duplexspyrat | 250609-aj5gsahsmg_pw_infected[.]zip

Resubmissions

15/11/2025, 04:13

251115-etlvmswpbl10

06/08/2025, 06:38

31/07/2025, 14:44

09/06/2025, 11:40

09/06/2025, 00:25

Sharing

Copy URL Twitter E-mail

General

Target
250609-aj5gsahsmg_pw_infected.zip
Size 280KB
Sample251115-etlvmswpbl
SHA256 a96bbf46955ec16f9a335d8a48385f61a1512e82d05b720f0189e26622117ce5
MD5 ea3bfea2367768948a6d29e8369ce5f3
SHA1 3c76a0e1153ae12851ccbfb1dc7ff11a111d6555
SHA512 affff51403df970ad3a19cd5de6d20e7aff498a61160e972780ad01d35f81c3c9ac52a4ca8829d24e70d9d9c052ec5585493146435ae485ce20adb0584331139
SSDEEP 6144:L+z+bUx2nMcnLdVpeci/W7S/cN6XJ1xXNxfujjyEHia2K:L+zFyvnL7UK7oRMjBqK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

duplexspyrat

Malware Config

Signatures

Detects DuplexSpyRAT 1 IoCs

resource	yara_rule
static1/unpack001/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a	family_duplexspyrat

Duplexspyrat family
duplexspyrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a

File Explorer

250609-aj5gsahsmg_pw_infected.zip

.zip 280KB
ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a

.exe 689KB

250609-aj5gsahsmg_pw_infected.zip

SHA256 a96bbf46955ec16f9a335d8a48385f61a1512e82d05b720f0189e26622117ce5
MD5 ea3bfea2367768948a6d29e8369ce5f3
SHA1 3c76a0e1153ae12851ccbfb1dc7ff11a111d6555
SHA512 affff51403df970ad3a19cd5de6d20e7aff498a61160e972780ad01d35f81c3c9ac52a4ca8829d24e70d9d9c052ec5585493146435ae485ce20adb0584331139
SSDEEP 6144:L+z+bUx2nMcnLdVpeci/W7S/cN6XJ1xXNxfujjyEHia2K:L+zFyvnL7UK7oRMjBqK
MD5 SHA1 SHA512 SSDEEP

Password

infected

ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a
MD5 1ca786b1741e68cec2ce1c13bad8a45f
SHA1 ec590c27e631ad238b1e736efc77d5c41fbeb15a
SHA512 107d0984ef5ea10d2e6d270d788594394f0121d9d62f6713f8e452bfdfa88edd5ed865baa7ac0a20df56146eaafb693afb2f117286ebd19cc9af0cf7cf04eb6c
SSDEEP 6144:GeJ286NdbQ3c/jOTKEPojJ0hAWlUDt9O3PItF0GvNpBCTwdFvqg9hgWImSepTPbV:uljOTKEzht8t9O/K64NpkTL4jIm5Pd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects DuplexSpyRAT
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

712510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\siral\Downloads\DuplexSpyCS-main\DuplexSpyCS-main\DuplexSpyCS\bin\Debug\net6.0-windows\client.pdb

250609-aj5gsahsmg_pw_infected.zip

ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a

mscoree

dotnet