New folder[.]rar | Triage™

resource	yara_rule
static1/unpack001/New folder/hailhydra.exe	pyinstaller

resource
unpack001/New folder/hailhydra.exe

New folder.rar

SHA256 b14101db96b9939d342e7cfeab6f7217ae0690f267642f338e706806e8bf8901
MD5 9d6a26935acfc57de9ade421d88602d8
SHA1 267054940d1e4fd8ef6c8e428971eb585141458e
SHA512 8775d0e6e88325e258dbb73850e5e22f4d620d9000d83bd71ed0d5fc864dfbe9177cb3f6e9c8e7caad9d045dfd063c53d899d2206e2767e5c6e35e1f0ed951c8
SSDEEP 196608:Cc2C/vCvtiZf6mpMSi3/Th6GY5ef8VbbRAEVNyj8cH8P:CbUvCv0yqivt6GQefejyjpH8P
MD5 SHA1 SHA512 SSDEEP

New folder/Hydra.bat

SHA256 e92f4a23337da362f761b1bcf222ad79547aba92a7a501ed8accf7e6f785763c
MD5 4f282c367693e6685b126567d2aaec24
SHA1 579f0edd1deea53c818d917f9477d7eafc464792
SHA512 e05a9a0f6179f0ca5f25e035998afb060e9c53880cc949c3959f1d7d8292f47157725d2c66de63c1b5aaa0d281eed375fe0a40715d3d2a4afd25738d3b217b7c
MD5 SHA1 SHA512

New folder/autorun.inf

SHA256 8ae077b42dc3d629a426a92d5d5fab3fbe7b8876d85e92d2c10724773f8f4887
MD5 4c31f2e59243fba4e9864025c4980b1c
SHA1 1f6869ed3f6a4a9663151d3f5ced658b17fb8d5c
SHA512 fd9812f15a2a0f94425df1c1e97d87e6f6823d775066b2ca84931accf2520f96a5671f784d3d5c647883a6c052c3aeae8a98911cfb40bc942819172c7ff59839
MD5 SHA1 SHA512

New folder/hailhydra.exe

IMPHASH ba2fe82dbe3fc8bdddc26ef88c3ef15a
SHA256 f941c8668fd45328111865edc1f737d5e207cf72b8e051e03b269654f286ef85
MD5 ab19a2ddb8b0b9f5b8aaef142bb66bec
SHA1 7cbbe9510eb75a9555667b720b2f31968b3c0eee
SHA512 da32eeeeb29b69e052e20a77b64fa4dfa6038ccac6fba97b642aec8f1c2d7d32e909af37ca24bc73582584b3a4de97a1a3a2f62b598ef2a24ac0375a57ee9572
SSDEEP 196608:vXVCQmlXMCHGLLc54i1wN+ijXx5nDasqWQ2dTNUG2ZXxHMB1lK0W8/Lf6zCl6+ik:NCvXMCHWUj6jx5WsqWxT45xHMrl9W89f
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

46288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetWindowThreadProcessId ShowWindow

kernel32

GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle WaitForSingleObject FormatMessageW GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW LocalFree SetConsoleCtrlHandler GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte HeapReAlloc GetLastError WriteConsoleW SetEndOfFile Sleep EnterCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

hailhydra.pyc

SHA256 82ded747bd44586455fa258ed3f7607bca562894969f8ebd864385704f374331
MD5 6f77e85240bb95a6614fa608c31068f6
SHA1 ad29c483ce049ea94fdb805adaeb840124440dfc
SHA512 408c8387ebe7da1e17f2b24c3102515700cbd6c7b089d7514ca943415e5b70072a18e231bfff2cf21beb2f61304149bd3b478a785a861a829e5bd5e6f8a5e7a9
MD5 SHA1 SHA512

New folder/hydrapaper.bmp

SHA256 3380e43c4903b2f0ece643688e24f0e9eb3750d436dfd53454151e9eb0e6239b
MD5 caf5b4389a81dfd77168455f3ec193b3
SHA1 64ad8b212159cc45d007a36448394f3bf485f6d1
SHA512 8b4c5d043c012e5829cd510728309f468d5b75a57154986ffb5fd78617e1560ad541656bc15e292cb8f02b33f9673f36751f025ba47a606679ac8ceea0b90186
SSDEEP 6144:AFFkDne+fPG2N8PAGu7of2apYyl96OULhjkyE11sRp+YJ6tbraJ15J2L4:AYe+tI0ofDDIzLhwyE1iR1AKDHH
MD5 SHA1 SHA512 SSDEEP

New folder/launch.bat

SHA256 1ae1f2b893a3ffa7d4682d43841d538ae70a8b9fe6c02fc06fbe694bbf31f865
MD5 2f3a6207faed17a01ff664fa4effc13f
SHA1 9c0aa5bfc0553f6ecc199fcca6040d74b9bbdaf4
SHA512 d8861b495433c62e1fea2962be6b976b08bf12d500552bac2e6403b8b695fc1f3055682e21d237b61150372d4f30b3d74ccfe16b0b2f84fc5a884f638369712e
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer