Resubmissions

17/11/2024, 20:54

241117-zp1hfsycjm 7

General

  • Target

    Felk.zip

  • Size

    5.0MB

  • MD5

    8a98ac989da8cf30be68958523a71d16

  • SHA1

    eaf18134e26ca756addf75bb6900476d1107cc68

  • SHA256

    4b8766194b1bd178d67178826cce15ee734ace9a32e7535b694d4e72fd172cde

  • SHA512

    23c263bb346efafa7f46fc8f4e45bff898737d17359d077f9073de99dd8e4da1ec96274241c645a73ff07c625717861a7c204f0ddfe8eabecd4245272dc9e5cf

  • SSDEEP

    98304:aMYs/j/LXCmug2JALK2ELJgAEUnZvpVWRf/KCdXj248iraUidgb7i3WVk:Rj/LIg2JZTJg5UZvpVwf/KKf8iraUu+o

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

Files

  • Felk.zip
    .zip
  • Felk/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Felk/Felk.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Felk/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Felk/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Felk/MetroFramework.Design.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Felk/MetroFramework.Fonts.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Felk/MetroFramework.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Felk/Scripts/InfiniteYield.txt
    .js
  • Felk/VisualStudioTabControl.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Felk/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    dc5ffe84bd3b4405ea83f693b055c515


    Headers

    Imports

    Exports

    Sections

  • Felk/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Felk/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • Felk/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Felk/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Felk/excutornew.exe.config
  • Felk/excutornew.pdb
  • Felk/workspace/IY_FE.iy