General

  • Target

    -btStrapper-.zip

  • Size

    112.7MB

  • MD5

    83eca0d623c3e29a3b43fb1f2817df4f

  • SHA1

    5c7cc3f8fc04f2bab635d33b9a7eea461cb00587

  • SHA256

    536e8b1207df3afebfae5d4d9f19e33948c04967c322ae1c02fae00bc3695346

  • SHA512

    2704c0f55ba55a04016ac59d9441ebced889e078245f68108e1a0ad98b624a9224b76ff8fc626b22c09302a3fe2147af7f845a8560bb9ac87cb412aa0dc954c3

  • SSDEEP

    1572864:f8mOnpSsJe8FMY/eGQl2zJYFdCG/zGSQkild9TE4kaWeQi3kR+pYb+KqDlH:f8LHLFaGUaqyXV44kaWi3kRPjqt

Score
3/10

Malware Config

Signatures

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

Files

  • -btStrapper-.zip
    .zip

    Password: ryos

  • README.txt
  • bootstrapper.zip
    .zip

    Password: ryos

  • bootstrapper/Bootstrapper.exe
    .exe windows:5 windows x64 arch:x64

    Password: ryos

    fb9c10264f2f8b2b71b7b4faf8701fec


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bootstrapper/LICENSE.electron.txt
  • bootstrapper/LICENSES.chromium.html
  • bootstrapper/chrome_100_percent.pak
  • bootstrapper/chrome_200_percent.pak
  • bootstrapper/d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    Password: ryos

    36f6d7806085bd3a70ed8c5dcb51f6c8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bootstrapper/ffmpeg.dll
    .dll windows:6 windows x64 arch:x64

    Password: ryos

    99c7db203f67e21296b9f90bdb8b5406


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/icudtl.dat
  • bootstrapper/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    Password: ryos

    b7d07fba9927b6b4247e86eea7632776


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    Password: ryos

    c54faf0fba825e7f8ac6d2a8308136b4


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/locales/am.pak
  • bootstrapper/locales/ar.pak
  • bootstrapper/locales/bg.pak
  • bootstrapper/locales/bn.pak
  • bootstrapper/locales/ca.pak
  • bootstrapper/locales/cs.pak
  • bootstrapper/locales/da.pak
  • bootstrapper/locales/de.pak
  • bootstrapper/locales/el.pak
  • bootstrapper/locales/en-GB.pak
  • bootstrapper/locales/en-US.pak
  • bootstrapper/locales/es-419.pak
  • bootstrapper/locales/es.pak
  • bootstrapper/locales/et.pak
  • bootstrapper/locales/fa.pak
  • bootstrapper/locales/fi.pak
  • bootstrapper/locales/fil.pak
  • bootstrapper/locales/fr.pak
  • bootstrapper/locales/gu.pak
  • bootstrapper/locales/he.pak
  • bootstrapper/locales/hi.pak
  • bootstrapper/locales/hr.pak
  • bootstrapper/locales/hu.pak
  • bootstrapper/locales/id.pak
  • bootstrapper/locales/it.pak
  • bootstrapper/locales/ja.pak
  • bootstrapper/locales/kn.pak
  • bootstrapper/locales/ko.pak
  • bootstrapper/locales/lt.pak
  • bootstrapper/locales/lv.pak
  • bootstrapper/locales/ml.pak
  • bootstrapper/locales/mr.pak
  • bootstrapper/locales/ms.pak
  • bootstrapper/locales/nb.pak
  • bootstrapper/locales/nl.pak
  • bootstrapper/locales/pl.pak
  • bootstrapper/locales/pt-BR.pak
  • bootstrapper/locales/pt-PT.pak
  • bootstrapper/locales/ro.pak
  • bootstrapper/locales/ru.pak
  • bootstrapper/locales/sk.pak
  • bootstrapper/locales/sl.pak
  • bootstrapper/locales/sr.pak
  • bootstrapper/locales/sv.pak
  • bootstrapper/locales/sw.pak
  • bootstrapper/locales/ta.pak
  • bootstrapper/locales/te.pak
  • bootstrapper/locales/th.pak
  • bootstrapper/locales/tr.pak
  • bootstrapper/locales/uk.pak
  • bootstrapper/locales/vi.pak
  • bootstrapper/locales/zh-CN.pak
  • bootstrapper/locales/zh-TW.pak
  • bootstrapper/resources.pak
  • bootstrapper/resources/app-update.yml
  • bootstrapper/resources/app.asar
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/7-zip.dll
    .dll regsvr32 windows:4 windows x64 arch:x64

    Password: ryos

    fdde3c04d1f341a112f96fb9358f9a60


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/7-zip32.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    Password: ryos

    d6f0c4465a1120873b28751db89680d9


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/7z.dll
    .dll windows:4 windows x64 arch:x64

    5cb522624c360f998a25b7ea74c6c524


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/7z.sfx
    .exe windows:4 windows x86 arch:x86

    e6f39b3587ab9278fb99290006fa6b09


    Headers

    Imports

    Sections

  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/7zCon.sfx
    .exe windows:4 windows x86 arch:x86

    95a41a4987b4dcc235078d14972ee80d


    Headers

    Imports

    Sections

  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/History.txt
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/Lang/en.ttt
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/License.txt
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/descript.ion
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/readme.txt
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/index.js
    .js
  • bootstrapper/resources/app.asar.unpacked/node_modules/7zip/package.json
  • bootstrapper/resources/icons/icon.icns
  • bootstrapper/resources/icons/icon.ico
  • bootstrapper/resources/icons/size/512x512.png
    .png
  • bootstrapper/snapshot_blob.bin
  • bootstrapper/swiftshader/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    67db432914b7baa0738050364c019173


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/swiftshader/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    8b4ec8564c21d6087c06b61d3d5ffbbd


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/v8_context_snapshot.bin
  • bootstrapper/vcruntime211.dll
  • bootstrapper/vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    661e9d495f857b282ac48d29fc7f3fb6


    Headers

    Imports

    Exports

    Sections

  • bootstrapper/vk_swiftshader_icd.json
  • bootstrapper/vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    21c5b88eff7d67aaad312ae7a9ae2733


    Headers

    Imports

    Exports

    Sections