disco.rar
- SHA256 004d425c8dd62c1220cbe269e265a73c359b05ba7dd525f0bc344759cd872c99
Password
dd
Overview
overview
9Static
static
9disco.rar
windows10-2004-x64
1disco.rar
windows11-21h2-x64
1disco/readme.txt
windows10-2004-x64
1disco/readme.txt
windows11-21h2-x64
3disco/readme2.md
windows10-2004-x64
3disco/readme2.md
windows11-21h2-x64
3disco/smsniff.cfg
windows10-2004-x64
3disco/smsniff.cfg
windows11-21h2-x64
3disco/smsniff.chm
windows10-2004-x64
1disco/smsniff.chm
windows11-21h2-x64
1disco/smsniff.exe
windows10-2004-x64
9disco/smsniff.exe
windows11-21h2-x64
9out.exe
windows10-2004-x64
out.exe
windows11-21h2-x64
3disco/smsniff_lng.ini
windows10-2004-x64
1disco/smsniff_lng.ini
windows11-21h2-x64
3Behavioral task
behavioral1
Sample
disco.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
disco.rar
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral3
Sample
disco/readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral4
Sample
disco/readme.txt
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral5
Sample
disco/readme2.md
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
disco/readme2.md
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
disco/smsniff.cfg
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral8
Sample
disco/smsniff.cfg
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral9
Sample
disco/smsniff.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral10
Sample
disco/smsniff.chm
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
disco/smsniff.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
disco/smsniff.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
out.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
out.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral15
Sample
disco/smsniff_lng.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral16
Sample
disco/smsniff_lng.ini
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target disco.rar
- Size 94KB
- Sample260602-h43spahs2j
- SHA256 004d425c8dd62c1220cbe269e265a73c359b05ba7dd525f0bc344759cd872c99
- MD5 68d1d4400565b83b6b3ab1ef1d612cc6
- SHA1 c2bdd429967ed98da6a6f5277107169318aaa3cf
- SHA512 ec83dae20941571b73960b715927126085264166d45803afdbea061a7fc91b3f8798796a6694160fc40bcf658807c724235f0feed9513be08849885c3b2b5c8f
- SSDEEP 1536:PrWHk1SWfzV67PWkldjUenIqJpVEjVKBEa9rxxQ2H8qgoMYl4G1yo23aCU7hxC/o:PKtWfzuWkgUIJVKztQ+8qMGwo23av7qQ
- TLSH T1649312D1FE969D5BCA5D8423B05E0B3B1CDB10DE4CF34078E463DA6662806DE86B88F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack002/out.upx Nirsoft -
resource yara_rule static1/unpack001/disco/smsniff.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/disco/smsniff.exe
File Explorer
-
disco.rar.rar 94KB
-
disco/readme.txt22KB
-
disco/readme2.md41B
-
disco/smsniff.cfg1KB
-
disco/smsniff.chm.chm 19KB
-
disco/smsniff.exe.exe 79KB
-
out.upx.exe 143KB
-
disco/smsniff_lng.ini5KB
disco/readme.txt
- SHA256 c6b765a0fb48c90e55b634dce30618866dcc031d8a4e6df48b2f18d023d734d5
- MD5 8937685047369b432d85f16097e23648
- SHA1 4c3e1284461f60cd9d6dc9a3853e357aeeb5cfdd
- SHA512 202225fbad34d85a2c0c4019c612b4ac5f3dff268b06abc8986fd4367628363962d57568efcfad64c1b6fe059a7ac695621f9245282a196a038254785cf10660
- SSDEEP 384:lQJ9Chsbk1enA+8OdM+OBAiW/kl+P1utIoL0oG0ROTT01eoOOrXwNIP:wdk1UNbDOBA3a0F0q01br
- TLSH T1E2A2A60EA702133256731186228EB7D2F77D425A635706EA386CC25C372B3A9D3F75E9
- MD5 SHA1 SHA512 SSDEEP TLSH
disco/readme2.md
- SHA256 3b375f9c4c144f489ea9585970dc399f2ae942ccc70d7e0675fbf2f28b669a68
