General

  • Target

    Debug (2).zip

  • Size

    5.9MB

  • MD5

    d2a428dbd2193fc14eb562f30fb879a7

  • SHA1

    d05ae2f5b512260b3109d2f0eaf8f7aed95b0f7e

  • SHA256

    1eb67c95ff70caed31d059966b15d806537567a6160db6bb5c3beb1dd6510640

  • SHA512

    0f4c51b14433f3f41876358b569cf286c3265076c91ccdbf8567ad74c01a26fe05d64bdafd401db55ba51cb122b25379e1289fd04aeaf509263d5b5534c334a7

  • SSDEEP

    98304:Ly/rGxtwE06gh/TA8pstEe2xIB0+ToxF8+/2DTLqkSf72bTNfq7MN16ayf/bBIlm:Ly/fHGoxTDxFjeD6kSD21SgN16Z7BIlm

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • Debug (2).zip
    .zip
  • ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Core.xml
    .xml
  • Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.WinForms.xml
    .xml
  • Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Wpf.xml
    .xml
  • Monaco/index.html
    .html .js polyglot
  • Monaco/vs/base/worker/workermain.js
    .js
  • Monaco/vs/basic-languages/bat/bat.js
  • Monaco/vs/basic-languages/coffee/coffee.js
  • Monaco/vs/basic-languages/cpp/cpp.js
  • Monaco/vs/basic-languages/csharp/csharp.js
  • Monaco/vs/basic-languages/csp/csp.js
  • Monaco/vs/basic-languages/css/css.js
  • Monaco/vs/basic-languages/dockerfile/dockerfile.js
  • Monaco/vs/basic-languages/fsharp/fsharp.js
  • Monaco/vs/basic-languages/go/go.js
  • Monaco/vs/basic-languages/handlebars/handlebars.js
    .js
  • Monaco/vs/basic-languages/html/html.js
    .js
  • Monaco/vs/basic-languages/ini/ini.js
  • Monaco/vs/basic-languages/java/java.js
  • Monaco/vs/basic-languages/less/less.js
  • Monaco/vs/basic-languages/lua/lua.js
  • Monaco/vs/basic-languages/markdown/markdown.js
    .js
  • Monaco/vs/basic-languages/msdax/msdax.js
  • Monaco/vs/basic-languages/mysql/mysql.js
  • Monaco/vs/basic-languages/objective-c/objective-c.js
  • Monaco/vs/basic-languages/pgsql/pgsql.js
  • Monaco/vs/basic-languages/php/php.js
  • Monaco/vs/basic-languages/postiats/postiats.js
  • Monaco/vs/basic-languages/powershell/powershell.js
  • Monaco/vs/basic-languages/pug/pug.js
  • Monaco/vs/basic-languages/python/python.js
  • Monaco/vs/basic-languages/r/r.js
  • Monaco/vs/basic-languages/razor/razor.js
    .js
  • Monaco/vs/basic-languages/redis/redis.js
  • Monaco/vs/basic-languages/redshift/redshift.js
  • Monaco/vs/basic-languages/ruby/ruby.js
  • Monaco/vs/basic-languages/rust/rust.js
  • Monaco/vs/basic-languages/sb/sb.js
  • Monaco/vs/basic-languages/scss/scss.js
  • Monaco/vs/basic-languages/solidity/solidity.js
  • Monaco/vs/basic-languages/sql/sql.js
  • Monaco/vs/basic-languages/st/st.js
  • Monaco/vs/basic-languages/swift/swift.js
  • Monaco/vs/basic-languages/vb/vb.js
  • Monaco/vs/basic-languages/xml/xml.js
  • Monaco/vs/basic-languages/yaml/yaml.js
  • Monaco/vs/editor/contrib/suggest/media/string_16x.svg
  • Monaco/vs/editor/contrib/suggest/media/string_inverse_16x.svg
  • Monaco/vs/editor/editor.main.css
  • Monaco/vs/editor/editor.main.js
    .js
  • Monaco/vs/editor/editor.main.nls.de.js
  • Monaco/vs/editor/editor.main.nls.es.js
  • Monaco/vs/editor/editor.main.nls.fr.js
  • Monaco/vs/editor/editor.main.nls.it.js
  • Monaco/vs/editor/editor.main.nls.ja.js
  • Monaco/vs/editor/editor.main.nls.js
  • Monaco/vs/editor/editor.main.nls.ko.js
  • Monaco/vs/editor/editor.main.nls.ru.js
  • Monaco/vs/editor/editor.main.nls.zh-cn.js
  • Monaco/vs/editor/editor.main.nls.zh-tw.js
  • Monaco/vs/editor/standalone/browser/quickopen/symbol-sprite.svg
  • Monaco/vs/language/css/cssmode.js
    .js
  • Monaco/vs/language/css/cssworker.js
    .js
  • Monaco/vs/language/html/htmlmode.js
    .js
  • Monaco/vs/language/html/htmlworker.js
    .js
  • Monaco/vs/language/json/jsonmode.js
    .js
  • Monaco/vs/language/json/jsonworker.js
    .js
  • Monaco/vs/language/typescript/lib/typescriptservices.js
    .js
  • Monaco/vs/language/typescript/tsmode.js
    .js
  • Monaco/vs/language/typescript/tsworker.js
    .js
  • Monaco/vs/loader.js
    .js
  • bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    ac435dfa812fddee99bbf7a986186d1d


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • meeeeelt.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • meeeeelt.exe.WebView2/EBWebView/Crashpad/settings.dat
  • meeeeelt.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000002
    .gz
  • f_000002
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000003
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000004
  • meeeeelt.exe.WebView2/EBWebView/Default/Cache/Cache_Data/index
  • meeeeelt.exe.WebView2/EBWebView/Default/Code Cache/js/index
  • meeeeelt.exe.WebView2/EBWebView/Default/Code Cache/js/index-dir/the-real-index
  • meeeeelt.exe.WebView2/EBWebView/Default/Code Cache/wasm/index
  • meeeeelt.exe.WebView2/EBWebView/Default/Code Cache/wasm/index-dir/the-real-index
  • meeeeelt.exe.WebView2/EBWebView/Default/DIPS
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_0
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_1
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_2
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_3
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnGraphiteCache/index
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_0
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_1
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_2
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_3
  • meeeeelt.exe.WebView2/EBWebView/Default/DawnWebGPUCache/index
  • meeeeelt.exe.WebView2/EBWebView/Default/EdgeEDrop/EdgeEDropSQLite.db
  • meeeeelt.exe.WebView2/EBWebView/Default/EdgeHubAppUsage/EdgeHubAppUsageSQLite.db
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension Rules/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension Rules/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension Rules/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension Scripts/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension Scripts/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension Scripts/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension State/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension State/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension State/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/Extension State/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/ExtensionActivityComp
  • meeeeelt.exe.WebView2/EBWebView/Default/ExtensionActivityEdge
  • meeeeelt.exe.WebView2/EBWebView/Default/Favicons
  • meeeeelt.exe.WebView2/EBWebView/Default/GPUCache/data_0
  • meeeeelt.exe.WebView2/EBWebView/Default/GPUCache/data_1
  • meeeeelt.exe.WebView2/EBWebView/Default/GPUCache/data_2
  • meeeeelt.exe.WebView2/EBWebView/Default/GPUCache/data_3
  • meeeeelt.exe.WebView2/EBWebView/Default/GPUCache/index
  • meeeeelt.exe.WebView2/EBWebView/Default/History
  • meeeeelt.exe.WebView2/EBWebView/Default/Local Storage/leveldb/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/Local Storage/leveldb/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Login Data
  • meeeeelt.exe.WebView2/EBWebView/Default/Network Action Predictor
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/Cookies
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/Network Persistent State
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/Reporting and NEL
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/SCT Auditing Pending Reports
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/Sdch Dictionaries
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/TransportSecurity
  • meeeeelt.exe.WebView2/EBWebView/Default/Network/Trust Tokens
  • meeeeelt.exe.WebView2/EBWebView/Default/Preferences
  • meeeeelt.exe.WebView2/EBWebView/Default/PreferredApps
  • meeeeelt.exe.WebView2/EBWebView/Default/README
  • meeeeelt.exe.WebView2/EBWebView/Default/Safe Browsing Network/Safe Browsing Cookies
  • meeeeelt.exe.WebView2/EBWebView/Default/Secure Preferences
  • meeeeelt.exe.WebView2/EBWebView/Default/Session Storage/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Session Storage/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Session Storage/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/Session Storage/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index
  • meeeeelt.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index-dir/the-real-index
  • meeeeelt.exe.WebView2/EBWebView/Default/Shared Dictionary/db
  • meeeeelt.exe.WebView2/EBWebView/Default/SharedStorage
  • meeeeelt.exe.WebView2/EBWebView/Default/Site Characteristics Database/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/Site Characteristics Database/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/Top Sites
  • meeeeelt.exe.WebView2/EBWebView/Default/Visited Links
  • meeeeelt.exe.WebView2/EBWebView/Default/Web Data
  • meeeeelt.exe.WebView2/EBWebView/Default/heavy_ad_intervention_opt_out.db
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/CURRENT
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG.old
  • meeeeelt.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/MANIFEST-000001
  • meeeeelt.exe.WebView2/EBWebView/GrShaderCache/data_0
  • meeeeelt.exe.WebView2/EBWebView/GrShaderCache/data_1
  • meeeeelt.exe.WebView2/EBWebView/GrShaderCache/data_2
  • meeeeelt.exe.WebView2/EBWebView/GrShaderCache/data_3
  • meeeeelt.exe.WebView2/EBWebView/GrShaderCache/f_000001
  • meeeeelt.exe.WebView2/EBWebView/GrShaderCache/index
  • meeeeelt.exe.WebView2/EBWebView/GraphiteDawnCache/data_0
  • meeeeelt.exe.WebView2/EBWebView/GraphiteDawnCache/data_1
  • meeeeelt.exe.WebView2/EBWebView/GraphiteDawnCache/data_2
  • meeeeelt.exe.WebView2/EBWebView/GraphiteDawnCache/data_3
  • meeeeelt.exe.WebView2/EBWebView/GraphiteDawnCache/index
  • meeeeelt.exe.WebView2/EBWebView/Last Version
  • meeeeelt.exe.WebView2/EBWebView/Local State
  • meeeeelt.exe.WebView2/EBWebView/ShaderCache/data_0
  • meeeeelt.exe.WebView2/EBWebView/ShaderCache/data_1
  • meeeeelt.exe.WebView2/EBWebView/ShaderCache/data_2
  • meeeeelt.exe.WebView2/EBWebView/ShaderCache/data_3
  • meeeeelt.exe.WebView2/EBWebView/ShaderCache/index
  • meeeeelt.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings
  • meeeeelt.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings_2.0-0
  • meeeeelt.exe.WebView2/EBWebView/Variations
  • meeeeelt.exe.config
  • meeeeelt.pdb
  • runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections