General

  • Target

    Vson I Temp.rar

  • Size

    16.8MB

  • MD5

    b97fc35921f8b2f60e4ebda757a161fa

  • SHA1

    41825285f8b8dcf3dab275a8427037d62860ac39

  • SHA256

    bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

  • SHA512

    e3393d73672943223583cf00ce837cf785ded421cce4243a757ddb3724487b96d9b4a0294c47a47210826087187974b62824a4269bd2a0e10470f2f755210a4e

  • SSDEEP

    393216:2PEV8LR5nWvyP/QpfAnFKdEfqdnx16XBap4NT8ibU2larSFFTff:aIa5WUopecdnABai8mUu6Sbf

Score
5/10
upx

Malware Config

Signatures

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • Vson I Temp.rar
    .rar

    Password: 9090

  • temp/temp/temp/temp/Serial Checker.bat
  • temp/temp/temp/temp/cleaners/FortniteCleaner.bat
  • temp/temp/temp/temp/cleaners/Midnight.bat
  • temp/temp/temp/temp/cleaners/Toruney_Cleaner.exe
    .exe windows:6 windows x64 arch:x64

    Password: 9090

    159731ee3c8c9d0496dcd3dc6dfc52a1


    Headers

    Imports

    Sections

  • temp/temp/temp/temp/cleaners/cleaner.exe
    .exe windows:6 windows x64 arch:x64

    Password: 9090

    04ec74b53750063212aa61296042395d


    Headers

    Imports

    Sections

  • temp/temp/temp/temp/d control need/Defender_Settings.vbs
    .vbs
  • temp/temp/temp/temp/d control need/ReadMe.txt
  • temp/temp/temp/temp/d control need/dControl.exe
    .exe windows:5 windows x86 arch:x86

    Password: 9090


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • temp/temp/temp/temp/d control need/dControl.ini
  • temp/temp/temp/temp/libcrypto-3-x64.dll
    .dll windows:5 windows x64 arch:x64

    Password: 9090

    bb5a888ca8f5ecb819108262e4084011


    Headers

    Imports

    Exports

    Sections

  • temp/temp/temp/temp/libssl-3-x64.dll
    .dll windows:5 windows x64 arch:x64

    Password: 9090

    5a3d68cb4a9c1ac01ceaad17d8bea927


    Headers

    Imports

    Exports

    Sections

  • temp/temp/temp/temp/steps.txt
  • temp/temp/temp/temp/vson I temp.exe
    .exe windows:4 windows x86 arch:x86

    Password: 9090

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections