
SHA256

2d2d4ada8af3c41c9a419a0e3ba167bb50f40b06042edb2439b21dcf262fd90b
SHA512

79dd882fc72c15c7f5741372c4f7a531e490cbf65d8c51642e56c3d7490abd9a13e98aabc7e2a12595dd4a6f0446531e1cc9c851bb070198b6162ad23f218ed1
SSDEEP

6291456:V+6xEOsDGugP/rLNRstFXF2Tf/89ibMPMo7CFD:V9u+XrLNyPYD/8AEMSCFD

Score

7^/10

agilenet themida

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
static1/unpack001/Craxs Rat v5.1 + Loader/LiveCharts.MAPS.dll	agile_net

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/Craxs Rat v5.1 + Loader/Loader/Loader.exe	themida

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Craxs Rat v5.1 + Loader/CraxsRatV5.exe
unpack001/Craxs Rat v5.1 + Loader/DrakeUI.Framework.dll
unpack001/Craxs Rat v5.1 + Loader/GeoIPCitys.dll
unpack001/Craxs Rat v5.1 + Loader/LiveCharts.MAPS.dll
unpack001/Craxs Rat v5.1 + Loader/LiveCharts.WinForms.dll
unpack001/Craxs Rat v5.1 + Loader/LiveCharts.Wpf.dll
unpack001/Craxs Rat v5.1 + Loader/LiveCharts.dll
unpack001/Craxs Rat v5.1 + Loader/Loader/Loader.exe
unpack001/Craxs Rat v5.1 + Loader/NAudio.dll
unpack001/Craxs Rat v5.1 + Loader/WinMM.Net.dll
unpack001/Craxs Rat v5.1 + Loader/Windows.UI.Immersive.dll

Files

Craxs Rat v5.1 + Loader.7z
.7z

Password: @ReverseEngineeringLab
Craxs Rat v5.1 + Loader/ChangeLog.html
Craxs Rat v5.1 + Loader/Config.json
Craxs Rat v5.1 + Loader/CraxsRat.exe.config
.xml
Craxs Rat v5.1 + Loader/CraxsRat.pdb
Craxs Rat v5.1 + Loader/CraxsRat.xml
Craxs Rat v5.1 + Loader/CraxsRatV5.exe
.exe windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 63.4MB - Virtual size: 63.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/DrakeUI.Framework.dll
.dll windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\DrakeUI.Framework\DrakeUI.Framework\DrakeUI.Framework\obj\Release\DrakeUI.Framework.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/Errorlogs.txt
Craxs Rat v5.1 + Loader/GeoIPCitys.dll
.dll windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\EVLF\source\repos\GeoIPCitys\GeoIPCitys\obj\Debug\GeoIPCitys.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/LiveCharts.MAPS.dll
.dll windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\erand\Dropbox\Dev\ag.v66\Libraries\VMRuntime\obj\Trial\AgileDotNet.VMRuntime.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/LiveCharts.WinForms.dll
.dll windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\btord\Documents\Projects\LiveCharts\WinFormsView\obj\Release\LiveCharts.WinForms.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/LiveCharts.WinForms.pdb
Craxs Rat v5.1 + Loader/LiveCharts.WinForms.xml
.xml
Craxs Rat v5.1 + Loader/LiveCharts.Wpf.dll
.dll windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\btord\Documents\Projects\LiveCharts\WpfView\obj\Release\LiveCharts.Wpf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/LiveCharts.Wpf.pdb
Craxs Rat v5.1 + Loader/LiveCharts.Wpf.xml
.xml
Craxs Rat v5.1 + Loader/LiveCharts.dll
.dll windows:4 windows x86 arch:x86

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\btord\Documents\Projects\LiveCharts\Core40\obj\Release\LiveCharts.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/LiveCharts.pdb
Craxs Rat v5.1 + Loader/LiveCharts.xml
.xml
Craxs Rat v5.1 + Loader/Loader/Loader.exe
.exe windows:6 windows x64 arch:x64

Password: @ReverseEngineeringLab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

DotNetRuntimeDebugHeader

Sections

Size: 201KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 555KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 604KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 28KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 70KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/NAudio.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Mark\code\github\NAudio\NAudio\obj\Release\net35\NAudio.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/01/2021, 00:00

Not After

14/01/2046, 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/07/2021, 00:00

Not After

14/07/2031, 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13/08/2021, 00:00

Not After

29/10/2024, 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/Newtonsoft.Json.xml
.xml
Craxs Rat v5.1 + Loader/System.IO.Compression.ZipFile.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:e3:a3:2d:f8:71:76:9b:66:a7:70:02:ef:69:91:70:2e:1d:d6:c5:f3:f4:b4:cf:e9:62:5e:c5:de:66:cf:77
Signer

Actual PE Digest

2b:e3:a3:2d:f8:71:76:9b:66:a7:70:02:ef:69:91:70:2e:1d:d6:c5:f3:f4:b4:cf:e9:62:5e:c5:de:66:cf:77

Digest Algorithm

sha256

PE Digest Matches

true

14:b0:8e:4d:e3:ae:df:ee:dd:e1:6b:b6:23:93:9d:2a:c5:d1:47:94
Signer

Actual PE Digest

14:b0:8e:4d:e3:ae:df:ee:dd:e1:6b:b6:23:93:9d:2a:c5:d1:47:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.Compression.ZipFile/net46\System.IO.Compression.ZipFile.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/WinMM.Net.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/Windows.UI.Immersive.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

C_~sKxli
Size: - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

OfjZ*]Hz
Size: - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

,YF:DdmG
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

-_Rd|Z;^
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

{a_wzeVk
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Craxs Rat v5.1 + Loader/World.xml
Craxs Rat v5.1 + Loader/icons/air_translate.png
.png
Craxs Rat v5.1 + Loader/icons/alarm.png
.png
Craxs Rat v5.1 + Loader/icons/always_on_display.png
.png
Craxs Rat v5.1 + Loader/icons/appstore.png
.png
Craxs Rat v5.1 + Loader/icons/artcanvas.png
.png
Craxs Rat v5.1 + Loader/icons/backup_and_restore.png
.png
Craxs Rat v5.1 + Loader/icons/billing.png
.png
Craxs Rat v5.1 + Loader/icons/bixby.png
.png
Craxs Rat v5.1 + Loader/icons/bixby_vision.png
.png
Craxs Rat v5.1 + Loader/icons/bookmark.png
.png
Craxs Rat v5.1 + Loader/icons/calculator.png
.png
Craxs Rat v5.1 + Loader/icons/calendar.png
.png
Craxs Rat v5.1 + Loader/icons/camera.png
.png
Craxs Rat v5.1 + Loader/icons/capture.png
.png
Craxs Rat v5.1 + Loader/icons/car_mode.png
.png
Craxs Rat v5.1 + Loader/icons/clock.png
.png
Craxs Rat v5.1 + Loader/icons/clock_bg.png
.png
Craxs Rat v5.1 + Loader/icons/connect.png
.png
Craxs Rat v5.1 + Loader/icons/contacts.png
.png
Craxs Rat v5.1 + Loader/icons/device_maintenance.png
.png
Craxs Rat v5.1 + Loader/icons/document.png
.png
Craxs Rat v5.1 + Loader/icons/edge_screen.png
.png
Craxs Rat v5.1 + Loader/icons/email.png
.png
Craxs Rat v5.1 + Loader/icons/enhanced_features.png
.png
Craxs Rat v5.1 + Loader/icons/flow.png
.png
Craxs Rat v5.1 + Loader/icons/galaxy_apps.png
.png
Craxs Rat v5.1 + Loader/icons/gallery.png
.png
Craxs Rat v5.1 + Loader/icons/game_launcher.png
.png
Craxs Rat v5.1 + Loader/icons/gear_360.png
.png
Craxs Rat v5.1 + Loader/icons/gear_manager.png
.png
Craxs Rat v5.1 + Loader/icons/gtrans.png
.png
Craxs Rat v5.1 + Loader/icons/health.png
.png
Craxs Rat v5.1 + Loader/icons/home.png
.png
Craxs Rat v5.1 + Loader/icons/ic_bg_container.png
.png
Craxs Rat v5.1 + Loader/icons/ic_bg_container_mask.png
.png
Craxs Rat v5.1 + Loader/icons/ic_launcher.png
.png
Craxs Rat v5.1 + Loader/icons/image.png
.png
Craxs Rat v5.1 + Loader/icons/internet.png
.png
Craxs Rat v5.1 + Loader/icons/keyboard.png
.png
Craxs Rat v5.1 + Loader/icons/knox.png
.png
Craxs Rat v5.1 + Loader/icons/knox_2.png
.png
Craxs Rat v5.1 + Loader/icons/launcher.png
.png
Craxs Rat v5.1 + Loader/icons/led_icon_editor.png
.png
Craxs Rat v5.1 + Loader/icons/link_sharing.png
.png
Craxs Rat v5.1 + Loader/icons/live_drawing.png
.png
Craxs Rat v5.1 + Loader/icons/lockscreen.png
.png
Craxs Rat v5.1 + Loader/icons/members.png
.png
Craxs Rat v5.1 + Loader/icons/memo.png
.png
Craxs Rat v5.1 + Loader/icons/messaging.png
.png
Craxs Rat v5.1 + Loader/icons/milk.png
.png
Craxs Rat v5.1 + Loader/icons/music.png
.png
Craxs Rat v5.1 + Loader/icons/my_files.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_amr.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_apk.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_contact.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_eml.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_etc.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_gallery.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_html.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_hwp.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_memo.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_music.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_pdf.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_ppt.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_raw.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_s_planner.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_scrapbook.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_sdoc.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_snb.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_spd.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_storyalbum.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_task.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_txt.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_video.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_vtext.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_word.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_xls.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_list_zip.png
.png
Craxs Rat v5.1 + Loader/icons/myfiles_thumb_folder_home.png
.png
Craxs Rat v5.1 + Loader/icons/notes.png
.png
Craxs Rat v5.1 + Loader/icons/optical_reader.png
.png
Craxs Rat v5.1 + Loader/icons/pass.png
.png
Craxs Rat v5.1 + Loader/icons/pay.png
.png
Craxs Rat v5.1 + Loader/icons/penup.png
.png
Craxs Rat v5.1 + Loader/icons/phone.png
.png
Craxs Rat v5.1 + Loader/icons/phone_log.png
.png
Craxs Rat v5.1 + Loader/icons/photo360_editor.png
.png
Craxs Rat v5.1 + Loader/icons/photo_editor.png
.png
Craxs Rat v5.1 + Loader/icons/protect.png
.png
Craxs Rat v5.1 + Loader/icons/recorder_audio.png
.png
Craxs Rat v5.1 + Loader/icons/reminder.png
.png
Craxs Rat v5.1 + Loader/icons/s_health.png
.png
Craxs Rat v5.1 + Loader/icons/s_protect.png
.png
Craxs Rat v5.1 + Loader/icons/s_translator.png
.png
Craxs Rat v5.1 + Loader/icons/samsung_pay.png
.png
Craxs Rat v5.1 + Loader/icons/secure_folder.png
.png
Craxs Rat v5.1 + Loader/icons/settings.png
.png
Craxs Rat v5.1 + Loader/icons/smart_switch.png
.png
Craxs Rat v5.1 + Loader/icons/smart_view.png
.png
Craxs Rat v5.1 + Loader/icons/soundcamp.png
.png
Craxs Rat v5.1 + Loader/icons/story_album.png
.png
Craxs Rat v5.1 + Loader/icons/svoice.png
.png
Craxs Rat v5.1 + Loader/icons/tempmailicon.png
.png
Craxs Rat v5.1 + Loader/icons/theme_store.png
.png
Craxs Rat v5.1 + Loader/icons/translator.png
.png
Craxs Rat v5.1 + Loader/icons/video_editor.png
.png
Craxs Rat v5.1 + Loader/icons/video_library.png
.png
Craxs Rat v5.1 + Loader/icons/wallp.png
.png
Craxs Rat v5.1 + Loader/icons/ytlite.png
.png
Craxs Rat v5.1 + Loader/res/Audio/1.wav
Craxs Rat v5.1 + Loader/res/Audio/10.wav
Craxs Rat v5.1 + Loader/res/Audio/11.wav
Craxs Rat v5.1 + Loader/res/Audio/2.wav
Craxs Rat v5.1 + Loader/res/Audio/3.wav
Craxs Rat v5.1 + Loader/res/Audio/4.wav
Craxs Rat v5.1 + Loader/res/Audio/5.wav
Craxs Rat v5.1 + Loader/res/Audio/6.wav
Craxs Rat v5.1 + Loader/res/Audio/7.wav
Craxs Rat v5.1 + Loader/res/Audio/8.wav
Craxs Rat v5.1 + Loader/res/Audio/9.wav
Craxs Rat v5.1 + Loader/res/Config/Pass.inf
Craxs Rat v5.1 + Loader/res/Config/maps.inf
Craxs Rat v5.1 + Loader/res/Config/supported_images.inf
Craxs Rat v5.1 + Loader/res/Config/supported_text.inf
Craxs Rat v5.1 + Loader/res/Config/supported_video.inf
Craxs Rat v5.1 + Loader/res/Fonts/Hack-Bold.ttf
Craxs Rat v5.1 + Loader/res/Fonts/Hack-BoldOblique.ttf
Craxs Rat v5.1 + Loader/res/Fonts/Hack-Regular.ttf
Craxs Rat v5.1 + Loader/res/Fonts/Hack-RegularOblique.ttf
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/-1.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AQ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AX.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/AZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BB.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BJ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/BZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CV.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CX.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/CZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/DE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/DJ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/DK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/DM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/DO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/DZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/EC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/EE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/EG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/EH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ER.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ES.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ET.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/EU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/FI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/FJ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/FK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/FM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/FO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/FR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GB.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GQ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/GY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/HK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/HN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/HR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/HT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/HU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ID.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IQ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/IT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/JE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/JM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/JO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/JP.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KP.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/KZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LB.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LV.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/LY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ME.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ML.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MP.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MQ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MV.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MX.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/MZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NP.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/NZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/OM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/PY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/QA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/RO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/RS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/RU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/RW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SB.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ST.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SV.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/SZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TD.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TH.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TJ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TK.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TL.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TO.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TR.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TV.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/TZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/UA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/UG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/US.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/UY.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/UZ.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VC.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VG.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VI.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VN.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/VU.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/WF.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/WS.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/YE.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/YT.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ZA.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ZM.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/ZW.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_abkhazia.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_basque-country.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_british-antarctic-territory.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_commonwealth.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_england.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_gosquared.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_kosovo.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_mars.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_nagorno-karabakh.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_nato.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_northern-cyprus.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_olympics.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_red-cross.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_scotland.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_somaliland.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_south-ossetia.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_united-nations.ico
Craxs Rat v5.1 + Loader/res/GeoIP/Flags/_wales.ico
Craxs Rat v5.1 + Loader/res/GeoIP/GeoIP.dat
Craxs Rat v5.1 + Loader/res/GeoIP/GeoIPCity.dat
Craxs Rat v5.1 + Loader/res/Icons/Apps/air_translate.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/alarm.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/always_on_display.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/appstore.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/artcanvas.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/backup_and_restore.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/billing.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/bixby.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/bixby_vision.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/bookmark.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/calculator.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/calendar.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/camera.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/capture.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/car_mode.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/clock.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/clock_bg.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/connect.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/contacts.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/device_maintenance.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/document.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/edge_screen.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/email.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/enhanced_features.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/flow.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/galaxy_apps.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/gallery.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/game_launcher.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/gear_360.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/gear_manager.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/gtrans.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/health.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/home.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/ic_bg_container.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/ic_bg_container_mask.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/ic_launcher.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/image.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/internet.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/keyboard.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/knox.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/knox_2.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/launcher.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/led_icon_editor.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/link_sharing.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/live_drawing.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/lockscreen.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/members.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/memo.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/messaging.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/milk.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/music.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/my_files.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_amr.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_apk.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_contact.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_eml.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_etc.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_gallery.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_html.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_hwp.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_memo.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_music.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_pdf.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_ppt.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_raw.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_s_planner.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_scrapbook.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_sdoc.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_snb.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_spd.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_storyalbum.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_task.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_txt.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_video.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_vtext.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_word.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_xls.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_list_zip.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/myfiles_thumb_folder_home.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/notes.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/optical_reader.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/pass.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/pay.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/penup.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/phone.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/phone_log.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/photo360_editor.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/photo_editor.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/protect.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/recorder_audio.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/reminder.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/s_health.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/s_protect.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/s_translator.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/samsung_pay.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/secure_folder.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/settings.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/smart_switch.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/smart_view.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/soundcamp.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/story_album.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/svoice.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/tempmailicon.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/theme_store.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/translator.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/video_editor.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/video_library.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/wallp.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Apps/ytlite.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/Account.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/CLICKED.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/FOCUSED.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/Incoming.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/LONG CLICKED.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/Missed.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/NA.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/NOTIFICATION.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/Outgoing.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/System.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/TEXT.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/User.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/WINDOW CHANGED.png
.png
Craxs Rat v5.1 + Loader/res/Icons/FillEllipse/null.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/account.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/add.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/applications.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/callphone.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/calls.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/camera.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/clipboard.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/contacts.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/copy.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/cut.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/decode.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/delete.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/download.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/downloads.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/edit.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/encrypt.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/folder.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/hidden.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/info.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/keylogger.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/location.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/microphone.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/open.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/paste.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/paths.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/playsound.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/refresh.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/rename.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/server.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/show.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/sms.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/terminal.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/unzip.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/upload.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/viewfile.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/wallpaper.png
.png
Craxs Rat v5.1 + Loader/res/Icons/Menu_Items/17/zip.png
.png
Craxs Rat v5.1 + Loader/res/Icons/apk.ico
Craxs Rat v5.1 + Loader/res/Icons/win/1.ico
Craxs Rat v5.1 + Loader/res/Icons/win/10.ico
Craxs Rat v5.1 + Loader/res/Icons/win/11.ico
Craxs Rat v5.1 + Loader/res/Icons/win/12.ico
Craxs Rat v5.1 + Loader/res/Icons/win/13.ico
Craxs Rat v5.1 + Loader/res/Icons/win/14.ico
Craxs Rat v5.1 + Loader/res/Icons/win/15.ico
Craxs Rat v5.1 + Loader/res/Icons/win/16.ico
Craxs Rat v5.1 + Loader/res/Icons/win/17.ico
Craxs Rat v5.1 + Loader/res/Icons/win/18.ico
Craxs Rat v5.1 + Loader/res/Icons/win/19.ico
Craxs Rat v5.1 + Loader/res/Icons/win/2.ico
Craxs Rat v5.1 + Loader/res/Icons/win/20.ico
Craxs Rat v5.1 + Loader/res/Icons/win/3.ico
Craxs Rat v5.1 + Loader/res/Icons/win/4.ico
Craxs Rat v5.1 + Loader/res/Icons/win/5.ico
Craxs Rat v5.1 + Loader/res/Icons/win/6.ico
Craxs Rat v5.1 + Loader/res/Icons/win/7.ico
Craxs Rat v5.1 + Loader/res/Icons/win/8.ico
Craxs Rat v5.1 + Loader/res/Icons/win/9.ico
Craxs Rat v5.1 + Loader/res/Lib/ApkEditor.jar
.jar
Craxs Rat v5.1 + Loader/res/Lib/platformBinary.zip
.zip
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-1.pl
.dex
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-2.pl
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-3.pl
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-4.pl
.dex
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-5.pl
.dex
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-6.pl
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-7.pl
Craxs Rat v5.1 + Loader/res/Plugins/Android/gen-8.pl

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: @ReverseEngineeringLab

Password: @ReverseEngineeringLab

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 63.4MB - Virtual size: 63.4MB

.rsrc Size: 164KB - Virtual size: 164KB

.reloc Size: 512B - Virtual size: 12B

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 189KB - Virtual size: 189KB

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 512B - Virtual size: 12B

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 50KB - Virtual size: 50KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 17KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 512B - Virtual size: 12B

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 210KB - Virtual size: 210KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 12B

Password: @ReverseEngineeringLab

dae02f32a21e03ce65412f6e56942daa

.text
Size: 63.4MB - Virtual size: 63.4MB

.rsrc
Size: 164KB - Virtual size: 164KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 189KB - Virtual size: 189KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 50KB - Virtual size: 50KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 210KB - Virtual size: 210KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 146KB - Virtual size: 146KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 512B - Virtual size: 12B

.edata
Size: 512B - Virtual size: 4KB

.idata
Size: 1024B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.themida
Size: - Virtual size: 6.1MB

.boot
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 16B - Virtual size: 4KB

.text
Size: 496KB - Virtual size: 495KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 12B

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer