General

  • Target
    قفقوس.zip
  • Size 4.7MB
  • Sample251230-wyncpsyrey
  • SHA256 0b76ab1b03a4ea153c5de738e5439a42711e870d208db7889a4efd41f57d0695
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://google.com

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://google.com

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    https://google.com

Signatures

  • Irata family
  • Irata payload 9 IoCs
  • Requests dangerous framework permissions 8 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned JAR 1 IoCs

    Checks for missing JAR codesign signature.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • قفقوس.zip
    .zip 4.7MB
  • 0/PanelManager.php
    16KB
  • 0/panel.php
    .ps1 110KB
  • 1`25.apk
    .apk 2.8MB
  • 777/Inf.json
    349B
  • 777/Inf.php
    237B
  • 777/data/block_users
    1B
  • 777/data/hide_users
    1B
  • 777/data/info_77b6478f6329de21.txt
    710B
  • 777/data/last_sms_target
    102B
  • 777/data/mianbor.json
    50B
  • 777/data/onlines.json
    33B
  • 777/data/username.json
    247B
  • 777/data/users
    137B
  • 777/db.json
    408B
  • 777/panel.php
    .ps1 109KB
  • B4a/AutoBackups/Backup Rat 2022-01-15 06.37.zip
    .zip 31KB
  • main - Copy/Files/lmain.bal
    1KB
  • main - Copy/Files/url.txt
    20B
  • main - Copy/FirebaseMessaging.bas
    .vbs 8KB
  • main - Copy/Objects/AndroidManifest.xml
    .xml 7KB
  • main - Copy/Objects/res/drawable/icon.png
    .png 25KB
  • main - Copy/Rat.b4a
    .vbs 7KB
  • main - Copy/Rat.b4a.meta
    581B
  • main - Copy/Starter.bas
    739B
  • B4a/AutoBackups/Backup Rat 2022-03-01 05.12.zip
    .zip 203KB
  • vip - Mine - Copy/ChangeDone.bas
    793B
  • vip - Mine - Copy/Files/lmain.bal
    1KB
  • vip - Mine - Copy/Files/url.txt
    29B
  • vip - Mine - Copy/FirebaseMessaging.bas
    .vbs 12KB
  • vip - Mine - Copy/Objects/AndroidManifest.xml
    .xml 10KB
  • vip - Mine - Copy/Objects/res/drawable/icon.png
    .png 19KB
  • vip - Mine - Copy/Objects/res/drawable/icon2.png
    .png 173KB
  • vip - Mine - Copy/PnServices.bas
    2KB
  • vip - Mine - Copy/Rat.b4a
    .vbs 9KB
  • vip - Mine - Copy/Rat.b4a.meta
    847B
  • vip - Mine - Copy/SmsforPn.bas
    .vbs 2KB
  • vip - Mine - Copy/Starter.bas
    904B
  • vip - Mine - Copy/fakemain.bas
    793B
  • B4a/AutoBackups/Backup Rat 2022-03-21 04.00.zip
    .zip 205KB
  • vip - Mine - Copy/ChangeDone.bas
    793B
  • vip - Mine - Copy/Files/lmain.bal
    1KB
  • vip - Mine - Copy/Files/url.txt
    25B
  • vip - Mine - Copy/FirebaseMessaging.bas
    .vbs 11KB
  • vip - Mine - Copy/Objects/AndroidManifest.xml
    .xml 10KB
  • vip - Mine - Copy/Objects/res/drawable/icon.png
    .png 25KB
  • vip - Mine - Copy/Objects/res/drawable/icon2.png
    .png 173KB
  • vip - Mine - Copy/PnServices.bas
    2KB
  • vip - Mine - Copy/Rat.b4a
    .vbs 9KB
  • vip - Mine - Copy/Rat.b4a.meta
    847B
  • vip - Mine - Copy/SmsforPn.bas
    .vbs 2KB
  • vip - Mine - Copy/Starter.bas
    904B
  • vip - Mine - Copy/fakemain.bas
    793B
  • B4a/AutoBackups/Backup Rat 2022-03-25 14.46.zip
    .zip 206KB
  • vip - Mine - Copy/ChangeDone.bas
    793B
  • vip - Mine - Copy/Files/lmain.bal
    1KB
  • vip - Mine - Copy/Files/url.txt
    25B
  • vip - Mine - Copy/FirebaseMessaging.bas
    .vbs 11KB
  • vip - Mine - Copy/Objects/AndroidManifest.xml
    .xml 10KB
  • vip - Mine - Copy/Objects/res/drawable/icon.png
    .png 25KB
  • vip - Mine - Copy/Objects/res/drawable/icon2.png
    .png 173KB
  • vip - Mine - Copy/PnServices.bas
    2KB
  • vip - Mine - Copy/Rat.b4a
    .vbs 9KB
  • vip - Mine - Copy/Rat.b4a.meta
    907B
  • vip - Mine - Copy/SmsforPn.bas
    .vbs 2KB
  • vip - Mine - Copy/Starter.bas
    904B
  • vip - Mine - Copy/fakemain.bas
    793B
  • B4a/AutoBackups/Backup Rat 2022-03-26 00.52.zip
    .zip 205KB
  • vip - Mine - Copy/ChangeDone.bas
    793B
  • vip - Mine - Copy/Files/lmain.bal
    1KB
  • vip - Mine - Copy/Files/url.txt
    25B
  • vip - Mine - Copy/FirebaseMessaging.bas
    .vbs 11KB
  • vip - Mine - Copy/Objects/AndroidManifest.xml
    .xml 10KB
  • vip - Mine - Copy/Objects/res/drawable/icon.png
    .png 25KB
  • vip - Mine - Copy/Objects/res/drawable/icon2.png
    .png 173KB
  • vip - Mine - Copy/PnServices.bas
    2KB
  • vip - Mine - Copy/Rat.b4a
    .vbs 9KB
  • vip - Mine - Copy/Rat.b4a.meta
    867B
  • vip - Mine - Copy/SmsforPn.bas
    .vbs 2KB
  • vip - Mine - Copy/Starter.bas
    904B
  • vip - Mine - Copy/fakemain.bas
    793B
  • B4a/AutoBackups/Backup Rat 2022-03-28 21.31.zip
    .zip 206KB
  • vip - Mine - Copy/ChangeDone.bas
    793B
  • vip - Mine - Copy/Files/lmain.bal
    1KB
  • vip - Mine - Copy/Files/url.txt
    26B
  • vip - Mine - Copy/FirebaseMessaging.bas
    .vbs 11KB
  • vip - Mine - Copy/Objects/AndroidManifest.xml
    .xml 10KB
  • vip - Mine - Copy/Objects/res/drawable/icon.png
    .png 25KB
  • vip - Mine - Copy/Objects/res/drawable/icon2.png
    .png 173KB
  • vip - Mine - Copy/PnServices.bas
    2KB
  • vip - Mine - Copy/Rat.b4a
    .vbs 9KB
  • vip - Mine - Copy/Rat.b4a.meta
    867B
  • vip - Mine - Copy/SmsforPn.bas
    .vbs 2KB
  • vip - Mine - Copy/Starter.bas
    904B
  • vip - Mine - Copy/fakemain.bas
    793B
  • B4a/AutoBackups/Backup Rat 2022-03-31 03.26.zip
    .zip 206KB
  • vip - Mine - Copy/ChangeDone.bas
    793B
  • vip - Mine - Copy/Files/lmain.bal
    1KB
  • vip - Mine - Copy/Files/url.txt
    26B
  • vip - Mine - Copy/FirebaseMessaging.bas
    .vbs 11KB
  • vip - Mine - Copy/Objects/AndroidManifest.xml
    .xml 10KB
  • vip - Mine - Copy/Objects/res/drawable/icon.png
    .png 25KB
  • vip - Mine - Copy/Objects/res/drawable/icon2.png
    .png 173KB
  • vip - Mine - Copy/PnServices.bas
    2KB
  • vip - Mine - Copy/Rat.b4a
    .vbs 9KB
  • vip - Mine - Copy/Rat.b4a.meta
    866B
  • vip - Mine - Copy/SmsforPn.bas
