Overview
overview
10Static
static
3Вооtstr...64.zip
windows7-x64
1Вооtstr...64.zip
windows10-2004-x64
1Release/Mi...re.dll
windows7-x64
1Release/Mi...re.dll
windows10-2004-x64
1Release/Xeno.exe
windows7-x64
10Release/Xeno.exe
windows10-2004-x64
10Release/li...64.dll
windows7-x64
1Release/li...64.dll
windows10-2004-x64
1Release/lo...v2.dll
windows7-x64
1Release/lo...v2.dll
windows10-2004-x64
1Release/lo...de.ps1
windows7-x64
3Release/lo...de.ps1
windows10-2004-x64
3Release/lo...m.html
windows7-x64
3Release/lo...m.html
windows10-2004-x64
3Release/lo...ng.dll
windows7-x64
1Release/lo...ng.dll
windows10-2004-x64
1Release/lo...ng.dll
windows7-x64
1Release/lo...ng.dll
windows10-2004-x64
1Release/lo...ng.dll
windows7-x64
1Release/lo...ng.dll
windows10-2004-x64
1Release/lo...47.dll
windows10-2004-x64
1Release/lo...de.ps1
windows7-x64
3Release/lo...de.ps1
windows10-2004-x64
3Release/lo...eg.dll
windows7-x64
1Release/lo...eg.dll
windows10-2004-x64
1Release/lo....1.dll
windows7-x64
1Release/lo....1.dll
windows10-2004-x64
1Release/lo...er.dll
windows7-x64
1Release/lo...er.dll
windows10-2004-x64
1Release/lo...-1.dll
windows7-x64
1Release/lo...-1.dll
windows10-2004-x64
1Release/sc...Dex.js
windows7-x64
3Analysis
- max time kernel
92s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
Вооtstrap-v1.0.9-x64.zip
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Вооtstrap-v1.0.9-x64.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Release/Microsoft.Web.WebView2.Core.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Release/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Release/Xeno.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Release/Xeno.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Release/libssl-3-x64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Release/libssl-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Release/locales/libGLESv2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Release/locales/libGLESv2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Release/locales/locales/de.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Release/locales/locales/de.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Release/locales/resources/LICENSES.chromium.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Release/locales/resources/LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Release/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Release/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral18
Sample
Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Release/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
Release/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Release/locales/resources/d3dcompiler_47.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Release/locales/resources/de.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
Release/locales/resources/de.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Release/locales/resources/ffmpeg.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
Release/locales/resources/ffmpeg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Release/locales/resources/mkl_mc3.1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
Release/locales/resources/mkl_mc3.1.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Release/locales/resources/vk_swiftshader.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral29
Sample
Release/locales/resources/vk_swiftshader.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Release/locales/resources/vulkan-1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
Release/locales/resources/vulkan-1.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Release/scripts/Dex.js
Resource
win7-20240903-en
windows7-x64
General
- Target Вооtstrap-v1.0.9-x64.zip
- Size 53.7MB
- Sample241113-mehtfazend
- SHA256 d49f9a79848735ce6ea9e8bd2a4570d0203bc2fa7b3fbd5fbfc948b6ea3825fd
- MD5 061b316cbc078015d07f5ea3c5ccc4c6
- SHA1 562cb3b52016d5b387e4433cbab8c7ae72ccaca6
- SHA512 3dabbd5364c254ed5ef13abf31f0883108838ba83cf9011851ec971ef3a9737190a7e13226180e9c55dc3db73e83e7d57d7b0f8867600df2bcad4f532b04c461
- SSDEEP 786432:+JKa9WJk+j847n6G2dC6P0uGfhB7DEzrAbcNkSssrzjoIvGEH8XcgEvrGxm0/K/:Va9I7niUJBeS/svLfH8XcBB0/K/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2156 7zFM.exe Token: 35 2156 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 7zFM.exe