General

  • Target

    250116-p2cbaasjam_pw_infected.zip

  • Size

    45.4MB

  • MD5

    bb89aa912881fd28b0f49ae859159518

  • SHA1

    77d088904c3f72bf81a5655fee5cc171b2afb190

  • SHA256

    994d6a3c00f42e919b596a6234346a095521ce84013474aa462570aa49b0e3da

  • SHA512

    512869aa6457340e9b67a04495c87b9c56d59941e6594c26b6d0c840026433fd637321de206d4a52b23960cdb97e788422bf3f0ef862bac3452d287c810cd66e

  • SSDEEP

    786432:C52/MKfhxQDvG5KendNkkjGfl4jyb1EzJQhKqFhUq0cIfl2smFKTC+N31MmsaJ/A:C5SVfWAkOyhMqFeqTI9PmsT/umNVmLl

Malware Config

Signatures

  • XMRig Miner payload 1 IoCs
  • Xmrig family
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

Files

  • 250116-p2cbaasjam_pw_infected.zip
    .zip

    Password: infected

  • Malware-1-master.zip
    .zip

    Password: fun

  • Malware-1-master/2530.exe
    .exe windows:5 windows x86 arch:x86

    Password: fun

    f0a5716e00f06c2ac94766e26777ea6e


    Headers

    Imports

    Sections

  • Malware-1-master/2887140.exe
    .exe windows:6 windows x86 arch:x86

    Password: fun

    d7854a9aa30702ffeeb9cbadd6e6d19e


    Headers

    Imports

    Sections

  • Malware-1-master/32.exe
    .exe windows:5 windows x86 arch:x86

    Password: fun

    f0a5716e00f06c2ac94766e26777ea6e


    Headers

    Imports

    Sections

  • Malware-1-master/5.exe
    .exe windows:4 windows x86 arch:x86

    Password: fun

    4b9ee012c1a2bb86abb262a522ef8633


    Headers

    Imports

    Sections

  • Malware-1-master/96591.exe
    .exe windows:5 windows x86 arch:x86

    Password: fun

    f0a5716e00f06c2ac94766e26777ea6e


    Headers

    Imports

    Sections

  • Malware-1-master/Amadey.exe
    .exe windows:4 windows x86 arch:x86

    Password: fun

    38c46ebea9bb002b350ca86f8d8d7108


    Headers

    Imports

    Sections

  • Malware-1-master/Blocked-v1.0.ipa
    .zip

    Password: fun

  • Payload/Blocked.app/0s.png
    .png
  • Payload/Blocked.app/1s.png
    .png
  • Payload/Blocked.app/2s.png
    .png
  • Payload/Blocked.app/3s.png
    .png
  • Payload/Blocked.app/4s.png
    .png
  • Payload/Blocked.app/5s.png
    .png
  • Payload/Blocked.app/6s.png
    .png
  • Payload/Blocked.app/7s.png
    .png
  • Payload/Blocked.app/8s.png
    .png
  • Payload/Blocked.app/9s.png
    .png
  • Payload/Blocked.app/Blocked
    .macho macos arch:arm
  • Payload/Blocked.app/Default.png
    .png
  • Payload/Blocked.app/Icon.png
    .png
  • Payload/Blocked.app/Info.plist
    .xml
  • Payload/Blocked.app/PkgInfo
  • Payload/Blocked.app/arrow_left.png
    .png
  • Payload/Blocked.app/arrow_right.png
    .png
  • Payload/Blocked.app/background.png
    .png
  • Payload/Blocked.app/block12.png
    .png
  • Payload/Blocked.app/block13.png
    .png
  • Payload/Blocked.app/block21.png
    .png
  • Payload/Blocked.app/block31.png
    .png
  • Payload/Blocked.app/blockgoal12.png
    .png
  • Payload/Blocked.app/blockgoal13.png
    .png
  • Payload/Blocked.app/blockgoal21.png
    .png
  • Payload/Blocked.app/blockgoal31.png
    .png
  • Payload/Blocked.app/boards.db
  • Payload/Blocked.app/boards.sql
  • Payload/Blocked.app/boards_schema.sql
  • Payload/Blocked.app/difficulty_1.png
    .png
  • Payload/Blocked.app/difficulty_2.png
    .png
  • Payload/Blocked.app/difficulty_3.png
    .png
  • Payload/Blocked.app/difficulty_4.png
    .png
  • Payload/Blocked.app/difficulty_5.png
    .png
  • Payload/Blocked.app/difficultybutton_1.png
    .png
  • Payload/Blocked.app/difficultybutton_2.png
    .png
  • Payload/Blocked.app/difficultybutton_3.png
    .png
  • Payload/Blocked.app/difficultybutton_4.png
    .png
  • Payload/Blocked.app/difficultybutton_5.png
    .png
  • Payload/Blocked.app/done_button.png
    .png
  • Payload/Blocked.app/done_stamp.png
    .png
  • Payload/Blocked.app/done_stamp_mini.png
    .png
  • Payload/Blocked.app/help.png
    .png
  • Payload/Blocked.app/help_button.png
    .png
  • Payload/Blocked.app/level.png
    .png
  • Payload/Blocked.app/level_grid_1.png
    .png
  • Payload/Blocked.app/level_grid_2.png
    .png
  • Payload/Blocked.app/level_grid_3.png
    .png
  • Payload/Blocked.app/level_grid_4.png
    .png
  • Payload/Blocked.app/level_grid_5.png
    .png
  • Payload/Blocked.app/level_small.png
    .png
  • Payload/Blocked.app/levels_background.png
    .png
  • Payload/Blocked.app/levels_button.png
    .png
  • Payload/Blocked.app/records.db
  • Payload/Blocked.app/records_schema.sql
  • Payload/Blocked.app/replay_button.png
    .png
  • Payload/Blocked.app/reset_button.png
    .png
  • Payload/Blocked.app/stamp.aif
  • Payload/Blocked.app/undo_button.png
    .png
  • iTunesArtwork
    .jpg
  • Malware-1-master/Download.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Malware-1-master/GunMayhem1unblocked.swf
  • Malware-1-master/Header
  • Malware-1-master/Illuminati.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • Malware-1-master/LICENSE
  • Malware-1-master/MEMZ-Clean.bat
    .bat .vbs
  • Malware-1-master/MEMZ-Clean.exe
    .exe windows:5 windows x86 arch:x86

    fa1a2f2198605213f450e3c9a78158a8


    Headers

    Imports

    Sections

  • Malware-1-master/MEMZ-Destructive.bat
    .bat .vbs
  • Malware-1-master/MEMZ-Destructive.exe
    .exe windows:5 windows x86 arch:x86

    52753d226ff5a8a88caf9829928cd5d1


    Headers

    Imports

    Sections

  • Malware-1-master/Petya.exe
    .exe windows:5 windows x86 arch:x86

    1a63922d5931d1bb8ca5188313f78eaa


    Headers

    Imports

    Sections

  • Malware-1-master/README.md
  • Malware-1-master/S28667145.tk.txt
  • Malware-1-master/SSL Comodo
  • Malware-1-master/Software.exe
    .exe windows:5 windows x86 arch:x86

    7f2222d75bcebeb591b7d884c5b9299b


    Headers

    Imports

    Sections

  • Malware-1-master/TX3_ojTHxaEidvzTZOAvBPqzTUsyZYJYhArok5hFTyw
  • Malware-1-master/Us4XR_D8S5RQ7SdaFWEiR3sqgAz2IBsgrlxJCfNCEYA
  • Malware-1-master/WannaCry.EXE
    .exe windows:4 windows x86 arch:x86

    68f013d7437aa653a8a98a05807afeb1


    Headers

    Imports

    Sections

  • Malware-1-master/Win32.EvilClusterFuck.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Malware-1-master/apache.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Malware-1-master/butterflyondesktop.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • Malware-1-master/crb.exe
    .exe windows:5 windows x86 arch:x86

    34fc9f1d705d6f6d4e6c04b364ef13e0


    Headers

    Imports

    Sections

  • Malware-1-master/eternalblue.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Malware-1-master/fear.png.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Malware-1-master/getr3kt.bat
    .bat .vbs
  • Malware-1-master/iimo3.exe
    .exe windows:5 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • Malware-1-master/jey.exe
    .exe windows:4 windows x86 arch:x86

    016d8460b9f2ab7f2380c4103e242b0e


    Headers

    Imports

    Sections

  • Malware-1-master/m.exe
    .exe windows:5 windows x86 arch:x86

    16d0da010adcbed32b3269206de04512


    Headers

    Imports

    Sections

  • Malware-1-master/mo3.exe
    .exe windows:5 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • Malware-1-master/mo332.exe
    .exe windows:5 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • Malware-1-master/mysqlconf.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Malware-1-master/o.exe
    .exe windows:5 windows x86 arch:x86

    3d0e5bb0bad44a5e58b77f8275e99ee0


    Headers

    Imports

    Sections

  • Malware-1-master/qOA7iZJcoB8.exe
    .exe windows:5 windows x86 arch:x86

    8ae4a04773f3882a8567173e07a659c6


    Headers

    Imports

    Sections

  • Malware-1-master/readme.md
  • Malware-1-master/rig.exe
    .exe windows:6 windows x86 arch:x86

    223b09ffa68a15c012f9161fa06d7e09


    Headers

    Imports

    Sections

  • Malware-1-master/sserv.jpg
    .exe windows:5 windows x86 arch:x86

    a93bc10227d5a9999fd6f439e1ba7461


    Code Sign

    Headers

    Imports

    Sections

  • Malware-1-master/stak.exe
    .exe windows:6 windows x64 arch:x64

    291991da8bbbc1b37483031156a68b46


    Headers

    Imports

    Sections

  • Malware-1-master/sysm.exe
    .exe windows:5 windows x86 arch:x86

    bdd68345193c3efc98d647d425b4f677


    Headers

    Imports

    Sections

  • Malware-1-master/wannakey-master.zip
    .zip
  • Malware-1-master/wintonic.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Code Sign

    Headers

    Imports

    Sections

  • Malware-1-master/youwin.exe
    .exe windows:4 windows x86 arch:x86

    d4ede8ca47995be40bff4de0f2cede9c


    Headers

    Imports

    Sections