sharphound | SharpHound_v2[.]11[.]0_windows_x86[.]zip

resource	yara_rule
static1/unpack001/SharpHound.exe	family_sharphound

resource
unpack001/SharpHound.exe

SharpHound_v2.11.0_windows_x86.zip

SHA256 fc63f52de10f5ede84bf385a39e93bfffdfd8aeea2de2786c14aff36d5b2ab5d
MD5 e5bc21b2519173f40048f53538d5179c
SHA1 144e528007d79c895f6e78254263cb26c5e42740
SHA512 52a1206a1cd2d1cc7e14763c6e2cc073bef39e04c7c317c295f9c3a024062f9483c465acbd25bd92968347debc453a73c44f52e808e777b6cec3d30587b1e2d2
SSDEEP 49152:fD5J0KJiM43XA4RU0n79U1EXm7Hot+pDf3PtsySQxiLgAb0:fD5J0CaXAKlqgmzis3FO/LgA4
TLSH
T17AB5331FA3953182219AAF8B936A774E9E5333F01B65CB1C353BD8547688BCD32CB464
MD5 SHA1 SHA512 SSDEEP TLSH

Password

asfserhgsdtjsxdtjzdytjsryjdfhgsdrthdsftjsgjsrytjredsthsdthes65rhs46h6j

SharpHound.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 50a2fc1f55fdc0f5799a49126f2e47ba9c00d2a92f47a608e4bea1c7070ae5d1
MD5 b2ca53763825cd0a1db7db46cf107ae1
SHA1 bc5243037150c5903c9afb2d7d64c9604cd40c41
SHA512 05a65ef54f2e3d1cbbcedf680aed89f5e9c94dd96deb65a5e896a1e911bb3e852effad1b21657c98dc99d730c3920e453ee0f48bffa23ceacceaeeeba543f9e2
SSDEEP 24576:TdLIGEDwgrRvNuXoVIa09WmPstYX3wrZviCZkong/iN9WC:ezRvNE9WmPDXArZaCZFK4W
TLSH
T15155125963F88A91F6AF1FB9A02442298BB77647F9ADFB8D5C8C74DC2483740D841327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects SharpHound hacktool
Unsigned PE

Checks for missing Authenticode signature.

Password

asfserhgsdtjsxdtjzdytjsryjdfhgsdrthdsftjsgjsrytjredsthsdthes65rhs46h6j

Minor OS version

0

Major OS version

4

Entry point

1321790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\SharpHound\SharpHound\obj\Release\net472\SharpHound.pdb

SharpHound.exe.config

SHA256 9e33249d43563df004ea6a52562bb406f446e4bc2366379bcd7cb785bdf4af77
MD5 85a933acdcbe62992f8c0032a3d3d2ce
SHA1 f21f24253fd04bc3a41a11ba1b95b67907db0949
SHA512 e2fdd98f572818fb09d3a6f839cb645fdeeb0a9340e06706b4cbc8016bd79de3d6b7d81982ccc059ba99a41ae1ddec1eab5e3b3ec8da851abc2a82fff21c5314
TLSH
T141F09E2184C8BFA64F724AA33B779464CBB483B32C8C044CB4AF6E974F2159D5207233
MD5 SHA1 SHA512 TLSH

SharpHound.pdb

SHA256 ae65bdac6f6df89e5d11ae9120027a758a908285654d319d91ffa781723ff26e
MD5 e913434ae3fd3b303aa82a6467d97b0d
SHA1 a955805d934a44e4b107a64977c01b710e47c1fb
SHA512 2e474c1483bb9d8e23f6bf10add302f98e49bd2aeb2ac5cd5da6e73e5819d6d524b6f3acfc888c581d27c9416fdf3f6a59ddadfca59d0d77300c18e7c42fa5ac
SSDEEP 3072:/aYQpp2Uektg6jaUX+Tluo0c0tTGcjj1unEuEANQY3:/uppDtg6ev90ciy+1uE/Y3
TLSH
T1D734A51BFF80C573D4AC86381A5F8F1C4638EA846F43D79F6B95712D2DA23462E46398
MD5 SHA1 SHA512 SSDEEP TLSH

SharpHound.ps1

SHA256 994361fb9dbc42d03174be9f6550ce8fe3d339bd5da4f16636fdab0b5c7ff26b
MD5 31ae1e16ebfa02a7beda05069a4a0135
SHA1 ef061ee809bf3294ee4ecb0248b790c843e5cb14
SHA512 3740e958e0a6b95d4982c4cc7c6d38f9b9105e14178e41196bc5df0709cb3ca65099c2a8b89198aaa486330dfead7417f82076eeaad14e1b9a95226e5b047bdc
SSDEEP 24576:OsLj9pL2OU1J3GX4XgMtktRVtW52JtaHwDG3Vbu6kpJfiSMLNlyoHy:RjFG57Typtaj37k/qbyoHy
TLSH
T14E752322AEEB0ABC07F40A35603BDB4D56100767E06E6D973BFDD4D7573BA8A42470A4
MD5 SHA1 SHA512 SSDEEP TLSH

SharpHound_v2.11.0_windows_x86.zip

SharpHound.exe

mscoree

dotnet

SharpHound.exe.config

SharpHound.pdb

SharpHound.ps1

Sharing

General

Malware Config

Signatures

File Explorer

SharpHound_v2.11.0_windows_x86.zip

SharpHound.exe

mscoree

dotnet

SharpHound.exe.config

SharpHound.pdb

SharpHound.ps1