General

  • Target

    DragonSploitV2 (1).zip

  • Size

    3.2MB

  • MD5

    40c8f9f136085cdec66de0daaeeca170

  • SHA1

    463ce124facc04fd96c87315a9a99041d880fb09

  • SHA256

    b0060911bc34a156dffaa01e7c12eae1bb1708686b06e34caf10bebd0683d748

  • SHA512

    7b0babe2a96a98b59448daaac9383782b54dcdfad4cdaed57ba320b6a5ac22791b046d8a82db5b1721a2370896062010bcdc6e6968596c931ead3168d19a1fcd

  • SSDEEP

    98304:PA2tiVNp0oIytptC57HQqY/EhvAMDrForlpOGO0d3:JiaoR/tC71CtCmUGxd3

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • DragonSploitV2 (1).zip
    .zip
  • FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • ICSharpCode.AvalonEdit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Main1.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Main1.exe.config
  • Main1.pdb
  • bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    ac435dfa812fddee99bbf7a986186d1d


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • syntax/lua.xshd
    .xml
  • workspace/IY_FE.iy