damn.zip
- SHA256 fa8cc2b40e644427aa4ec7e9441f5b75389c6a7915cd732b01a5a50921331e80
Overview
overview
10Static
static
10Client - C...0).exe
windows11-21h2-x64
10Client - C...1).exe
windows11-21h2-x64
10Client - C...2).exe
windows11-21h2-x64
10Client - C...3).exe
windows11-21h2-x64
10Client - C...4).exe
windows11-21h2-x64
10Client - C...5).exe
windows11-21h2-x64
10Client - C...6).exe
windows11-21h2-x64
10Client - C...7).exe
windows11-21h2-x64
10Client - C...8).exe
windows11-21h2-x64
10Client - C...9).exe
windows11-21h2-x64
10Client - Copy (2).exe
windows11-21h2-x64
10Client - C...0).exe
windows11-21h2-x64
10Client - C...1).exe
windows11-21h2-x64
10Client - C...2).exe
windows11-21h2-x64
10Client - C...3).exe
windows11-21h2-x64
10Client - C...4).exe
windows11-21h2-x64
10Client - C...5).exe
windows11-21h2-x64
10Client - C...6).exe
windows11-21h2-x64
10Client - C...7).exe
windows11-21h2-x64
10Client - C...8).exe
windows11-21h2-x64
10Client - C...9).exe
windows11-21h2-x64
10Client - Copy (3).exe
windows11-21h2-x64
10Client - C...0).exe
windows11-21h2-x64
10Client - C...1).exe
windows11-21h2-x64
10Client - Copy (4).exe
windows11-21h2-x64
10Client - Copy (5).exe
windows11-21h2-x64
10Client - Copy (6).exe
windows11-21h2-x64
10Client - Copy (7).exe
windows11-21h2-x64
10Client - Copy (8).exe
windows11-21h2-x64
10Client - Copy (9).exe
windows11-21h2-x64
10Client - Copy.exe
windows11-21h2-x64
10Client.exe
windows11-21h2-x64
10Behavioral task
behavioral1
Sample
Client - Copy (10).exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
Client - Copy (11).exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral3
Sample
Client - Copy (12).exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral4
Sample
Client - Copy (13).exe
Resource
win11-20241023-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral5
Sample
Client - Copy (14).exe
Resource
win11-20241023-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral6
Sample
Client - Copy (15).exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral7
Sample
Client - Copy (16).exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral8
Sample
Client - Copy (17).exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral9
Sample
Client - Copy (18).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral10
Sample
Client - Copy (19).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral11
Sample
Client - Copy (2).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral12
Sample
Client - Copy (20).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral13
Sample
Client - Copy (21).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral14
Sample
Client - Copy (22).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral15
Sample
Client - Copy (23).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral16
Sample
Client - Copy (24).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral17
Sample
Client - Copy (25).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral18
Sample
Client - Copy (26).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral19
Sample
Client - Copy (27).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral20
Sample
Client - Copy (28).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral21
Sample
Client - Copy (29).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral22
Sample
Client - Copy (3).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral23
Sample
Client - Copy (30).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral24
Sample
Client - Copy (31).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral25
Sample
Client - Copy (4).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral26
Sample
Client - Copy (5).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral27
Sample
Client - Copy (6).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral28
Sample
Client - Copy (7).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral29
Sample
Client - Copy (8).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral30
Sample
Client - Copy (9).exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral31
Sample
Client - Copy.exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
900 seconds
General
- Target damn.zip
- Size 2.2MB
- Sample250108-a2bmesykbn
- SHA256 fa8cc2b40e644427aa4ec7e9441f5b75389c6a7915cd732b01a5a50921331e80
- MD5 5797d65f4c208a90b54dd4656510ba59
- SHA1 70f5451c90062d511e64542759bf4969bb4dd138
- SHA512 2731c8eb4655fd30ea15d6d4c182459a24b88347539fca23e9cae5919255e2b32d9cc399cac5719d80e34e80a7e885a80848a07872f8d4eca309d6b3c6718079
- SSDEEP 24576:QhUrmkx1ikx+jIVinmrw9SXMZuTTuF4/6hUrmkx1ikx+jIVinmrw9SXMZuTTuF4i:k
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
159.203.126.35:22279
Mutex
-
hnfkoikowllyvsdhi
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 64 IoCs
resource yara_rule static1/unpack002/Client - Copy (10).exe family_asyncrat static1/unpack002/Client - Copy (11).exe family_asyncrat static1/unpack002/Client - Copy (12).exe family_asyncrat static1/unpack002/Client - Copy (13).exe family_asyncrat static1/unpack002/Client - Copy (14).exe family_asyncrat static1/unpack002/Client - Copy (15).exe family_asyncrat static1/unpack002/Client - Copy (16).exe family_asyncrat static1/unpack002/Client - Copy (17).exe family_asyncrat static1/unpack002/Client - Copy (18).exe family_asyncrat static1/unpack002/Client - Copy (19).exe family_asyncrat static1/unpack002/Client - Copy (2).exe family_asyncrat static1/unpack002/Client - Copy (20).exe family_asyncrat static1/unpack002/Client - Copy (21).exe family_asyncrat static1/unpack002/Client - Copy (22).exe family_asyncrat static1/unpack002/Client - Copy (23).exe family_asyncrat static1/unpack002/Client - Copy (24).exe family_asyncrat static1/unpack002/Client - Copy (25).exe family_asyncrat static1/unpack002/Client - Copy (26).exe family_asyncrat static1/unpack002/Client - Copy (27).exe family_asyncrat static1/unpack002/Client - Copy (28).exe family_asyncrat static1/unpack002/Client - Copy (29).exe family_asyncrat static1/unpack002/Client - Copy (3).exe family_asyncrat static1/unpack002/Client - Copy (30).exe family_asyncrat static1/unpack002/Client - Copy (31).exe family_asyncrat static1/unpack002/Client - Copy (4).exe family_asyncrat static1/unpack002/Client - Copy (5).exe family_asyncrat static1/unpack002/Client - Copy (6).exe family_asyncrat static1/unpack002/Client - Copy (7).exe family_asyncrat static1/unpack002/Client - Copy (8).exe family_asyncrat static1/unpack002/Client - Copy (9).exe family_asyncrat static1/unpack002/Client - Copy.exe family_asyncrat static1/unpack002/Client.exe family_asyncrat static1/unpack001/Client - Copy (10).exe family_asyncrat static1/unpack001/Client - Copy (11).exe family_asyncrat static1/unpack001/Client - Copy (12).exe family_asyncrat static1/unpack001/Client - Copy (13).exe family_asyncrat static1/unpack001/Client - Copy (14).exe family_asyncrat static1/unpack001/Client - Copy (15).exe family_asyncrat static1/unpack001/Client - Copy (16).exe family_asyncrat static1/unpack001/Client - Copy (17).exe family_asyncrat static1/unpack001/Client - Copy (18).exe family_asyncrat static1/unpack001/Client - Copy (19).exe family_asyncrat static1/unpack001/Client - Copy (2).exe family_asyncrat static1/unpack001/Client - Copy (20).exe family_asyncrat static1/unpack001/Client - Copy (21).exe family_asyncrat static1/unpack001/Client - Copy (22).exe family_asyncrat static1/unpack001/Client - Copy (23).exe family_asyncrat static1/unpack001/Client - Copy (24).exe family_asyncrat static1/unpack001/Client - Copy (25).exe family_asyncrat static1/unpack001/Client - Copy (26).exe family_asyncrat static1/unpack001/Client - Copy (27).exe family_asyncrat static1/unpack001/Client - Copy (28).exe family_asyncrat static1/unpack001/Client - Copy (29).exe family_asyncrat static1/unpack001/Client - Copy (3).exe family_asyncrat static1/unpack001/Client - Copy (30).exe family_asyncrat static1/unpack001/Client - Copy (31).exe family_asyncrat static1/unpack001/Client - Copy (4).exe family_asyncrat static1/unpack001/Client - Copy (5).exe family_asyncrat static1/unpack001/Client - Copy (6).exe family_asyncrat static1/unpack001/Client - Copy (7).exe family_asyncrat static1/unpack001/Client - Copy (8).exe family_asyncrat static1/unpack001/Client - Copy (9).exe family_asyncrat static1/unpack001/Client - Copy.exe family_asyncrat static1/unpack001/Client.exe family_asyncrat - Asyncrat family
- Unsigned PE 64 IoCs
Checks for missing Authenticode signature.
resource unpack002/Client - Copy (10).exe unpack002/Client - Copy (11).exe unpack002/Client - Copy (12).exe unpack002/Client - Copy (13).exe unpack002/Client - Copy (14).exe unpack002/Client - Copy (15).exe unpack002/Client - Copy (16).exe unpack002/Client - Copy (17).exe unpack002/Client - Copy (18).exe unpack002/Client - Copy (19).exe unpack002/Client - Copy (2).exe unpack002/Client - Copy (20).exe unpack002/Client - Copy (21).exe unpack002/Client - Copy (22).exe unpack002/Client - Copy (23).exe unpack002/Client - Copy (24).exe unpack002/Client - Copy (25).exe unpack002/Client - Copy (26).exe unpack002/Client - Copy (27).exe unpack002/Client - Copy (28).exe unpack002/Client - Copy (29).exe unpack002/Client - Copy (3).exe unpack002/Client - Copy (30).exe unpack002/Client - Copy (31).exe unpack002/Client - Copy (4).exe unpack002/Client - Copy (5).exe unpack002/Client - Copy (6).exe unpack002/Client - Copy (7).exe unpack002/Client - Copy (8).exe unpack002/Client - Copy (9).exe unpack002/Client - Copy.exe unpack002/Client.exe unpack001/Client - Copy (10).exe unpack001/Client - Copy (11).exe unpack001/Client - Copy (12).exe unpack001/Client - Copy (13).exe unpack001/Client - Copy (14).exe unpack001/Client - Copy (15).exe unpack001/Client - Copy (16).exe unpack001/Client - Copy (17).exe unpack001/Client - Copy (18).exe unpack001/Client - Copy (19).exe unpack001/Client - Copy (2).exe unpack001/Client - Copy (20).exe unpack001/Client - Copy (21).exe unpack001/Client - Copy (22).exe unpack001/Client - Copy (23).exe unpack001/Client - Copy (24).exe unpack001/Client - Copy (25).exe unpack001/Client - Copy (26).exe unpack001/Client - Copy (27).exe unpack001/Client - Copy (28).exe unpack001/Client - Copy (29).exe unpack001/Client - Copy (3).exe unpack001/Client - Copy (30).exe unpack001/Client - Copy (31).exe unpack001/Client - Copy (4).exe unpack001/Client - Copy (5).exe unpack001/Client - Copy (6).exe unpack001/Client - Copy (7).exe unpack001/Client - Copy (8).exe unpack001/Client - Copy (9).exe unpack001/Client - Copy.exe unpack001/Client.exe
File Explorer
-
damn.zip.zip 2.2MB
-
3D Objects/damn.zip.zip 1.1MB
-
Client - Copy (10).exe.exe 74KB
-
Client - Copy (11).exe.exe 74KB
-
Client - Copy (12).exe.exe 74KB
-
Client - Copy (13).exe.exe 74KB
-
Client - Copy (14).exe.exe 74KB
-
Client - Copy (15).exe.exe 74KB
-
Client - Copy (16).exe.exe 74KB
-
Client - Copy (17).exe.exe 74KB
-
Client - Copy (18).exe.exe 74KB
-
Client - Copy (19).exe.exe 74KB
-
Client - Copy (2).exe.exe 74KB
-
Client - Copy (20).exe.exe 74KB
-
Client - Copy (21).exe.exe 74KB
-
Client - Copy (22).exe.exe 74KB
-
Client - Copy (23).exe.exe 74KB
-
Client - Copy (24).exe.exe 74KB
-
Client - Copy (25).exe.exe 74KB
-
Client - Copy (26).exe.exe 74KB
-
Client - Copy (27).exe.exe 74KB
-
Client - Copy (28).exe.exe 74KB
-
Client - Copy (29).exe.exe 74KB
-
Client - Copy (3).exe.exe 74KB
-
Client - Copy (30).exe.exe 74KB
-
Client - Copy (31).exe.exe 74KB
-
Client - Copy (4).exe.exe 74KB
-
Client - Copy (5).exe.exe 74KB
-
Client - Copy (6).exe.exe 74KB
-
Client - Copy (7).exe.exe 74KB
-
Client - Copy (8).exe.exe 74KB
-
Client - Copy (9).exe.exe 74KB
-
Client - Copy.exe.exe 74KB
-
Client.exe.exe 74KB
-
Client - Copy (10).exe.exe 74KB
-
Client - Copy (11).exe.exe 74KB
-
Client - Copy (12).exe.exe 74KB
-
Client - Copy (13).exe.exe 74KB
-
Client - Copy (14).exe.exe 74KB
-
Client - Copy (15).exe.exe 74KB
-
Client - Copy (16).exe.exe 74KB
-
Client - Copy (17).exe.exe 74KB
-
Client - Copy (18).exe.exe 74KB
-
Client - Copy (19).exe.exe 74KB
-
Client - Copy (2).exe.exe 74KB
-
Client - Copy (20).exe.exe 74KB
-
Client - Copy (21).exe.exe 74KB
-
Client - Copy (22).exe.exe 74KB
-
Client - Copy (23).exe.exe 74KB
-
Client - Copy (24).exe.exe 74KB
-
Client - Copy (25).exe.exe 74KB
-
Client - Copy (26).exe.exe 74KB
-
Client - Copy (27).exe.exe 74KB
-
Client - Copy (28).exe.exe 74KB
-
Client - Copy (29).exe.exe 74KB
-
Client - Copy (3).exe.exe 74KB
-
Client - Copy (30).exe.exe 74KB
-
Client - Copy (31).exe.exe 74KB
-
Client - Copy (4).exe.exe 74KB
-
Client - Copy (5).exe.exe 74KB
-
Client - Copy (6).exe.exe 74KB
-
Client - Copy (7).exe.exe 74KB
-
Client - Copy (8).exe.exe 74KB
-
Client - Copy (9).exe.exe 74KB
-
Client - Copy.exe.exe 74KB
-
Client.exe.exe 74KB
3D Objects/damn.zip
- SHA256 86bdc7097235e4257b643b569ef4cf9bef7d34a0df98392537b883e25cf80a4e
- MD5 8ef4bb29fadaa379edf37720c766ee7a
- SHA1 deffd0cf7932b5be65b2534dff7a5b71eb8e68ee
- SHA512 0f6442bf4c2985951ab0a1da9bac6f170350c6a995e1927d069b865c6caf2d16465aa762fa179e5ecf84852dfc7cd3559fcb5ab7b1771878cfb22da2351b665f
- SSDEEP 24576:QhUrmkx1ikx+jIVinmrw9SXMZuTTuF4/B:d
- MD5 SHA1 SHA512 SSDEEP
Client - Copy (10).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (11).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (12).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (13).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (14).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (15).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (16).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (17).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (18).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (19).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (20).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (21).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (22).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (23).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (24).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (25).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (26).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (27).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (28).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (29).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (3).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (30).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (31).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (4).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (5).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (6).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (7).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (8).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (9).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (10).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (11).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (12).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (13).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (14).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (15).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (16).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (17).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (18).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (19).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (20).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (21).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (22).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (23).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (24).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (25).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (26).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (27).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (28).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (29).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (3).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (30).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (31).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (4).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (5).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (6).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (7).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (8).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy (9).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client - Copy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2a1b43cafc7425461176f66986b25408dca8fedef6ec84b411a82da5be8953ab
- MD5 518cefe78569449a64ba9fcc57722fc3
- SHA1 f5a37814247e38571eea79a509b81599b95868fd
- SHA512 88a17a768af4800e7b6f8f96cfb7de4788b5eceae6241dba694cf071410365508bb7982761bbbd518ada6e4db713e591b800a3365e1dd1daddc3918f09661958
- SSDEEP 1536:EUEkcx4VHsC0SPMV7e9VdQuDI6H1bf/DtQzc2LVclN:EUxcx4GfSPMV7e9VdQsH1bfZQPBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