General

  • Target

    $RFDB4ES.rar

  • Size

    13.7MB

  • MD5

    f43a112608b3f0973436b37d87b0a52b

  • SHA1

    560e06b4b1158691db16afc64100cd9bc6d4b616

  • SHA256

    f578d77e5264494fd9cf4b740953b12b348745c43cc256cc5339c6a91413f909

  • SHA512

    aca61d94c6a13e6620d5f0df240804dc71c049bc53ff1d53a3ae50a7a22f2a6ade7effba6be7d60367fe3d5c6ab3124931ed38c50240f933fdb98fea72782721

  • SSDEEP

    393216:1NfaZPrGlu2oRZ2+JmaFiTH3K+cFIoRZ2+Jmag:raZPaIRjmaFyH3Vc1Rjmag

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • $RFDB4ES.rar
    .rar
  • lcb spoofer_updated_quack/Loader.exe
    .exe windows:6 windows x64 arch:x64

    614128c26c018f9d0a9999d7c2cc764e


    Headers

    Imports

    Sections

  • lcb spoofer_updated_quack/Serial Checker.bat
  • lcb spoofer_updated_quack/cleaners/FortniteCleaner.bat
  • lcb spoofer_updated_quack/cleaners/Midnight.bat
  • lcb spoofer_updated_quack/cleaners/Toruney_Cleaner.exe
    .exe windows:6 windows x64 arch:x64

    159731ee3c8c9d0496dcd3dc6dfc52a1


    Headers

    Imports

    Sections

  • lcb spoofer_updated_quack/cleaners/cleaner.exe
    .exe windows:6 windows x64 arch:x64

    04ec74b53750063212aa61296042395d


    Headers

    Imports

    Sections

  • lcb spoofer_updated_quack/cleaners/leakedshit/New Cleaner.bat
  • lcb spoofer_updated_quack/cleaners/leakedshit/applecleaner.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • lcb spoofer_updated_quack/cleaners/leakedshit/clean1.bat
  • lcb spoofer_updated_quack/cleaners/leakedshit/clean2.bat
    .bat .vbs
  • lcb spoofer_updated_quack/cleaners/leakedshit/clean3.bat
  • lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EAC.bat
  • lcb spoofer_updated_quack/cleaners/leakedshit/eac install/EasyAntiCheat_EOS_Setup.exe
    .exe windows:6 windows x86 arch:x86

    a0d6eb56177227fdeb580f73484233df


    Code Sign

    Headers

    Imports

    Sections

  • lcb spoofer_updated_quack/cleaners/leakedshit/read me.txt
  • lcb spoofer_updated_quack/lcb_spoof_crack.exe
    .exe windows:6 windows x64 arch:x64

    614128c26c018f9d0a9999d7c2cc764e


    Headers

    Imports

    Sections

  • lcb spoofer_updated_quack/libcrypto-3-x64.dll
    .dll windows:5 windows x64 arch:x64

    bb5a888ca8f5ecb819108262e4084011


    Headers

    Imports

    Exports

    Sections

  • lcb spoofer_updated_quack/libssl-3-x64.dll
    .dll windows:5 windows x64 arch:x64

    5a3d68cb4a9c1ac01ceaad17d8bea927


    Headers

    Imports

    Exports

    Sections