- MD5 17c3487ac61845bd0be55bec7e469468
- SHA1 3981aaf6cfb9383dd201bc656c22622ffb378138
- SHA512 4eb7e31ea021fe65531986e6ef5d52c4507ae4be10e644b15d614969b0ceaf3982bf486d3b53afe1d7948c8c0399f78ccfd0bab8c31993cd680cae84adc9feaa
- MD5 SHA1 SHA512
disco/smsniff.cfg
- SHA256 3b004f9cf33e97b638db4fbaee73bdaba325f497b6838047d6fef6b0e83e6734
- MD5 10e6b08d49f6072ace17f7e52de7e57d
- SHA1 36d47be49547b28125c739b60a1504c95379e7e9
- SHA512 81b05047de5c11889d84f79c28c758e145f030c55044abc91459a8fe0184189e258617a8428aca4250e852c117b6faef5aa850227f1a43bfec2355d69bf4dbd5
- TLSH T1BC2186510A0B1D5DE052BA8C306E3A6249F86E333CD92DE1AB4D271CDEAB9E94B49210
- MD5 SHA1 SHA512 TLSH
disco/smsniff.chm
- SHA256 ce71d65f73c5185f85f8cfe42984cc0b3f6cb1c711da846b1de8e1587a684cb1
- MD5 662f90bec361d17f61e851a5364f714c
- SHA1 82d9420e8500e36b06973ead366bb503c8126036
- SHA512 ceadbebe99ceb597d8abd99b8d1b9d5a636679db534f2a58c38a9feb15caf3525c5a95edee42ad72db8ec4d4194218e78196e74b563defb0aed47d6238965d09
- SSDEEP 192:rXNv5gaLswP3vNWdtlAmMB/fvGxlBJXS6p0KZcrn/42ZR6iWkF288C:rXNv5ganPEdnaslBJXSIKnX6AF28v
- TLSH T1DF92BF559BD6060BC8299337BFC66C5B3E203E259EEAACC401A613E211F0E0B57B1CA4
- MD5 SHA1 SHA512 SSDEEP TLSH
disco/smsniff.exe
- SHA256 326f3c55a978216a140d20516fc2008353ea92380fde373f9c381d902d4c9fd6
- MD5 a1e45561b188022e69c33479bb8370a7
- SHA1 febf8aa857bbc9bf279228b22d6dc89c570b18e2
- SHA512 6669b3cab1cd059a853e42a0c68f03f7ae68563168d6961ca524efdb090a35791956b117949b4a46edc3c7d4437c473023aec29a1a9fcf621e5c13ecce9c8397
- SSDEEP 1536:D8TEXwcKLS2SiDOiXzCqN/lxpF5kQ/YEncXUx8yktm9ZnahOm:ITvcKLS2c0Ndvnb/YAWSY2ns
- TLSH T18A83F10BDB18DE1AD61A0AB0119B8D361D55F09673258FDB6B59ED9FFCD03823E10278
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
dd
PE Signature issue
Digest
25:f4:ed:ca:4c:c4:de:62:01:bf:bd:c4:b2:c7:b5:6d:93:b0:6e:91
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Mar 3, 2013
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 10, 2010 - May 10, 2015
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 17, 2012 - Sep 17, 2014
Minor OS version
0
Major OS version
4
Entry point
226352
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
65KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=2, id=25, version=9210,
count=309, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=51, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 3c1a14db2e3b14d6407595f31864422999e733163a82bb8a61d5bc2cb5727504
- MD5 31a5597342bdc3cd61b47d620d05f9ee
- SHA1 180a2f18592cbff80f07b21fc31e006de966003c
- SHA512 4a8a00ec3c5720b6d857a371319e6d9146ee99b80db10775f6a49a2c90bd0bfcf0d520676041514f9e884cf6a784cd1bf686184a4ac866f1cbd4d41a58076534
- SSDEEP 3072:/WhNw+DJXegRF5ILvXNdfye+Tor8HRDDrHlnxNX+Md9:/WhpzjKLD0oy/
- TLSH T16AE36B03B2D48431E4FB1A305DF29B729EB6BD705938DA4B47986E0E2C71690DE2735B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=2, id=25, version=9210,
count=309, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=51, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
disco/smsniff_lng.ini
- SHA256 610551b1c63bc7277bb47b15418debc4d6326e3194d48ece41f67fc44799da24
- MD5 e4075d62ad8dc0e421e439a7cdf82bac
- SHA1 5d5632ca4f53c68e6a1263e79c6132d5fb4c7e27
- SHA512 1ca3c9c11459f7b328b032abda199d2d1e0fa70d72104a1c44f7430cb06d79850479a34f885dbf4782c4a25a6e7aa41477d1f70897b0d4223b7a3f2651e6b26c
- SSDEEP 96:OzRZVhmVqM/eCmd1rc7awrmTmUFJABEMXqk4MfOHghe6MaeFKmONE:SZVhm/awrm7JAyexWHgh/MRKmf
- TLSH T1C9C1D6531C4DA45AA15C9B7C34124E20807DAE48FD0BE2BC62B3EB8D2F4526EB85711F
- MD5 SHA1 SHA512 SSDEEP TLSH