General

  • Target

    New folder (3) - Copy.zip

  • Size

    4.4MB

  • MD5

    a126199cc6cd9379c7c0be6db37d71c0

  • SHA1

    b1d4b236c939064642097d6cbb08cceef4ef3fb2

  • SHA256

    f049e03440a42fe760a86564d7a2f0f35b2f66e1da2c0d0753bcaf9a3e122c51

  • SHA512

    5e18df9ff83925e174c9f9bb2d6c9ff87aa081ac850768e7a9f73ee9f1cdb87ae56e2dc1699b6f8828b90df212415f568a319a50d7be99ddeea13cecfc802276

  • SSDEEP

    98304:HWN9ZPzCWUmM3OGOjWu3sfx7kYu1xKi0D9XZqnxs4Xni:2N9ZP2WUNLAZ3O7kYwXKXZSsoni

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • New folder (3) - Copy.zip
    .zip
  • New folder (3) - Copy/Xentic Executor.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • New folder (3) - Copy/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    dc5ffe84bd3b4405ea83f693b055c515


    Headers

    Imports

    Exports

    Sections

  • New folder (3) - Copy/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • New folder (3) - Copy/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • New folder (3) - Copy/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • New folder (3) - Copy/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • New folder (3) - Copy/workspace/BaldyToSorcerer/ReversalRedFire.MP3
  • New folder (3) - Copy/workspace/BaldyToSorcerer/ReversalRedStartup2.MP3
  • New folder (3) - Copy/workspace/IY_FE.iy
  • New folder (3) - Copy/workspace/KadeHub/options.json
  • New folder (3) - Copy/workspace/dex/deps_version.dat
  • New folder (3) - Copy/workspace/dex/rbx_api.dat
  • New folder (3) - Copy/workspace/dex/rbx_rmd.dat