bccea83082fdd2f448e309697ce640e06935a3b7884b517f89727b52cd2c3fe5.zip
- SHA256 bccea83082fdd2f448e309697ce640e06935a3b7884b517f89727b52cd2c3fe5
Password
infected
Behavioral task
behavioral1
Sample
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target bccea83082fdd2f448e309697ce640e06935a3b7884b517f89727b52cd2c3fe5.zip
- Size 12.4MB
- Sample250327-e91zhazj16
- SHA256 bccea83082fdd2f448e309697ce640e06935a3b7884b517f89727b52cd2c3fe5
- MD5 0c6e0209c0623d1fd8b26b43df726501
- SHA1 68ed867a7b15d66035db589760755f77d345d351
- SHA512 191deb3290eb33731b84060eabdecfd1d852f02eb3fb057fd085d4245c23018ef635344aa40d22eb74f752ee4e679a4ce7318c5af117c787a4de38039e2d32c1
- SSDEEP 393216:V9zks/a4ASrq3hYtdgzAOb0FNdr/IG/TC8rsQpytDqK:3dScMWdggxrggNrwkK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cyrat executable 1 IoCs
resource yara_rule static1/unpack001/4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe family_cyrat - Cyrat family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe
File Explorer
-
bccea83082fdd2f448e309697ce640e06935a3b7884b517f89727b52cd2c3fe5.zip.zip 12.4MB
-
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe.exe 12.6MB
-
Microsoft_dll_fix.pyc10KB
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.exe
- IMPHASH 58053a2a3020fdc7713b576ad93bf7bd
- SHA256 4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6
- MD5 d427390e9fad598ec3288c9275c84628
- SHA1 7b88e1eaa07151fc0d7639574fc7f40fa5be8aa3
- SHA512 83ecc48386999ec6d05999d88e9a81eae5267ea807441727cd60d44f17ead8a0ca6e8a0ffa7d5e4e9fc800d858fb2ee824815abe4299e0ec85639384b75324a8
- SSDEEP 393216:prVo+wu2gmnX9c5hlEK/PNMtN3ZW43Q4Eei:prVo+wu2gmNEhxtMtN3r3Q4Ee
- MD5 SHA1 SHA512 SSDEEP
-
Cyrat executable
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
34388
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ws2_32
ntohl
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=241, version=40116,
count=169, id=243, version=40116,
count=13, id=242, version=40116,
count=7, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=7, id=203, version=65501,
count=114, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Microsoft_dll_fix.pyc
- SHA256 574dd7912864c2df235581977c1a3505ad7826c81fce8f2714f05fdff400415d
- MD5 024dc87afbbd6ae9ab9753f0ee2ea140
- SHA1 55713f07e583cbb9d6697d91a4b986ae465641e6
- SHA512 f180f6444df90f6f7d2cd42fd8c20c91faaca3b45a97b6db9f24febdd066991c01e340555dbe85f2c5d3a77c02a8d715571142861cf5ffc42b39293459c1c76d
- SSDEEP 192:x2vMWgNAVmVt2/HCoOjPsyvIi0WoM+O2X9/3scSWpHAr16PXvZRICfjEKrvev4vR:xAMBNAA32/kPjQXxp9/8tWs1a3Iel
- MD5 SHA1 SHA512 SSDEEP