Новая сжатая ZIP-папка[.]zip

General

Target
Новая сжатая ZIP-папка.zip
Size 131KB
Sample260622-2xaccahs4x
SHA256 fe02d216f029f771ce43353ada03d53af9c3c5125189473c113c95bff5d5e094
MD5 ffc8b29dde9d1c47ee8c311061122308
SHA1 4a2db4841b7388a2a7ef6dc22bb667332e224360
SHA512 bd8682824520f562b0563362fe15bcdd62b30952929c7a87a06da8baeb968c723f3b1c6afdb689492fc27748a0020632ffd392c3e3c6d4f0473501edc3f0f162
SSDEEP 3072:IGzrQqJE7GLdh+7SJ6JLvD0j8ZwFNHYdTrHnlDfsU:IG31JEaRI7pJLvwwZqedHHnB0U
TLSH
T164D312957325BDA5C8205267E67F6A0B218FF0832DB33ACF9C21065C06D7446EA8F67D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/SatoshiTerminal.exe	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SatoshiTerminal.exe

File Explorer

Новая сжатая ZIP-папка.zip

.zip 131KB
SatoshiTerminal.exe

.exe 217KB

Новая сжатая ZIP-папка.zip

SHA256 fe02d216f029f771ce43353ada03d53af9c3c5125189473c113c95bff5d5e094
MD5 ffc8b29dde9d1c47ee8c311061122308
SHA1 4a2db4841b7388a2a7ef6dc22bb667332e224360
SHA512 bd8682824520f562b0563362fe15bcdd62b30952929c7a87a06da8baeb968c723f3b1c6afdb689492fc27748a0020632ffd392c3e3c6d4f0473501edc3f0f162
SSDEEP 3072:IGzrQqJE7GLdh+7SJ6JLvD0j8ZwFNHYdTrHnlDfsU:IG31JEaRI7pJLvwwZqedHHnB0U
TLSH
T164D312957325BDA5C8205267E67F6A0B218FF0832DB33ACF9C21065C06D7446EA8F67D
MD5 SHA1 SHA512 SSDEEP TLSH

SatoshiTerminal.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 161e7979a8e50bd5d85a641baa8c59f3a02b7386236f1fad24fc74e08156eab1
MD5 e57f86f54f3a2e4e21e5378370cd91ae
SHA1 601cd8e0a7bb564308f9b55dfb33ca63fc8b3819
SHA512 8096473d69ad030617dd23bb3c882eefdb138e9fa0ca1300f1c705eea5d46a8dbef2848222af97213033869e73dda9f05f541ea73e18e3958407007e0a9de054
SSDEEP 6144:HLEaVI7pnLvAwZSSIvMbJ8u1V7iLNlWMBQ30oktSF8iIk5Dm5:IaVI7pn8vSIvG8u1V7iLNlWMBQ30oktx
TLSH
T1D224BADC726072DFC867D472DEA82CA8EA6174BB931B4603902715ED9E4D897DF180F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

245770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Новая сжатая ZIP-папка.zip

SatoshiTerminal.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Новая сжатая ZIP-папка.zip

SatoshiTerminal.exe

mscoree

dotnet