General

  • Target

    ZurcSploit.rar

  • Size

    2.7MB

  • MD5

    f26e3816e8dc8c635201159a83b9515c

  • SHA1

    1f91b6c858d00701fd63a9dd2f626279891d9a80

  • SHA256

    1c44180e03b173aa3dda211bdc11f43f336783eb3f57ad69e5f71f16224a07a6

  • SHA512

    e04dd97bfb61e9a1096088e91faebbb38b21ea3f65f8f6e52095d88a7281fa4d7cd0ed309e55658173ea3f40b50b8f72da43a9cec12d3eec0b6244efdeadc8a6

  • SSDEEP

    49152:o8iepjYiicXncLKHB+EQMZCj0LGaIVupDMKnSVzYF+ccbLha9i93YQ2GJBQsLHLk:XpjYYncLKHPZCXVBVzYb0da+YrAA

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • ZurcSploit.rar
    .rar
  • ZurcSploit/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ZurcSploit/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • ZurcSploit/Scripts/Infinite Yield.txt
    .js
  • ZurcSploit/ZurcSploit.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • ZurcSploit/ZurcSploit.exe.config
  • ZurcSploit/ZurcSploit.pdb
  • ZurcSploit/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    dc5ffe84bd3b4405ea83f693b055c515


    Headers

    Imports

    Exports

    Sections

  • ZurcSploit/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • ZurcSploit/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • ZurcSploit/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • ZurcSploit/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • ZurcSploit/workspace/IY_FE.iy
  • ZurcSploit/workspace/Scripts/Infinite Yield.txt
    .js