General

  • Target

    hassan.zip

  • Size

    9.7MB

  • MD5

    cc23b598015c2fe116e27d67bab4fd15

  • SHA1

    d354982d4a21dbdfa4349adae7ee1940adc21c1a

  • SHA256

    93a6519eb0d8dc227a9f26699e71febd7c5563316e7eeadb3c0948d7188dd617

  • SHA512

    414adf45b4161c050c521f8d8e95a47f5c5a81090ac7e1d768abe6a1ebb2fa4bf6808b6e56928e21144bcad984eb10ab441c559d5b8573975115a933d6a034db

  • SSDEEP

    196608:RGpsZjpJULw+2DRqrBMnofes7NdAHGfv+/qOnUO/3me2XMh7nYw2JPEVD:Mpsj1cd+ssGfm/qOWe2XE7nYZPeD

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • hassan.zip
    .zip
  • hassan.exe
    .exe windows:6 windows x64 arch:x64

    d2e4ad872587946802558cde4157923c


    Headers

    Imports

    Sections

  • lib/_bz2.pyd
    .dll windows:6 windows x64 arch:x64

    a36962884764276bb35985709aa4e40d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/_cffi_backend.cp312-win_amd64.pyd
    .dll windows:6 windows x64 arch:x64

    b0d47a66136aeb61988f1677126ff499


    Headers

    Imports

    Exports

    Sections

  • lib/_ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    4b327bc6e5b6b43c45400cac1afc35e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/_decimal.pyd
    .dll windows:6 windows x64 arch:x64

    45cfc0dbb456d5511c83e751dbe4c179


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/_hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    a8173ef8679f8544a88e355945112c77


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/_lzma.pyd
    .dll windows:6 windows x64 arch:x64

    b865edd9b0c291111893fc2b523f7264


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/_socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    de62106114a70bb3c0dfb5c6513e0ba1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/collections/__init__.pyc
  • lib/collections/abc.pyc
  • lib/cryptography/__about__.pyc
  • lib/cryptography/__init__.pyc
  • lib/cryptography/exceptions.pyc
  • lib/cryptography/fernet.pyc
  • lib/cryptography/hazmat/__init__.pyc
  • lib/cryptography/hazmat/bindings/__init__.pyc
  • lib/cryptography/hazmat/bindings/_rust.pyd
    .dll windows:6 windows x64 arch:x64

    6689c65e302c055ac21ed5ce07588089


    Headers

    Imports

    Exports

    Sections

  • lib/cryptography/hazmat/bindings/_rust/__init__.pyi
  • lib/cryptography/hazmat/bindings/_rust/_openssl.pyi
  • lib/cryptography/hazmat/bindings/_rust/asn1.pyi
  • lib/cryptography/hazmat/bindings/_rust/exceptions.pyi
  • lib/cryptography/hazmat/bindings/_rust/ocsp.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/__init__.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/aead.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/ciphers.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/cmac.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/dh.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/dsa.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/ec.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/ed25519.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/ed448.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/hashes.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/hmac.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/kdf.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/keys.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/poly1305.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/x25519.pyi
  • lib/cryptography/hazmat/bindings/_rust/openssl/x448.pyi
  • lib/cryptography/hazmat/bindings/_rust/pkcs12.pyi
  • lib/cryptography/hazmat/bindings/_rust/pkcs7.pyi
  • lib/cryptography/hazmat/bindings/_rust/test_support.pyi
  • lib/cryptography/hazmat/bindings/_rust/x509.pyi
  • lib/cryptography/hazmat/decrepit/__init__.pyc
  • lib/cryptography/hazmat/decrepit/ciphers/__init__.pyc
  • lib/cryptography/hazmat/decrepit/ciphers/algorithms.pyc
  • lib/cryptography/hazmat/primitives/__init__.pyc
  • lib/cryptography/hazmat/primitives/_cipheralgorithm.pyc
  • lib/cryptography/hazmat/primitives/ciphers/__init__.pyc
  • lib/cryptography/hazmat/primitives/ciphers/algorithms.pyc
  • lib/cryptography/hazmat/primitives/ciphers/base.pyc
  • lib/cryptography/hazmat/primitives/ciphers/modes.pyc
  • lib/cryptography/hazmat/primitives/hashes.pyc
  • lib/cryptography/hazmat/primitives/hmac.pyc
  • lib/cryptography/hazmat/primitives/padding.pyc
  • lib/cryptography/utils.pyc
  • lib/ctypes/__init__.pyc
  • lib/ctypes/_endian.pyc
  • lib/ctypes/macholib/README.ctypes
  • lib/ctypes/macholib/fetch_macholib
    .sh linux
  • lib/ctypes/macholib/fetch_macholib.bat
  • lib/email/__init__.pyc
  • lib/email/_encoded_words.pyc
  • lib/email/_header_value_parser.pyc
  • lib/email/_parseaddr.pyc
  • lib/email/_policybase.pyc
  • lib/email/architecture.rst
  • lib/email/base64mime.pyc
  • lib/email/charset.pyc
  • lib/email/contentmanager.pyc
  • lib/email/encoders.pyc
  • lib/email/errors.pyc
  • lib/email/feedparser.pyc
  • lib/email/generator.pyc
  • lib/email/header.pyc
  • lib/email/headerregistry.pyc
  • lib/email/iterators.pyc
  • lib/email/message.pyc
  • lib/email/parser.pyc
  • lib/email/policy.pyc
  • lib/email/quoprimime.pyc
  • lib/email/utils.pyc
  • lib/encodings/__init__.pyc
  • lib/encodings/aliases.pyc
  • lib/encodings/ascii.pyc
  • lib/encodings/base64_codec.pyc
  • lib/encodings/big5.pyc
  • lib/encodings/big5hkscs.pyc
  • lib/encodings/bz2_codec.pyc
  • lib/encodings/charmap.pyc
  • lib/encodings/cp037.pyc
  • lib/encodings/cp1006.pyc
  • lib/encodings/cp1026.pyc
  • lib/encodings/cp1125.pyc
  • lib/encodings/cp1140.pyc
  • lib/encodings/cp1250.pyc
  • lib/encodings/cp1251.pyc
  • lib/encodings/cp1252.pyc
  • lib/encodings/cp1253.pyc
  • lib/encodings/cp1254.pyc
  • lib/encodings/cp1255.pyc
  • lib/encodings/cp1256.pyc
  • lib/encodings/cp1257.pyc
  • lib/encodings/cp1258.pyc
  • lib/encodings/cp273.pyc
  • lib/encodings/cp424.pyc
  • lib/encodings/cp437.pyc
  • lib/encodings/cp500.pyc
  • lib/encodings/cp720.pyc
  • lib/encodings/cp737.pyc
  • lib/encodings/cp775.pyc
  • lib/encodings/cp850.pyc
  • lib/encodings/cp852.pyc
  • lib/encodings/cp855.pyc
  • lib/encodings/cp856.pyc
  • lib/encodings/cp857.pyc
  • lib/encodings/cp858.pyc
  • lib/encodings/cp860.pyc
  • lib/encodings/cp861.pyc
  • lib/encodings/cp862.pyc
  • lib/encodings/cp863.pyc
  • lib/encodings/cp864.pyc
  • lib/encodings/cp865.pyc
  • lib/encodings/cp866.pyc
  • lib/encodings/cp869.pyc
  • lib/encodings/cp874.pyc
  • lib/encodings/cp875.pyc
  • lib/encodings/cp932.pyc
  • lib/encodings/cp949.pyc
  • lib/encodings/cp950.pyc
  • lib/encodings/euc_jis_2004.pyc
  • lib/encodings/euc_jisx0213.pyc
  • lib/encodings/euc_jp.pyc
  • lib/encodings/euc_kr.pyc
  • lib/encodings/gb18030.pyc
  • lib/encodings/gb2312.pyc
  • lib/encodings/gbk.pyc
  • lib/encodings/hex_codec.pyc
  • lib/encodings/hp_roman8.pyc
  • lib/encodings/hz.pyc
  • lib/encodings/idna.pyc
  • lib/encodings/iso2022_jp.pyc
  • lib/encodings/iso2022_jp_1.pyc
  • lib/encodings/iso2022_jp_2.pyc
  • lib/encodings/iso2022_jp_2004.pyc
  • lib/encodings/iso2022_jp_3.pyc
  • lib/encodings/iso2022_jp_ext.pyc
  • lib/encodings/iso2022_kr.pyc
  • lib/encodings/iso8859_1.pyc
  • lib/encodings/iso8859_10.pyc
  • lib/encodings/iso8859_11.pyc
  • lib/encodings/iso8859_13.pyc
  • lib/encodings/iso8859_14.pyc
  • lib/encodings/iso8859_15.pyc
  • lib/encodings/iso8859_16.pyc
  • lib/encodings/iso8859_2.pyc
  • lib/encodings/iso8859_3.pyc
  • lib/encodings/iso8859_4.pyc
  • lib/encodings/iso8859_5.pyc
  • lib/encodings/iso8859_6.pyc
  • lib/encodings/iso8859_7.pyc
  • lib/encodings/iso8859_8.pyc
  • lib/encodings/iso8859_9.pyc
  • lib/encodings/johab.pyc
  • lib/encodings/koi8_r.pyc
  • lib/encodings/koi8_t.pyc
  • lib/encodings/koi8_u.pyc
  • lib/encodings/kz1048.pyc
  • lib/encodings/latin_1.pyc
  • lib/encodings/mac_arabic.pyc
  • lib/encodings/mac_croatian.pyc
  • lib/encodings/mac_cyrillic.pyc
  • lib/encodings/mac_farsi.pyc
  • lib/encodings/mac_greek.pyc
  • lib/encodings/mac_iceland.pyc
  • lib/encodings/mac_latin2.pyc
  • lib/encodings/mac_roman.pyc
  • lib/encodings/mac_romanian.pyc
  • lib/encodings/mac_turkish.pyc
  • lib/encodings/mbcs.pyc
  • lib/encodings/oem.pyc
  • lib/encodings/palmos.pyc
  • lib/encodings/ptcp154.pyc
  • lib/encodings/punycode.pyc
  • lib/encodings/quopri_codec.pyc
  • lib/encodings/raw_unicode_escape.pyc
  • lib/encodings/rot_13.pyc
  • lib/encodings/shift_jis.pyc
  • lib/encodings/shift_jis_2004.pyc
  • lib/encodings/shift_jisx0213.pyc
  • lib/encodings/tis_620.pyc
  • lib/encodings/undefined.pyc
  • lib/encodings/unicode_escape.pyc
  • lib/encodings/utf_16.pyc
  • lib/encodings/utf_16_be.pyc
  • lib/encodings/utf_16_le.pyc
  • lib/encodings/utf_32.pyc
  • lib/encodings/utf_32_be.pyc
  • lib/encodings/utf_32_le.pyc
  • lib/encodings/utf_7.pyc
  • lib/encodings/utf_8.pyc
  • lib/encodings/utf_8_sig.pyc
  • lib/encodings/uu_codec.pyc
  • lib/encodings/zlib_codec.pyc
  • lib/importlib/__init__.pyc
  • lib/importlib/_abc.pyc
  • lib/importlib/_bootstrap.pyc
  • lib/importlib/_bootstrap_external.pyc
  • lib/importlib/abc.pyc
  • lib/importlib/machinery.pyc
  • lib/importlib/metadata/__init__.pyc
  • lib/importlib/metadata/_adapters.pyc
  • lib/importlib/metadata/_collections.pyc
  • lib/importlib/metadata/_functools.pyc
  • lib/importlib/metadata/_itertools.pyc
  • lib/importlib/metadata/_meta.pyc
  • lib/importlib/metadata/_text.pyc
  • lib/importlib/readers.pyc
  • lib/importlib/resources/__init__.pyc
  • lib/importlib/resources/_adapters.pyc
  • lib/importlib/resources/_common.pyc
  • lib/importlib/resources/_itertools.pyc
  • lib/importlib/resources/_legacy.pyc
  • lib/importlib/resources/abc.pyc
  • lib/importlib/resources/readers.pyc
  • lib/importlib/resources/simple.pyc
  • lib/importlib/simple.pyc
  • lib/importlib/util.pyc
  • lib/libcrypto-3.dll
    .dll windows:6 windows x64 arch:x64

    39ff058e9c1b8f647f7390cb7c710bc0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/libffi-8.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/library.dat
  • lib/library.zip
    .zip
  • BUILD_CONSTANTS.pyc
  • __future__.pyc
  • __init__hassan.pyc
  • __main__hassan.pyc
  • __startup__.pyc
  • _collections_abc.pyc
  • _compat_pickle.pyc
  • _compression.pyc
  • _py_abc.pyc
  • _pydatetime.pyc
  • _pydecimal.pyc
  • _strptime.pyc
  • _threading_local.pyc
  • _weakrefset.pyc
  • abc.pyc
  • argparse.pyc
  • ast.pyc
  • base64.pyc
  • bisect.pyc
  • bz2.pyc
  • calendar.pyc
  • certifi-2024.8.30.dist-info/INSTALLER
  • certifi-2024.8.30.dist-info/LICENSE
  • certifi-2024.8.30.dist-info/METADATA
  • certifi-2024.8.30.dist-info/RECORD
  • certifi-2024.8.30.dist-info/WHEEL
  • certifi-2024.8.30.dist-info/top_level.txt
  • cffi-1.17.1.dist-info/INSTALLER
  • cffi-1.17.1.dist-info/LICENSE
  • cffi-1.17.1.dist-info/METADATA
  • cffi-1.17.1.dist-info/RECORD
  • cffi-1.17.1.dist-info/WHEEL
  • cffi-1.17.1.dist-info/entry_points.txt
  • cffi-1.17.1.dist-info/top_level.txt
  • click-8.1.7.dist-info/INSTALLER
  • click-8.1.7.dist-info/LICENSE.rst
  • click-8.1.7.dist-info/METADATA
  • click-8.1.7.dist-info/RECORD
  • click-8.1.7.dist-info/WHEEL
  • click-8.1.7.dist-info/top_level.txt
  • codecs.pyc
  • contextlib.pyc
  • contextvars.pyc
  • copy.pyc
  • copyreg.pyc
  • cryptography-43.0.1.dist-info/INSTALLER
  • cryptography-43.0.1.dist-info/METADATA
  • cryptography-43.0.1.dist-info/RECORD
  • cryptography-43.0.1.dist-info/WHEEL
  • csv.pyc
  • dataclasses.pyc
  • datetime.pyc
  • decimal.pyc
  • dis.pyc
  • enum.pyc
  • fnmatch.pyc
  • fractions.pyc
  • functools.pyc
  • genericpath.pyc
  • getopt.pyc
  • gettext.pyc
  • gzip.pyc
  • hashlib.pyc
  • heapq.pyc
  • importlib_metadata-8.4.0.dist-info/INSTALLER
  • importlib_metadata-8.4.0.dist-info/LICENSE
  • importlib_metadata-8.4.0.dist-info/METADATA
  • importlib_metadata-8.4.0.dist-info/RECORD
  • importlib_metadata-8.4.0.dist-info/WHEEL
  • importlib_metadata-8.4.0.dist-info/top_level.txt
  • importlib_resources-6.4.0.dist-info/INSTALLER
  • importlib_resources-6.4.0.dist-info/LICENSE
  • importlib_resources-6.4.0.dist-info/METADATA
  • importlib_resources-6.4.0.dist-info/RECORD
  • importlib_resources-6.4.0.dist-info/WHEEL
  • importlib_resources-6.4.0.dist-info/top_level.txt
  • inspect.pyc
  • io.pyc
  • ipaddress.pyc
  • keyword.pyc
  • linecache.pyc
  • locale.pyc
  • lzma.pyc
  • ntpath.pyc
  • numbers.pyc
  • opcode.pyc
  • operator.pyc
  • os.pyc
  • packaging-24.1.dist-info/INSTALLER
  • packaging-24.1.dist-info/LICENSE
  • packaging-24.1.dist-info/LICENSE.APACHE
  • packaging-24.1.dist-info/LICENSE.BSD
  • packaging-24.1.dist-info/METADATA
  • packaging-24.1.dist-info/RECORD
  • packaging-24.1.dist-info/WHEEL
  • pathlib.pyc
  • pickle.pyc
  • posixpath.pyc
  • pprint.pyc
  • py_compile.pyc
  • pycparser-2.22.dist-info/INSTALLER
  • pycparser-2.22.dist-info/LICENSE
  • pycparser-2.22.dist-info/METADATA
  • pycparser-2.22.dist-info/RECORD
  • pycparser-2.22.dist-info/WHEEL
  • pycparser-2.22.dist-info/top_level.txt
  • quopri.pyc
  • random.pyc
  • reprlib.pyc
  • selectors.pyc
  • shutil.pyc
  • signal.pyc
  • socket.pyc
  • stat.pyc
  • statistics.pyc
  • string.pyc
  • stringprep.pyc
  • struct.pyc
  • subprocess.pyc
  • tarfile.pyc
  • tempfile.pyc
  • textwrap.pyc
  • threading.pyc
  • token.pyc
  • tokenize.pyc
  • traceback.pyc
  • tracemalloc.pyc
  • types.pyc
  • typing.pyc
  • typing_extensions-4.12.2.dist-info/INSTALLER
  • typing_extensions-4.12.2.dist-info/LICENSE
  • typing_extensions-4.12.2.dist-info/METADATA
  • typing_extensions-4.12.2.dist-info/RECORD
  • typing_extensions-4.12.2.dist-info/WHEEL
  • warnings.pyc
  • weakref.pyc
  • zipp-3.20.2.dist-info/INSTALLER
  • zipp-3.20.2.dist-info/LICENSE
  • zipp-3.20.2.dist-info/METADATA
  • zipp-3.20.2.dist-info/RECORD
  • zipp-3.20.2.dist-info/WHEEL
  • zipp-3.20.2.dist-info/top_level.txt
  • lib/logging/__init__.pyc
  • lib/re/__init__.pyc
  • lib/re/_casefix.pyc
  • lib/re/_compiler.pyc
  • lib/re/_constants.pyc
  • lib/re/_parser.pyc
  • lib/select.pyd
    .dll windows:6 windows x64 arch:x64

    e41677fc9cd5514cd954ce2ce19e425c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    a3519e9a1b69560ea1c5fe43fd626ac5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib/urllib/__init__.pyc
  • lib/urllib/parse.pyc
  • lib/zipfile/__init__.pyc
  • lib/zipfile/_path/__init__.pyc
  • lib/zipfile/_path/glob.pyc
  • python3.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • python312.dll
    .dll windows:6 windows x64 arch:x64

    f8e2e55d20d3c537df33c9a83eab99cf


    Code Sign

    Headers

    Imports

    Exports

    Sections