Kox_Spoofer__LEAKED_.rar
- SHA256 cd2fdd55b920a87b56eaca6f8b1b78db347a4b4b42a1e67a0f0c4d1e09c19c06
Overview
overview
10Static
static
10Spoofer/In...64.dll
windows10-2004-x64
1Spoofer/In...64.dll
windows11-21h2-x64
1Spoofer/In...64.dll
windows10-2004-x64
1Spoofer/In...64.dll
windows11-21h2-x64
1Spoofer/In...64.dll
windows10-2004-x64
1Spoofer/In...64.dll
windows11-21h2-x64
1Spoofer/In...64.dll
windows10-2004-x64
1Spoofer/In...64.dll
windows11-21h2-x64
1Spoofer/Mo...er.dll
windows10-2004-x64
1Spoofer/Mo...er.dll
windows11-21h2-x64
1Spoofer/Sp...ox.exe
windows10-2004-x64
8Spoofer/Sp...ox.exe
windows11-21h2-x64
8Spoofer/by...-0.dll
windows10-2004-x64
3Spoofer/by...-0.dll
windows11-21h2-x64
3Spoofer/by...-0.dll
windows10-2004-x64
3Spoofer/by...-0.dll
windows11-21h2-x64
3Spoofer/by...-0.dll
windows10-2004-x64
3Spoofer/by...-0.dll
windows11-21h2-x64
3Spoofer/by...-0.dll
windows10-2004-x64
3Spoofer/by...-0.dll
windows11-21h2-x64
3Spoofer/by...-1.dll
windows10-2004-x64
3Spoofer/by...-1.dll
windows11-21h2-x64
3Spoofer/mo...gc.dll
windows10-2004-x64
1Spoofer/mo...gc.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Spoofer/Interface/Magick.Native-Q16-arm64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Spoofer/Interface/Magick.Native-Q16-arm64.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Spoofer/Interface/Magick.Native-Q16-x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Spoofer/Interface/Magick.Native-Q16-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Spoofer/Interface/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Spoofer/Interface/libcrypto-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Spoofer/Interface/libssl-3-x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Spoofer/Interface/libssl-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Spoofer/MonoPosixHelper.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Spoofer/MonoPosixHelper.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Spoofer/SpooferByKox.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Spoofer/SpooferByKox.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
Spoofer/bypass/api-ms-win-core-memory-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Spoofer/bypass/api-ms-win-core-memory-l1-1-0.dll
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
Spoofer/bypass/api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Spoofer/bypass/api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
Spoofer/bypass/api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Spoofer/bypass/api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
Spoofer/bypass/api-ms-win-core-processthreads-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Spoofer/bypass/api-ms-win-core-processthreads-l1-1-0.dll
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
Spoofer/bypass/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Spoofer/bypass/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
Spoofer/mono-2.0-bdwgc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
Spoofer/mono-2.0-bdwgc.dll
Resource
win11-20241007-en
njrat
im523
HacKed
147.185.221.24:50768
543f49bacff49231d84b60f449c28484
543f49bacff49231d84b60f449c28484
|'|'|
Embeds OpenSSL, may be used to circumvent TLS interception.
| resource | yara_rule |
|---|---|
| static1/unpack001/Spoofer/Interface/libcrypto-3-x64.dll | embeds_openssl |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Spoofer/Interface/libcrypto-3-x64.dll |
| unpack001/Spoofer/Interface/libssl-3-x64.dll |
| unpack001/Spoofer/MonoPosixHelper.dll |
| unpack001/Spoofer/SpooferByKox.exe |
Sep 6, 2024
count=33, id=259, version=30795,
count=239, id=261, version=30795,
count=21, id=253, version=33808,
count=17, id=259, version=33808,
count=18, id=260, version=33808,
count=100, id=261, version=33808,
count=73, id=260, version=30795,
count=27, productName=Unmarked objects (old),
count=1, id=259, version=34120,
count=622, id=261, version=34120,
count=1262, id=260, version=34120,
count=25, id=257, version=30795,
count=419, id=1, productName=Unmarked objects,
count=39, id=265, version=34120,
count=1, id=256, version=34120,
count=1, id=255, version=34120,
count=1, id=151,
count=1, id=258, version=34120,
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33808,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=12, id=261, version=33808,
count=211, id=1, productName=Unmarked objects,
count=11, id=257, version=30795,
count=36, productName=Unmarked objects (old),
count=917, id=260, version=34120,
count=1, id=256, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33808,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=13, id=261, version=33808,
count=4, id=257, version=30795,
count=3, id=257, version=34120,
count=603, id=1, productName=Unmarked objects,
count=102, id=260, version=34120,
count=1, id=256, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=241, version=40116,
count=171, id=243, version=40116,
count=14, id=242, version=40116,
count=2, id=199, version=41118,
count=7, id=259, version=23907,
count=22, id=261, version=23907,
count=17, id=260, version=23907,
count=5, id=203, version=65501,
count=104, id=1, productName=Unmarked objects,
count=25, id=260, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Unsigned PE
Checks for missing Authenticode signature.
Jan 15, 2025
count=1, id=238, version=40116,
count=2, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
Jan 15, 2025
count=1, id=238, version=40116,
count=2, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
Jan 15, 2025
count=1, id=238, version=40116,
count=2, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
Jan 15, 2025
count=1, id=238, version=40116,
count=2, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
Jan 15, 2025
count=1, id=238, version=40116,
count=2, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
May 23, 2019
CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=21, id=241, version=40116,
count=193, id=243, version=40116,
count=48, id=242, version=40116,
count=9, id=199, version=41118,
count=8, id=259, version=23907,
count=21, id=261, version=23907,
count=20, id=260, version=23907,
count=1, id=208, version=65501,
count=23, id=203, version=65501,
count=317, id=1, productName=Unmarked objects,
count=1, id=259, productName=VS2015 UPD2 build 23918, version=23918,
count=245, id=260, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,