Release.zip
- SHA256 505c14a562732c086bd2c132d863a57b295776f244d97414f793aca4d5926611
Overview
overview
10Static
static
10Release.zip
windows10-2004-x64
1Release.zip
windows11-ltsc_2024-x64
1Release/Ex...ns.txt
windows10-2004-x64
1Release/Ex...ns.txt
windows11-ltsc_2024-x64
1Release/Fl...IP.png
windows10-2004-x64
1Release/Fl...IP.png
windows11-ltsc_2024-x64
1Release/Fl...AL.png
windows10-2004-x64
1Release/Fl...AL.png
windows11-ltsc_2024-x64
1Release/Fl...KN.png
windows10-2004-x64
1Release/Fl...KN.png
windows11-ltsc_2024-x64
1Release/Fl...AN.png
windows10-2004-x64
1Release/Fl...AN.png
windows11-ltsc_2024-x64
1Release/Fl...on.png
windows10-2004-x64
1Release/Fl...on.png
windows11-ltsc_2024-x64
1Release/Fl...ey.png
windows10-2004-x64
1Release/Fl...ey.png
windows11-ltsc_2024-x64
1Release/Fl...ue.png
windows10-2004-x64
1Release/Fl...ue.png
windows11-ltsc_2024-x64
1Release/Fl...ry.png
windows10-2004-x64
1Release/Fl...ry.png
windows11-ltsc_2024-x64
1Release/Fl...OM.png
windows10-2004-x64
1Release/Fl...OM.png
windows11-ltsc_2024-x64
1Release/Fl...IS.png
windows10-2004-x64
1Release/Fl...IS.png
windows11-ltsc_2024-x64
1Release/Fl...ia.png
windows10-2004-x64
1Release/Fl...ia.png
windows11-ltsc_2024-x64
1Release/Fl...th.png
windows10-2004-x64
1Release/Fl...th.png
windows11-ltsc_2024-x64
1Release/Fl...nd.png
windows10-2004-x64
1Release/Fl...nd.png
windows11-ltsc_2024-x64
1Release/Fl...on.png
windows10-2004-x64
1Release/Fl...on.png
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
Release.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Release.zip
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral3
Sample
Release/Extensions.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Release/Extensions.txt
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral5
Sample
Release/Flags/FlagsBase/LOCALIP.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Release/Flags/FlagsBase/LOCALIP.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral7
Sample
Release/Flags/FlagsBase/NOCONNECTIONORLOCAL.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Release/Flags/FlagsBase/NOCONNECTIONORLOCAL.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral9
Sample
Release/Flags/FlagsBase/UKN.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Release/Flags/FlagsBase/UKN.png
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral11
Sample
Release/Flags/FlagsBase/_ASEAN.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Release/Flags/FlagsBase/_ASEAN.png
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral13
Sample
Release/Flags/FlagsBase/_African Union.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Release/Flags/FlagsBase/_African Union.png
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral15
Sample
Release/Flags/FlagsBase/_Alderney.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Release/Flags/FlagsBase/_Alderney.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral17
Sample
Release/Flags/FlagsBase/_Arab League.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Release/Flags/FlagsBase/_Arab League.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral19
Sample
Release/Flags/FlagsBase/_Basque Country.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Release/Flags/FlagsBase/_Basque Country.png
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral21
Sample
Release/Flags/FlagsBase/_CARICOM.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Release/Flags/FlagsBase/_CARICOM.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral23
Sample
Release/Flags/FlagsBase/_CIS.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Release/Flags/FlagsBase/_CIS.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral25
Sample
Release/Flags/FlagsBase/_Catalonia.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Release/Flags/FlagsBase/_Catalonia.png
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral27
Sample
Release/Flags/FlagsBase/_Commonwealth.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Release/Flags/FlagsBase/_Commonwealth.png
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral29
Sample
Release/Flags/FlagsBase/_England.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
Release/Flags/FlagsBase/_England.png
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral31
Sample
Release/Flags/FlagsBase/_European Union.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
Release/Flags/FlagsBase/_European Union.png
Resource
win11ltsc2024-20260617-en
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
| resource | yara_rule |
|---|---|
| static1/unpack001/Release/SamplePayloads(x32)/PayloadCSharpShellCode.bin | family_donutloader |
| static1/unpack001/Release/SamplePayloads(x32)/PayloadDllCppShellCode.bin | family_donutloader |
File was altered after it was signed.
| resource |
|---|
| unpack001/Release/System.dll |
Detects ConfuserEx .NET packer.
| resource | yara_rule |
|---|---|
| static1/unpack001/Release/Guna.UI2.dll | ConfuserEx |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Release/Eagle Monitor RAT Reborn (x32).exe |
| unpack001/Release/Eagle Monitor RAT Reborn (x64).exe |
| unpack001/Release/FastColoredTextBox.dll |
| unpack001/Release/Guna.UI2.dll |
| unpack001/Release/Leaf.xNet.dll |
| unpack001/Release/NAudio.dll |
| unpack001/Release/PacketLib.dll |
| unpack001/Release/Plugins/Admin.dll |
| unpack001/Release/Plugins/AudioRecording.dll |
| unpack001/Release/Plugins/Chat.dll |
| unpack001/Release/Plugins/FileManager.dll |
| unpack001/Release/Plugins/Hardware.dll |
| unpack001/Release/Plugins/Information.dll |
| unpack001/Release/Plugins/Keylogger.dll |
| unpack001/Release/Plugins/MemoryExecution.dll |
| unpack001/Release/Plugins/Miscellaneous.dll |
| unpack001/Release/Plugins/PowerManager.dll |
| unpack001/Release/Plugins/ProcessManager.dll |
| unpack001/Release/Plugins/Ransomware.dll |
| unpack001/Release/Plugins/RemoteCamera.dll |
| unpack001/Release/Plugins/RemoteDesktop.dll |
| unpack001/Release/Plugins/RemoteShell.dll |
| unpack001/Release/Plugins/ScreenLocker.dll |
| unpack001/Release/Plugins/Stealer.dll |
| unpack001/Release/SamplePayloads(x32)/PayloadCSharp.exe |
| unpack001/Release/SamplePayloads(x32)/PayloadDllCpp.dll |
| unpack001/Release/SamplePayloads(x32)/PayloadExeCpp.exe |
| unpack001/Release/SamplePayloads(x64)/PayloadCpp.dll |
| unpack001/Release/Stubs/Offline.dll |
| unpack001/Release/Stubs/PacketLib.dll |
| unpack001/Release/Vestris.ResourceLib.dll |
| unpack001/Release/dnlib.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Mar 17, 2021
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detects DonutLoader
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=10, id=261, version=30034,
count=10, id=260, version=30034,
count=1, id=259, version=30034,
count=5, id=257, version=27412,
count=31, id=1, productName=Unmarked objects,
count=2, id=265, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Detects DonutLoader
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=19, id=261, version=30034,
count=12, id=260, version=30034,
count=1, id=259, version=30034,
count=5, id=257, version=27412,
count=46, id=1, productName=Unmarked objects,
count=1, id=265, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=10, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=8, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=3, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=5, id=257, version=27412,
count=35, id=1, productName=Unmarked objects,
count=2, id=265, version=31107,
count=1, id=255, version=31107,
count=1, id=258, version=31107,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Codesign digest Mismatch
File was altered after it was signed.
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 24, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.