Resubmissions

09-12-2024 19:32

241209-x83e2sykf1 10

General

  • Target

    prank.zip

  • Size

    37.3MB

  • MD5

    3cfdf9542fe562cafa039b017b6c132c

  • SHA1

    401d3d1cf805acfeb8f54d93afb9003663eb463b

  • SHA256

    eee5148cf8a219e81c9330cc253677333c1b5de273593cbc86986ea0476f414f

  • SHA512

    d136a9ae181408413c15a1975abee60a34ea096f718ead6d2a7f1c8ddd0a2e057d0a80cc7e0282d11643439cb755bd184f62ec50241362dfe8c15ae520d07b6a

  • SSDEEP

    393216:LCyt8yLre34k1CPwDvt3uFRCH3dEVB399e0DG6fTKcY1ErSkTGEzADiyrcFuLtwa:LqH6fecYZKG/iyJe+4vfZ6

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Embeds OpenSSL 2 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • prank.zip
    .zip
  • FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • FastColoredTextBox.xml
    .xml
  • Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Core.xml
    .xml
  • Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.WinForms.xml
    .xml
  • Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Web.WebView2.Wpf.xml
    .xml
  • Monaco/index.html
    .html .js polyglot
  • Monaco/vs/base/worker/workerMain.js
    .js
  • Monaco/vs/basic-languages/bat/bat.js
  • Monaco/vs/basic-languages/coffee/coffee.js
  • Monaco/vs/basic-languages/cpp/cpp.js
  • Monaco/vs/basic-languages/csharp/csharp.js
  • Monaco/vs/basic-languages/csp/csp.js
  • Monaco/vs/basic-languages/css/css.js
  • Monaco/vs/basic-languages/dockerfile/dockerfile.js
  • Monaco/vs/basic-languages/fsharp/fsharp.js
  • Monaco/vs/basic-languages/go/go.js
  • Monaco/vs/basic-languages/handlebars/handlebars.js
    .js
  • Monaco/vs/basic-languages/html/html.js
    .js
  • Monaco/vs/basic-languages/ini/ini.js
  • Monaco/vs/basic-languages/java/java.js
  • Monaco/vs/basic-languages/less/less.js
  • Monaco/vs/basic-languages/lua/lua.js
  • Monaco/vs/basic-languages/markdown/markdown.js
    .js
  • Monaco/vs/basic-languages/msdax/msdax.js
  • Monaco/vs/basic-languages/mysql/mysql.js
  • Monaco/vs/basic-languages/objective-c/objective-c.js
  • Monaco/vs/basic-languages/pgsql/pgsql.js
  • Monaco/vs/basic-languages/php/php.js
  • Monaco/vs/basic-languages/postiats/postiats.js
  • Monaco/vs/basic-languages/powershell/powershell.js
  • Monaco/vs/basic-languages/pug/pug.js
  • Monaco/vs/basic-languages/python/python.js
  • Monaco/vs/basic-languages/r/r.js
  • Monaco/vs/basic-languages/razor/razor.js
    .js
  • Monaco/vs/basic-languages/redis/redis.js
  • Monaco/vs/basic-languages/redshift/redshift.js
  • Monaco/vs/basic-languages/ruby/ruby.js
  • Monaco/vs/basic-languages/rust/rust.js
  • Monaco/vs/basic-languages/sb/sb.js
  • Monaco/vs/basic-languages/scss/scss.js
  • Monaco/vs/basic-languages/solidity/solidity.js
  • Monaco/vs/basic-languages/sql/sql.js
  • Monaco/vs/basic-languages/st/st.js
  • Monaco/vs/basic-languages/swift/swift.js
  • Monaco/vs/basic-languages/vb/vb.js
  • Monaco/vs/basic-languages/xml/xml.js
  • Monaco/vs/basic-languages/yaml/yaml.js
  • Monaco/vs/editor/contrib/suggest/media/String_16x.svg
  • Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
  • Monaco/vs/editor/editor.main.css
  • Monaco/vs/editor/editor.main.js
    .js
  • Monaco/vs/editor/editor.main.nls.de.js
  • Monaco/vs/editor/editor.main.nls.es.js
  • Monaco/vs/editor/editor.main.nls.fr.js
  • Monaco/vs/editor/editor.main.nls.it.js
  • Monaco/vs/editor/editor.main.nls.ja.js
  • Monaco/vs/editor/editor.main.nls.js
  • Monaco/vs/editor/editor.main.nls.ko.js
  • Monaco/vs/editor/editor.main.nls.ru.js
  • Monaco/vs/editor/editor.main.nls.zh-cn.js
  • Monaco/vs/editor/editor.main.nls.zh-tw.js
  • Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
  • Monaco/vs/language/css/cssMode.js
    .js
  • Monaco/vs/language/css/cssWorker.js
    .js
  • Monaco/vs/language/html/htmlMode.js
    .js
  • Monaco/vs/language/html/htmlWorker.js
    .js
  • Monaco/vs/language/json/jsonMode.js
    .js
  • Monaco/vs/language/json/jsonWorker.js
    .js
  • Monaco/vs/language/typescript/lib/typescriptServices.js
    .js
  • Monaco/vs/language/typescript/tsMode.js
    .js
  • Monaco/vs/language/typescript/tsWorker.js
    .js
  • Monaco/vs/loader.js
    .js
  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Newtonsoft.Json.xml
    .xml
  • RC7.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • RC7.exe.config
  • RC7.pdb
  • README.txt
  • Spoofer/Fornlon-Spoofer.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Code Sign

