Overview

overview

10

Static

static

10

yes.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yes.7z

  • Size

    37.3MB

  • MD5

    028d808e644a4499b62cadb5106f54d8

  • SHA1

    58fc0d31ded82d8fd6d3aac9cefd2fbdd7236df8

  • SHA256

    dd2c7f46e8f070fcc9ef66271e2741d07bf2ba59c40790751d9fa32b8296881d

  • SHA512

    0368eeb8af3fb1a6e0f7f66c86fb2d91a5fd1393c30f2ad8a042d771fc2e77fac6c35cbe288cc23944ff6f1a0c9e5c84202f7f4ef9adaa8ce99d4d72610a6b39

  • SSDEEP

    786432:6bAVFSMAPH/sldSJUo5c67RlaBsyvIY5vtGPlMO8:6bAVg/PHsoq60swh5gm7

Score
10/10
upx

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • yes.7z
    .7z
  • 888_RAT.exe
    .exe windows:4 windows x86 arch:x86

    29b61e5a552b3a9bc00953de1c93be41


    Headers

    Imports

    Sections

  • 888_RAT_1.0.9 Cracked by Shark M!nd.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • majid z hacker website.exe
    .exe windows:4 windows x86 arch:x86

    29b61e5a552b3a9bc00953de1c93be41


    Headers

    Imports

    Sections

  • microsoft corporation.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • program startup.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • script.vbs
    .vbs
  • apktool.jar
    .jar