General

  • Target

    fixsolve.rar

  • Size

    17.9MB

  • MD5

    e7200a9d41ccbc6117adc585d80a339b

  • SHA1

    1a81172d0cbb33f3c304f4282a92e4bfe6e9329f

  • SHA256

    02885f0df1df616298a4768a79af718894f63b0fa953f682eea823999ab2cc8d

  • SHA512

    65a65550ad2711ed0d36f9c375aefe544ddba9c74a08439af1952a07ee02e34b98bccd10ab3c1c153d57baf3e88e499a3468ab8101dd71ae25b7af2eaaf02c22

  • SSDEEP

    393216:NzRxZS3atZgob/Fx1Yt4fCia/LTM968jbhc4iQkLZ3+mUedksWtOlXCKaH1a/0:1R4uZdYaq//cEik7UKWydaH100

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • fixsolve.rar
    .rar
  • MAPPING/HWID.dll
    .dll windows:6 windows x64 arch:x64

    27a311b1330c0aee48d1ddba70a324fa


    Headers

    Imports

    Exports

    Sections

  • MAPPING/HWID.exe
    .exe windows:6 windows x64 arch:x64

    965e162fe6366ee377aa9bc80bdd5c65


    Headers

    Imports

    Sections

  • Stub.pyc
  • MAPPING/README.txt
  • fix solve.exe
    .exe windows:6 windows x64 arch:x64

    965e162fe6366ee377aa9bc80bdd5c65


    Code Sign

    Headers

    Imports

    Sections

  • �aYO�.pyc