    Headers

    Imports

    Sections

  • ���%b�.pyc
  • bin/Xeno.dll
    .dll windows:6 windows x64 arch:x64

    3a1f9d973bff43051a3daf411f707362


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • cver.txt
  • cxapis.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scripts/Anonymous.txt
  • scripts/BirdWings.txt
  • scripts/Blue_Fire.txt
  • scripts/C00lGui by Team c00lkidd.txt
    .js
  • scripts/CMD-X.txt
  • scripts/CheckFE.txt
  • scripts/Control Player.txt
  • scripts/Divided Character R15.txt
  • scripts/Fire (local).txt
  • scripts/Fire (on player).txt
  • scripts/Fire.txt
  • scripts/Fly Upwards.txt
  • scripts/ForceField.txt
  • scripts/Forcefield (local).txt
  • scripts/Forcefield (on player).txt
  • scripts/Freeze.txt
  • scripts/Green_Fire.txt
  • scripts/Harambe.txt
  • scripts/HipHeight.txt
  • scripts/John Doe.txt
    .js
  • scripts/JumpPower.txt
  • scripts/Lua Hammer.txt
  • scripts/Pendulum Hub.txt
  • scripts/R6.txt
  • scripts/Red_Fire.txt
  • scripts/Ro-Xploit 6.0.txt
  • scripts/RockyAdmin.txt
  • scripts/Smoke Rc7.txt
  • scripts/Sparkles (local) Rc7.txt
  • scripts/Sparkles (on player) Rc7.txt
  • scripts/Spooky Esqueletons Rc7.txt
  • scripts/StatHacks Rc7.txt
  • scripts/allahu akbar.txt
  • scripts/btools.txt
  • scripts/doge particles.txt
  • scripts/illuminati.txt
  • scripts/pepe particles.txt
  • scripts/pewdiepie particles.txt
  • scripts/print.txt
  • scripts/spongebob particles Rc7.txt
  • scripts/spy chat.txt
  • scripts/t0pk3k V3.txt
    .js
  • workspace/.tests/appendfile.txt
  • workspace/.tests/getcustomasset.txt
  • workspace/.tests/isfile.txt
  • workspace/.tests/listfiles/test_1.txt
  • workspace/.tests/listfiles/test_2.txt
  • workspace/.tests/loadfile.txt
  • workspace/.tests/readfile.txt
  • workspace/.tests/writefile
  • workspace/.tests/writefile.txt
  • workspace/IY_FE.iy
  • workspace/Nameless-Admin/Prefix.txt
  • workspace/SimpleSpy/Settings.json
  • workspace/config.yaml