    .vbs 2KB
  • vip - Mine - Copy/Starter.bas
    904B
  • vip - Mine - Copy/fakemain.bas
    793B
  • B4a/ChangeDone.bas
    793B
  • B4a/Files/lmain.bal
    1KB
  • B4a/FirebaseMessaging.bas
    .vbs 11KB
  • B4a/Objects/AndroidManifest.xml
    .xml 10KB
  • B4a/Objects/gen/androidx/coordinatorlayout/R.java
    82KB
  • B4a/Objects/gen/androidx/core/R.java
    82KB
  • B4a/Objects/gen/androidx/drawerlayout/R.java
    82KB
  • B4a/Objects/gen/androidx/fragment/R.java
    82KB
  • B4a/Objects/gen/androidx/media/R.java
    82KB
  • B4a/Objects/gen/androidx/swiperefreshlayout/R.java
    82KB
  • B4a/Objects/gen/com/google/android/gms/base/R.java
    82KB
  • B4a/Objects/gen/com/google/android/gms/common/R.java
    82KB
  • B4a/Objects/gen/com/google/firebase/messaging/R.java
    82KB
  • B4a/Objects/gen/ir/NoBody/Manifest.java
    356B
  • B4a/Objects/gen/ir/NoBody/R.java
    81KB
  • B4a/Objects/gen/ir/PluTus/pluto/Manifest.java
    368B
  • B4a/Objects/gen/ir/PluTus/pluto/R.java
    82KB
  • B4a/Objects/gen/ir/SuNLoveLs/sunlovel/Manifest.java
    380B
  • B4a/Objects/gen/ir/SuNLoveLs/sunlovel/R.java
    82KB
  • B4a/Objects/gen/ir/stop/bye/Manifest.java
    360B
  • B4a/Objects/gen/ir/stop/bye/R.java
    81KB
  • B4a/Objects/gen/ir/stop/com/Manifest.java
    360B
  • B4a/Objects/gen/ir/stop/com/R.java
    81KB
  • B4a/Objects/gen/ir/stop/dev/Manifest.java
    360B
  • B4a/Objects/gen/ir/stop/dev/R.java
    81KB
  • B4a/Objects/gen/ir/stop/deve/Manifest.java
    362B
  • B4a/Objects/gen/ir/stop/deve/R.java
    82KB
  • B4a/Objects/gen/ir/stop/devel/Manifest.java
    364B
  • B4a/Objects/gen/ir/stop/devel/R.java
    82KB
  • B4a/Objects/gen/ir/stop/devs/Manifest.java
    362B
  • B4a/Objects/gen/ir/stop/devs/R.java
    82KB
  • B4a/Objects/gen/ir/stop/devsalm/Manifest.java
    368B
  • B4a/Objects/gen/ir/stop/devsalm/R.java
    82KB
  • B4a/Objects/gen/ir/stop/devsam/Manifest.java
    366B
  • B4a/Objects/gen/ir/stop/devsam/R.java
    82KB
  • B4a/Objects/gen/ir/stop/devsi/Manifest.java
    364B
  • B4a/Objects/gen/ir/stop/devsi/R.java
    82KB
  • B4a/Objects/gen/ir/stop/hello/Manifest.java
    364B
  • B4a/Objects/gen/ir/stop/hello/R.java
    82KB
  • B4a/Objects/gen/ir/stop/hi/Manifest.java
    358B
  • B4a/Objects/gen/ir/stop/hi/R.java
    81KB
  • B4a/Objects/gen/ir/stop/ok/Manifest.java
    358B
  • B4a/Objects/gen/ir/stop/ok/R.java
    81KB
  • B4a/Objects/gen/ir/stop/xyz/Manifest.java
    360B
  • B4a/Objects/gen/ir/stop/xyz/R.java
    81KB
  • B4a/PnServices.bas
    2KB
  • B4a/Rat.b4a
    .vbs 9KB
  • B4a/Rat.b4a.meta
    866B
  • B4a/SmsforPn.bas
    .vbs 2KB
  • B4a/Starter.bas
    904B
  • B4a/fakemain.bas
    793B
  • Bot Panel/auto.php
    6KB
  • Bot Panel/bot.php
    .ps1 30KB
  • Bot Panel/info.php
    266B
  • Bot Panel/jdf.php
    14KB
  • Bot Panel/rat.php
    20KB
  • Bot Panel/stop.php
    3KB
  • Bot Panel/upload.php
    2KB
  • Library/Clipboard.jar
    .jar 1KB
  • Library/Clipboard.xml
    .xml 1KB
  • Library/PNBroadcastReceiver.jar
    .zip 2KB
  • PNBroadcastReceiver/PNBrodcastReceiver$1.class
    2KB
  • PNBroadcastReceiver/PNBrodcastReceiver.class
    2KB
  • Library/PNBroadcastReceiver.xml
    .xml 3KB
  • Library/PNSMS.jar
    .zip 5KB
  • Library/PNSMS.xml
    .xml 1KB
  • Library/PersianDeviceInfo.jar
    .zip 13KB
  • Library/PersianDeviceInfo.xml
    .xml 14KB
  • M/Inf.json
    355B
  • M/Inf.php
    237B
  • M/data/block_users
    1B
  • M/data/hide_users
    1B
  • M/data/last_sms_target
    196B
  • M/data/msg
    76B
  • M/data/onlines.json
    33B
  • M/data/phones
    11B
  • M/data/username.json
    236B
  • M/data/users
    86B
  • M/db.json
    408B
  • M/panel.php
    .ps1 110KB
  • Madremrem/Madsal.php
    516B
  • Madremrem/autohide
    3B
  • Madremrem/bot.php
    .vbs 26KB
  • Madremrem/contact.php
    1KB
  • Madremrem/files/actionbuy.txt
    3B
  • Madremrem/files/actionfirst.txt
    3B
  • Madremrem/files/actionhide.txt
    3B
  • Madremrem/files/autohide.txt
    3B
  • Madremrem/files/bomber.txt
    11B
  • Madremrem/files/contact.txt
    548B
  • Madremrem/files/ftext.txt
    3B
  • Madremrem/files/num.txt
    480B
  • Madremrem/files/sms.txt
    128KB
  • Madremrem/files/smsbomber.txt
    9B
  • Madremrem/id.txt
    18B
  • Madremrem/jdf.php
    14KB
  • Madremrem/pe.php
    23KB
  • Madremrem/requests.php
    8KB
  • Madremrem/sms.php
    1KB
  • Me/Delete
    2KB
  • Me/Inf.json
    328B
  • Me/Inf.php
    237B
  • Me/R.txt
    1B
  • Me/contact.txt
    8KB
  • Me/data/block_users
    1B
  • Me/data/hide_users
    1B
  • Me/data/info_2347e08ffb8ccfc7.txt
    187B
  • Me/data/info_34522cc6e4ac43.txt
    169B
  • Me/data/info_3960ed1172c7a2d0.txt
    169B
  • Me/data/info_4479546494e76dc6.txt
    183B
  • Me/data/info_539762be3f96d051.txt
    10B
  • Me/data/info_adfcfb4598cc8635.txt
    185B
  • Me/data/info_cb75bc49320d7d80.txt
    169B
  • Me/data/last_sms_target
    197B
  • Me/data/mianbor.json
    287B
  • Me/data/msg
    10B
  • Me/data/onlines.json
    623B
  • Me/data/phones
    11B
  • Me/data/username.json
    1KB
  • Me/data/users
    187B
  • Me/db.json
    442B
  • Me/ip.json
    104B
  • Me/number.txt
    2KB
  • Me/panel.php
    .ps1 110KB
  • V/Inf.json
    349B
  • V/Inf.php
    237B
  • V/data/block_users
    1B
  • V/data/hide_users
    1B
  • V/data/onlines.json
    146B
  • V/data/username.json
    79B
  • V/data/users
    35B
  • V/db.json
    405B
  • V/panel.php
    .ps1 110KB
  • arba/Inf.json
    340B
  • arba/Inf.php
    237B
  • arba/data/block_users
    1B
  • arba/data/hide_users
    1B
  • arba/data/onlines.json
    33B
  • arba/data/username.json
    79B
  • arba/data/users
    34B
  • arba/db.json
    420B
  • arba/ip.json
    19B
  • arba/panel.php
    .ps1 110KB
  • arbab/Inf.json
    354B
  • arbab/Inf.php
    237B
  • arbab/data/block_users
    1B
  • arbab/data/hide_users
    1B
  • arbab/data/onlines.json
    33B
  • arbab/data/username.json
    135B
  • arbab/data/users
    68B
  • arbab/db.json
    417B
  • arbab/panel.php
    .ps1 110KB
  • b/Inf.json
    349B
  • b/Inf.php
    237B
  • b/data/block_users
    1B
  • b/data/hide_users
    1B
  • b/data/onlines.json
    437B
  • b/data/username.json
    387B
  • b/data/users
    222B
  • b/db.json
    434B
  • b/panel.php
    .ps1 110KB
  • bot/Inf.json
    353B
  • bot/Inf.php
    237B
  • bot/data/block_users
    1B
  • bot/data/hide_users
    1B
  • bot/data/onlines.json
    33B
  • bot/data/username.json
    51B
  • bot/data/users
    295B
  • bot/db.json
    710B
  • bot/panel.php
    .ps1 110KB
  • cro/Inf.json
    348B
  • cro/Inf.php
    237B
  • cro/data/block_users
    1B
  • cro/data/hide_users
    1B
  • cro/data/onlines.json
    33B
  • cro/data/username.json
    51B
  • cro/data/users
    18B
  • cro/db.json
    434B
  • cro/ip.json
    19B
  • cro/panel.php
    .ps1 110KB
  • fathe/Inf.json
    355B
  • fathe/Inf.php
    237B
  • fathe/data/block_users
    1B
  • fathe/data/hide_users
    1B
  • fathe/data/onlines.json
    33B
  • fathe/data/username.json
    19B
  • fathe/data/users
    1B
  • fathe/db.json
    386B
  • fathe/panel.php
    .ps1 110KB
  • father/Inf.json
    358B
  • father/Inf.php
    237B
  • father/data/block_users
    1B
  • father/data/hide_users
    1B
  • father/data/info_819fcae59a392175.txt
    6B
  • father/data/last_sms_target
    24B
  • father/data/online_user
    1B
  • father/data/online_user_w
    1B
  • father/data/onlines.json
    33B
  • father/data/username.json
    303B
  • father/data/users
    153B
  • father/db.json
    432B
  • father/panel.php
    .ps1 110KB
  • fiiko/Inf.json
    352B
  • fiiko/Inf.php
    237B
  • fiiko/data/block_users
    1B
  • fiiko/data/hide_users
    1B
  • fiiko/data/onlines.json
    33B
  • fiiko/data/username.json
    19B
  • fiiko/data/users
    1B
  • fiiko/db.json
    389B
  • fiiko/panel.php
    .ps1 110KB
  • gregold lor/Inf.json
    356B
  • gregold lor/Inf.php
    237B
  • gregold lor/data/block_users
    1B
  • gregold lor/data/hide_users
    1KB
  • gregold lor/data/last_sms_target
    186B
  • gregold lor/data/msg
    8B
  • gregold lor/data/onlines.json
    33B
  • gregold lor/data/phones
    11B
  • gregold lor/data/username.json
    3KB
  • gregold lor/data/users
    1KB
  • gregold lor/db.json
    431B
  • gregold lor/ip.json
    19B
  • gregold lor/panel.php
    .ps1 110KB
  • h/Inf.json
    344B
  • h/Inf.php
    237B
  • h/data/block_users
    1B
  • h/data/hide_users
    1B
  • h/data/last_sms_target
    20B
  • h/data/onlines.json
    33B
  • h/data/username.json
    107B
  • h/data/users
    52B
  • h/db.json
    403B
  • h/panel.php
    .ps1 110KB
  • julian/Inf.json
    355B
  • julian/Inf.php
    237B
  • julian/data/block_users
    1B
  • julian/data/hide_users
    86B
  • julian/data/info_103e50e5034f5301.txt
    126B
  • julian/data/info_2435c2cbb750ffc0.txt
    119B
  • julian/data/info_293d7ffb391342ac.txt
    122B
  • julian/data/info_3960ed1172c7a2d0.txt
    17B
  • julian/data/info_42eb64bf55c4e95e.txt
    123B
  • julian/data/info_5fe5162d4b7a6ef1.txt
    126B
  • julian/data/info_c258526e002a26c6.txt
    122B
  • julian/data/info_c6cf0c5c0406983b.txt
    129B
  • julian/data/info_c998ab4a4e190822.txt
    122B
  • julian/data/info_d5b047abf21d7380.txt
    123B
  • julian/data/last_sms_target
    4B
  • julian/data/msg
    1B
  • julian/data/onlines.json
    33B
  • julian/data/phones
    11B
  • julian/data/username.json
    2KB
  • julian/db.json
    425B
  • julian/panel.php
    .ps1 110KB
  • mahdi/Inf.json
    350B
  • mahdi/Inf.php
    237B
  • mahdi/data/block_users
    1B
  • mahdi/data/hide_users
    154B
  • mahdi/data/last_sms_target
    35B
  • mahdi/data/mianbor.json
    2B
  • mahdi/data/onlines.json
    33B
  • mahdi/data/username.json
    270B
  • mahdi/data/users
    103B
  • mahdi/db.json
    434B
  • mahdi/panel.php
    .ps1 110KB
  • nul/Inf.json
    355B
  • nul/Inf.php
    237B
  • nul/data/block_users
    1B
  • nul/data/hide_users
    1B
  • nul/data/onlines.json
    33B
  • nul/data/username.json
    51B
  • nul/data/users
    18B
  • nul/db.json
    418B
  • nul/panel.php
    .ps1 110KB
  • null/Inf.json
    356B
  • null/Inf.php
    237B
  • null/data/block_users
    1B
  • null/data/hide_users
    1B
  • null/data/last_sms_target
    136B
  • null/data/msg
    15B
  • null/data/onlines.json
    33B
  • null/data/phones
    72B
  • null/data/username.json
    247B
  • null/data/users
    51B
  • null/db.json
    424B
  • null/panel.php
    .ps1 110KB
  • ooo/Inf.json
    347B
  • ooo/Inf.php
    237B
  • ooo/data/block_users
    1B
  • ooo/data/hide_users
    1B
  • ooo/data/onlines.json
    33B
  • ooo/data/username.json
    19B
  • ooo/db.json
    386B
  • ooo/panel.php
    .ps1 110KB
  • port/Inf.json
    340B
  • port/Inf.php
    237B
  • port/data/block_users
    1B
  • port/data/hide_users
    1B
  • port/data/online_user
    1B
  • port/data/online_user_w
    1B
  • port/data/onlines.json
    33B
  • port/data/username.json
    19B
  • port/db.json
    355B
  • port/panel.php
    .ps1 113KB
  • toxic/Inf.json
    353B
  • toxic/Inf.php
    237B
  • toxic/data/block_users
    1B
  • toxic/data/hide_users
    1B
  • toxic/data/last_sms_target
    259B
  • toxic/data/msg
    2B
  • toxic/data/onlines.json
    33B
  • toxic/data/phones
    11B
  • toxic/data/username.json
    2KB
  • toxic/db.json
    434B
  • toxic/panel.php
    .ps1 110KB
  • userlist/M2102J20SG-44.json
    55B

قفقوس.zip

  • SHA256 0b76ab1b03a4ea153c5de738e5439a42711e870d208db7889a4efd41f57d0695
  • MD5 SHA1 SHA512 SSDEEP