General

  • Target

    R.zip

  • Size

    4.2MB

  • MD5

    36d13811dbdaed733965fb81900875f7

  • SHA1

    001d47b8bc9e13d6a13921e226a07958bb647e95

  • SHA256

    61e04786763072218a6848fdd4ca340083481d51eefe4628d7c3d44cf0acb174

  • SHA512

    b0c5e52d3eea0a3acb51f7f8017f38e297aece68c872b0ee33c8d7d6af27615514523d39ca321545f1c5e4c475dfc980634431ca862021b75860a7adb8d6521a

  • SSDEEP

    98304:9cMCwMYZ1Bi5yP86sIwKAC3tZQ3kvBQt3XSz7POjmEtYCOi9M05lzWz4oPhi77lU:2KMN5yx7R3tZQLSnSzR93wE7lU

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • R.zip
    .zip
  • Release v1/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Release v1/Rael No Fake Sigma Balls.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Release v1/Siticone.Desktop.UI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Release v1/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    dc5ffe84bd3b4405ea83f693b055c515


    Headers

    Imports

    Exports

    Sections

  • Release v1/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Release v1/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • Release v1/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Release v1/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Release v1/workspace/.tests/appendfile.txt
  • Release v1/workspace/.tests/getcustomasset.txt
  • Release v1/workspace/.tests/isfile.txt
  • Release v1/workspace/.tests/listfiles/test_1.txt
  • Release v1/workspace/.tests/listfiles/test_2.txt
  • Release v1/workspace/.tests/loadfile.txt
  • Release v1/workspace/.tests/readfile.txt
  • Release v1/workspace/.tests/writefile
  • Release v1/workspace/.tests/writefile.txt
  • Release v1/workspace/Eazvy-Hub/Animations_Settings.txt
  • Release v1/workspace/IY_FE.iy
  • Release v1/workspace/Nut Hub/3008.rfld