General

  • Target

    zorara.zip

  • Size

    7.7MB

  • MD5

    4e47c47b65d61432c3dcf082311f9fca

  • SHA1

    5178cd22044430593ad0f5a2c909dd24c4f8416f

  • SHA256

    f6b70da0f729454190543f63eb35a5278c7991ef0f135a8de4c30afc36e8a75b

  • SHA512

    fe3038d0b7d9c326760c7f9ba3609c3ef9034e9a031f8da83c82204d14c0f5bbdc418c59cdbcfe8dc97560d0683b877a4bb107b8c66323d11d60e04417c32a85

  • SSDEEP

    196608:x0+/HtFPT5d1mNu4Y9MTjSiwP+ZNEVliRUhszze88:S+/HTPT95WaiMKNEri/8

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • zorara.zip
    .zip
  • Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno.dll
    .dll windows:6 windows x64 arch:x64

    195325a47071c3f0ee02a64f5844cd12


    Headers

    Imports

    Exports

    Sections

  • Xeno.exp
  • Xeno.lib
  • Xeno.pdb
  • XenoUI.deps.json
  • XenoUI.dll
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • XenoUI.exe
    .exe windows:6 windows x64 arch:x64

    6a91eb82bfd19d2706c7d43c46f7064e


    Headers

    Imports

    Sections

  • XenoUI.exe.WebView2/EBWebView/Breadcrumbs
  • XenoUI.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-66FD9342-408C.pma
  • XenoUI.exe.WebView2/EBWebView/Crashpad/settings.dat
  • XenoUI.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
  • XenoUI.exe.WebView2/EBWebView/CrashpadMetrics-active.pma
  • XenoUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
  • XenoUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
  • XenoUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
  • XenoUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
  • XenoUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001
    .gz
  • f_000001
  • XenoUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/index
  • XenoUI.exe.WebView2/EBWebView/Default/Code Cache/js/index
  • XenoUI.exe.WebView2/EBWebView/Default/Code Cache/js/index-dir/the-real-index
  • XenoUI.exe.WebView2/EBWebView/Default/Code Cache/wasm/index
  • XenoUI.exe.WebView2/EBWebView/Default/Code Cache/wasm/index-dir/the-real-index
  • XenoUI.exe.WebView2/EBWebView/Default/DIPS
  • XenoUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_0
  • XenoUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_1
  • XenoUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_2
  • XenoUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_3
  • XenoUI.exe.WebView2/EBWebView/Default/DawnGraphiteCache/index
  • XenoUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_0
  • XenoUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_1
  • XenoUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_2
  • XenoUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_3
  • XenoUI.exe.WebView2/EBWebView/Default/DawnWebGPUCache/index
  • XenoUI.exe.WebView2/EBWebView/Default/EdgeEDrop/EdgeEDropSQLite.db
  • XenoUI.exe.WebView2/EBWebView/Default/EdgeHubAppUsage/EdgeHubAppUsageSQLite.db
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Rules/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Rules/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Rules/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Rules/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Scripts/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Scripts/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Scripts/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Extension Scripts/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/Extension State/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/Extension State/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Extension State/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Extension State/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/ExtensionActivityComp
  • XenoUI.exe.WebView2/EBWebView/Default/ExtensionActivityEdge
  • XenoUI.exe.WebView2/EBWebView/Default/Favicons
  • XenoUI.exe.WebView2/EBWebView/Default/GPUCache/data_0
  • XenoUI.exe.WebView2/EBWebView/Default/GPUCache/data_1
  • XenoUI.exe.WebView2/EBWebView/Default/GPUCache/data_2
  • XenoUI.exe.WebView2/EBWebView/Default/GPUCache/data_3
  • XenoUI.exe.WebView2/EBWebView/Default/GPUCache/index
  • XenoUI.exe.WebView2/EBWebView/Default/History
  • XenoUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Local Storage/leveldb/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/Login Data
  • XenoUI.exe.WebView2/EBWebView/Default/Network Action Predictor
  • XenoUI.exe.WebView2/EBWebView/Default/Network/Cookies
  • XenoUI.exe.WebView2/EBWebView/Default/Network/Network Persistent State
  • XenoUI.exe.WebView2/EBWebView/Default/Network/Reporting and NEL
  • XenoUI.exe.WebView2/EBWebView/Default/Network/SCT Auditing Pending Reports
  • XenoUI.exe.WebView2/EBWebView/Default/Network/Sdch Dictionaries
  • XenoUI.exe.WebView2/EBWebView/Default/Network/TransportSecurity
  • XenoUI.exe.WebView2/EBWebView/Default/Network/Trust Tokens
  • XenoUI.exe.WebView2/EBWebView/Default/Preferences
  • XenoUI.exe.WebView2/EBWebView/Default/PreferredApps
  • XenoUI.exe.WebView2/EBWebView/Default/README
  • XenoUI.exe.WebView2/EBWebView/Default/Safe Browsing Network/Safe Browsing Cookies
  • XenoUI.exe.WebView2/EBWebView/Default/Secure Preferences
  • XenoUI.exe.WebView2/EBWebView/Default/Session Storage/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/Session Storage/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Session Storage/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Session Storage/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index
  • XenoUI.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index-dir/the-real-index
  • XenoUI.exe.WebView2/EBWebView/Default/Shared Dictionary/db
  • XenoUI.exe.WebView2/EBWebView/Default/SharedStorage
  • XenoUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Site Characteristics Database/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/Top Sites
  • XenoUI.exe.WebView2/EBWebView/Default/Visited Links
  • XenoUI.exe.WebView2/EBWebView/Default/Web Data
  • XenoUI.exe.WebView2/EBWebView/Default/heavy_ad_intervention_opt_out.db
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/000003.log
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/CURRENT
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG
  • XenoUI.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/MANIFEST-000001
  • XenoUI.exe.WebView2/EBWebView/GrShaderCache/data_0
  • XenoUI.exe.WebView2/EBWebView/GrShaderCache/data_1
  • XenoUI.exe.WebView2/EBWebView/GrShaderCache/data_2
  • XenoUI.exe.WebView2/EBWebView/GrShaderCache/data_3
  • XenoUI.exe.WebView2/EBWebView/GrShaderCache/index
  • XenoUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_0
  • XenoUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_1
  • XenoUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_2
  • XenoUI.exe.WebView2/EBWebView/GraphiteDawnCache/data_3
  • XenoUI.exe.WebView2/EBWebView/GraphiteDawnCache/index
  • XenoUI.exe.WebView2/EBWebView/Last Version
  • XenoUI.exe.WebView2/EBWebView/Local State
  • XenoUI.exe.WebView2/EBWebView/ShaderCache/data_0
  • XenoUI.exe.WebView2/EBWebView/ShaderCache/data_1
  • XenoUI.exe.WebView2/EBWebView/ShaderCache/data_2
  • XenoUI.exe.WebView2/EBWebView/ShaderCache/data_3
  • XenoUI.exe.WebView2/EBWebView/ShaderCache/index
  • XenoUI.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings
  • XenoUI.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings_2.0-0
  • XenoUI.exe.WebView2/EBWebView/Variations
  • XenoUI.pdb
  • XenoUI.runtimeconfig.json
  • bin/Monaco/index.html
    .html .js polyglot
  • bin/Monaco/vs/base/worker/workerMain.js
    .js
  • bin/Monaco/vs/basic-languages/lua/lua.js
  • bin/Monaco/vs/editor/editor.main.css
  • bin/Monaco/vs/editor/editor.main.js
    .js
  • bin/Monaco/vs/editor/editor.main.nls.de.js
  • bin/Monaco/vs/editor/editor.main.nls.es.js
  • bin/Monaco/vs/editor/editor.main.nls.fr.js
  • bin/Monaco/vs/editor/editor.main.nls.it.js
  • bin/Monaco/vs/editor/editor.main.nls.ja.js
  • bin/Monaco/vs/editor/editor.main.nls.js
  • bin/Monaco/vs/editor/editor.main.nls.ko.js
  • bin/Monaco/vs/editor/editor.main.nls.ru.js
  • bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • bin/Monaco/vs/loader.js
    .js
  • bin/editor.lua
  • libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • runtimes/win-arm64/native/WebView2Loader.dll
  • runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • runtimes/win-x86/native/WebView2Loader.dll
    .dll windows:10 windows x86 arch:x86

    72229ff546c74d09d9030ca49ce61b31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scripts/IY.lua
    .js
  • scripts/UNCTest.lua
    .js
  • scripts/unnamedesp.lua
    .js
  • workspace/.tests/appendfile.txt
  • workspace/.tests/getcustomasset.txt
  • workspace/.tests/isfile.txt
  • workspace/.tests/listfiles/test_1.txt
  • workspace/.tests/listfiles/test_2.txt
  • workspace/.tests/loadfile.txt
  • workspace/.tests/readfile.txt
  • workspace/.tests/writefile
  • workspace/.tests/writefile.txt
  • workspace/286090429.txt
  • workspace/IY_FE.iy
  • workspace/vape/CustomModules/6872274481.lua
    .js
  • workspace/vape/CustomModules/8560631822.lua
  • workspace/vape/CustomModules/cachechecked.txt
  • workspace/vape/GuiLibrary.lua
    .js
  • workspace/vape/Libraries/entityHandler.lua
    .js
  • workspace/vape/Libraries/sha.lua
    .js
  • workspace/vape/MainScript.lua
    .js
  • workspace/vape/Profiles/1430993116GUIPositions.vapeprofile.txt
  • workspace/vape/Profiles/4483381587.vapeprofile.txt
  • workspace/vape/Profiles/4483381587.vapeprofiles.txt
  • workspace/vape/Profiles/whitelist.json
  • workspace/vape/Universal.lua
    .js
  • workspace/vape/assets/AddItem.png
    .png
  • workspace/vape/assets/AddRemoveIcon1.png
    .png
  • workspace/vape/assets/BackIcon.png
    .png
  • workspace/vape/assets/BindBackground.png
    .png
  • workspace/vape/assets/BlatantIcon.png
    .png
  • workspace/vape/assets/CircleListBlacklist.png
    .png
  • workspace/vape/assets/ColorSlider1.png
    .png
  • workspace/vape/assets/CombatIcon.png
    .png
  • workspace/vape/assets/DiscordIcon.png
    .png
  • workspace/vape/assets/DownArrow.png
    .png
  • workspace/vape/assets/ExitIcon1.png
    .png
  • workspace/vape/assets/FriendsIcon.png
    .png
  • workspace/vape/assets/HoverArrow.png
    .png
  • workspace/vape/assets/HoverArrow3.png
    .png
  • workspace/vape/assets/InfoNotification.png
    .png
  • workspace/vape/assets/KeybindIcon.png
    .png
  • workspace/vape/assets/LegitModeIcon.png
    .png
  • workspace/vape/assets/MoreButton1.png
    .png
  • workspace/vape/assets/MoreButton3.png
    .png
  • workspace/vape/assets/NotificationBackground.png
    .png
  • workspace/vape/assets/NotificationBar.png
    .png
  • workspace/vape/assets/OnlineProfilesButton.png
    .png
  • workspace/vape/assets/PinButton.png
    .png
  • workspace/vape/assets/ProfilesIcon.png
    .png
  • workspace/vape/assets/RadarIcon1.png
    .png
  • workspace/vape/assets/RadarIcon2.png
    .png
  • workspace/vape/assets/RainbowIcon1.png
    .png
  • workspace/vape/assets/RenderIcon.png
    .png
  • workspace/vape/assets/RightArrow.png
    .png
  • workspace/vape/assets/SearchBarIcon.png
    .png
  • workspace/vape/assets/SettingsWheel1.png
    .png
  • workspace/vape/assets/SettingsWheel2.png
    .png
  • workspace/vape/assets/SliderArrow1.png
    .png
  • workspace/vape/assets/SliderArrowSeperator.png
    .png
  • workspace/vape/assets/SliderButton1.png
    .png
  • workspace/vape/assets/TargetInfoIcon1.png
    .png
  • workspace/vape/assets/TargetInfoIcon2.png
    .png
  • workspace/vape/assets/TextBoxBKG.png
    .png
  • workspace/vape/assets/TextBoxBKG2.png
    .png
  • workspace/vape/assets/TextGUIIcon1.png
    .png
  • workspace/vape/assets/TextGUIIcon2.png
    .png
  • workspace/vape/assets/TextGUIIcon3.png
    .png
  • workspace/vape/assets/TextGUIIcon4.png
    .png
  • workspace/vape/assets/ToggleArrow.png
    .png
  • workspace/vape/assets/UpArrow.png
    .png
  • workspace/vape/assets/UtilityIcon.png
    .png
  • workspace/vape/assets/VapeLogo1.png
    .png
  • workspace/vape/assets/VapeLogo2.png
    .png
  • workspace/vape/assets/VapeLogo3.png
    .png
  • workspace/vape/assets/VapeLogo4.png
    .png
  • workspace/vape/assets/WindowBlur.png
    .png
  • workspace/vape/assets/WorldIcon.png
    .png
  • workspace/vape/assetsversion.txt
  • workspace/vape/commithash.txt
  • xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections