Extracted

• • Target
    nmap-7.99-setup.exe
  • Size 35.2MB
  • SHA256 fda839f35d9f8f18a11670e17d0332ce9d05a3556c5a20e91b0b56c57774f611
  • MD5 ab2854d90d342bc22ceb1d88b38736cd
  • SHA1 88a591b2d1b7019d6f85686db82201ab07a38ae3
  • SHA512 af07f61306ba6c4b41a553b03f7626b2566ad9ec3fee66d478aa7ae3d7634be3ef33913594725dd8242db252644747fcc757eb8aea95b07d45fe8879697ff647
  • SSDEEP 786432:awhBLkfvX3EE713WeJXJC+fvHEFTAE729OJFE7AI:awhBC3Z79xXcmclAw2BJ
  • TLSH
    T13B87334B301D6665D35437BEAAE3BC723627EB563146E30235CD234D0B7B21DD39AA22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral1behavioral2
• • Target
    zenmap/lib/python3.14/__future__.pyc
  • Size 4KB
  • SHA256 79f27ebdc9ba2e9d995211ee08af9aaa59200262a3bd15a64cef0129f156c421
  • MD5 85176f9c376fb1b4f447e067f067792d
  • SHA1 b64397f8d46b02e62ac3aec9bde828e73f84ee56
  • SHA512 127ecf34e843ca306c1786b6fe2f69b0c3293e3c18d9cb9f05e5efdad8c99eb2e01304ecb067ede3f4c8dff29a420cdcde4625e589fd36a3719a83932b4e4589
  • SSDEEP 96:yhdINzUuGd+P2scvNDdsBWxczgHAleC5hlR4Xa2iuryoVVo:yM4BpifWehlyXa2iuFPo
  • TLSH
    T1CFA1C61A2184467BF983F0F2E6895281EF19C5BE9B61113B705C02493FC7DB08F3789A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    zenmap/lib/python3.14/_aix_support.pyc
  • Size 4KB
  • SHA256 d254a5a6f0ce804ee175b441d69dde3168892255a5fc27b0cdadf3f42ac73717
  • MD5 197248b77941094684eaba13d4cb18cb
  • SHA1 2db2d01a7b5d1531cd682915634efec838734a2a
  • SHA512 bfbbaa22706669f1e9a7736d361588ac5b912031c20308a25d9d37c55e8cc799ca7ce32b06afbe7e34abb82cba5d9ba84384632e8a255e3193e4d1f6b9a00173
  • SSDEEP 96:0/tDAdBEkTR2B+wqRzNV6X/tfVwt2G+VN52123:0FUVTR2YBNs9Vw4G0Y1k
  • TLSH
    T1F1A1D5590A881A73EDE18134309F69CADF32C4BA1A44C783D0A50E1D6CAB735A8AB65C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    zenmap/lib/python3.14/_ast_unparse.pyc
  • Size 72KB
  • SHA256 65ba1feb27423850173b72a44e6fe80ce7e7c392143f1d1ad49ff08b0998aebb
  • MD5 02cdba3ba67ac3e5a672cd4b655a02d0
  • SHA1 e42d7929e61bd48de4b25158f4c6ca63e77b3ae9
  • SHA512 ea6014f5f8c3517880111170b90e70aa71bef80179f1b7e91d14e4c1e5dcb35c0e68dc696209eeace8c03ab8402bc1bfa569cac252dbf94e6f430c59642b8e5e
  • SSDEEP 768:uwSp6K7zIw1/3KIf5fyf93Pvfpf2NoeA8qHZnoJ46IKNWIwSYo:uu6xfxfWBPXpoop8yxoJ46ttn
  • TLSH
    T1F67360BAA868640BF9DEB57835D7A990E721E005B340C793D13044FEBDEC360D9A974E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral7behavioral8
• • Target
    zenmap/lib/python3.14/_collections_abc.pyc
  • Size 46KB
  • SHA256 9aea0540523f2ab5e079df92b7d4e5941e64f65188901f9bb99b0a82623bbc24
  • MD5 b0b24ae1639a4014b96593c6659b1492
  • SHA1 19d01c1da6e11d2cb3f5b9de0f6e96bbaa7163bb
  • SHA512 b0fcca5f352ec540b8563fc4570935fc313bf5177a027cf991c9dceeb953d9b2bb25cf122d0f54c3c90d48fb802053a0be9e9e6e017198b98547bea4ee4e62bd
  • SSDEEP 768:qThCX9uxRpq+zexmF6xyiECG9FYQIBqAwL1q4MbKe9ymes1jI:qThCX9uxRpqdqmECGnYQIBqzL1q4Mbh8
  • TLSH
    T16F23A49576E15927FDAAF43920639905E727C052F300C353A97E58AFFC3A6808E7798C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionwarmcookiepersistenceransomware

  • Family: Warmcookie, Badspace

    Warmcookie aka Badspace is a backdoor written in C++.

    backdoorwarmcookie

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral10behavioral9
• • Target
    zenmap/lib/python3.14/_colorize.pyc
  • Size 18KB
  • SHA256 0e4535d36e8e32007399f1b5e0dcad0320f4f1c8cffdf589b8b955c6b049c360
  • MD5 61b702616bfe41702dc6dfef6fa318b0
  • SHA1 7faa9e8b1bec6902adbbf821ed30382045a7c4ab
  • SHA512 5f908a6c4d412928fd59c294ab98820ec80dd903300a94adb6abd6c752b5a4f478326c4ae5a2abadb129a768a363efce93f76825d799e4a3337ae6bd461572b0
  • SSDEEP 384:Tx0UyaYMQBHpiwL9KiMKTZC5L9Tu6Ugayw1rO:OGYMQuuIdKTc5A6U/C
  • TLSH
    T1D982A7D9B3C8DA17FC69F9B92287C705BB359241E9009363E2304C794C696A19FBF51C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral11behavioral12
• • Target
    zenmap/lib/python3.14/_compat_pickle.pyc
  • Size 7KB
  • SHA256 ccc8dfc2952fd754318138426d5a89c7df7a46434e5789464b24be412151ce25
  • MD5 05847ff8636dd780ed0d26eb384546d1
  • SHA1 17277b78c0da25cab87a242f72b3531bfb034a2d
  • SHA512 5bb50b1eabca9dcd86af9ac381a6bde7b1481d38a10e20a000d0535d48dcd6f80900c50bbec6282245d8db0a29779b366e7d79db89d264134c7ee089f2de44ed
  • SSDEEP 192:tuMaDWhQraaKEoGa3UNWReGtnwNDy5cQz8:t9yOEv/N25JY
  • TLSH
    T189E1A6463F0860D7FFE8B7B727A0C769535C05946290F17299F49E1A4E9CA01DD2126E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral13behavioral14
• • Target
    zenmap/lib/python3.14/_ios_support.pyc
  • Size 2KB
  • SHA256 e9e5096e110d3eb1ff9dd088a38989f4aee46450c6a484264038d6007484faaf
  • MD5 c8fe8cf5da6269eff14e08aa259f077e
  • SHA1 ee0ef0a661b46a59e474a5a6c7c0c1225a7c2624
  • SHA512 29657acea887a590fc098f7cc40c7a28acb7023b09ee7363a49bfaa4c3221e42e5a93a501e6ef24f23d17da9f53e86c53de01d48323448691805d3e33e6ef172
  • TLSH
    T1235151F604204A63DAC9E1712CF207E86F77C5C69C65E2A6F5C80C366E9D199013233C
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral15behavioral16
• • Target
    zenmap/lib/python3.14/_opcode_metadata.pyc
  • Size 10KB
  • SHA256 7dcf2b852e6bf630f44a23d7c7c63ac3670ae836bf34922c79b1dd2e743c519c
  • MD5 c4910d0c2bcb0d6f4549d8a4b8f6f1d8
  • SHA1 4416b4c0b6257b20bc2fde75b2097725e1f82fd3
  • SHA512 a9d25ea7d98643007c219b845d74c671ad02186dc938e4271d74373946455449d0ffe46cb0bac2752a3b9cdc647985306437624cfc9ff660e5dfec285ecaa65a
  • SSDEEP 192:vVI1ZQ1DGAS+BD2RW9n00BPnkGsg5i57O6uB3uoDmIXhO3S/7MuG9MeF:NI1CDARu00Bc+5i57OZB+oDmhizMrRF
  • TLSH
    T13C2271B8FD8A27E16E81F47C2F50A663F5AAD558FEB006B1C4D3940D2087A47FC0AC85
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral17behavioral18
• • Target
    zenmap/lib/python3.14/_osx_support.pyc
  • Size 18KB
  • SHA256 0bdc0380115871b15a3ce15c0c0b4003bfba2ebe9ace69edd9da360a5a98f534
  • MD5 8f22666b58d648925a478fc880945656
  • SHA1 4a7e1a4c64338c435b0a728311ba5b4009b0e795
  • SHA512 d227daedae147fbd1c94a46664b98f55df9757bb336162743f30b11f55de670db3d669bf4ca45631c57b61c5bdd0bd9329501ad64e0be4001cfeb099094819f6
  • SSDEEP 384:QNxA7FICfQunKqSlV/IEMNk2vKO9g+QCT2LFiv:GZNqSYb6+AFs
  • TLSH
    T1EE8207BCD6806537FCD9A178A2EB1985DB22C1929208F743E0189D75ECCE64CE67735C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral19behavioral20
• • Target
    zenmap/lib/python3.14/_py_abc.pyc
  • Size 7KB
  • SHA256 4bab71b3f29f9b69940b570aacc05297b24fe485ed994f601ac05e9100d9ea53
  • MD5 31aaefd6a3b6335bba9b5a062f4ae1d8
  • SHA1 8f94c4ac3f947097a2ba6af88afa8229e7038aba
  • SHA512 2ae6c4f830c167a5e72e38b4bcf8841134d9b6a2c25ed72a60149c9170c9f802dbbcc56b8eb4b3886e0190ddd9ad4eee2f7b919af5c74393216258f8dd6a9d3d
  • SSDEEP 192:Rm4ezIhXMf329es1j/BM3N0QBqCqiCmy7ZIHb820:Rm4gIHXlQhCmYZIV0
  • TLSH
    T130E1E7289A81B97FFDCFF07A7473A995A3138447A310C743C9B548ACAC0A656D0E256C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral21behavioral22
• • Target
    zenmap/lib/python3.14/_py_warnings.pyc
  • Size 36KB
  • SHA256 d1b7f7d0e9101beefc7ce09743532abab3b225980d9a7b219eaaf502a7cd8db3
  • MD5 0aff2a65f017cdef7f97230ac759ac7e
  • SHA1 98254caa1b40701b0a6435da999319331b7bf7eb
  • SHA512 3185f343e925d3c144f7b7c787e8ffc649c772e6d002c7047aeedd0403f77fd3a93c3008d8e835875fc8e746d20a5019ad264dad5be7267acb2029d312458d5e
  • SSDEEP 768:uEz123BJmtuN3KQaTIqKQujPrtlRP9Dkhfx/P6xPca:3I3mtuN3KQaTIqLujztVg3/PY
  • TLSH
    T1D9F2F8B4A5806627FE89F5F931E3988AD322C047A302D303D13C99BE7DDE6948A7571D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral23behavioral24
• • Target
    zenmap/lib/python3.14/_pydatetime.pyc
  • Size 99KB
  • SHA256 d0dcbca8d523717c89a1807c6e1592b0d09d07bae8d38e23378f7c01bdd3abd4
  • MD5 02ceed3a530c8893ce73c40ca6bbeca9
  • SHA1 285bfa8c2030e7beeff2b883fa32e0795bfca9c9
  • SHA512 4e3642d5901fb5fe47eac04db9857134969bafafb46e298b1d6985330dd6661b27d6c5af54adbf922fdcae830c8c771016845806daf1a3f57a45684f6a9951af
  • SSDEEP 1536:ZGdKIPagbNs9w+AiH1IUgS811WlcUaGzCChy3ez30EaxhbxQq:QcIGwAVIE810i6hseaF
  • TLSH
    T18FA3D7A4B9B4182BFCAAB03576F73981F732E05A4304DB43D53D4EA67CA5B24DC2568C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral25behavioral26
• • Target
    zenmap/lib/python3.14/_pydecimal.pyc
  • Size 221KB
  • SHA256 41ceaa4915b58843aea03031c5b682665871e5a13dedbced4a48335178bbf720
  • MD5 1b9de1474e5ecf79d3085eee2b595d0c
  • SHA1 e2e82ca8e0d1f19b1ccc692f80753090e606a07f
  • SHA512 1606d6a1ba5132da403bff30ed97868927a2ea32c109ade6fd0838444909c71703a96cb964f7c43f773e287a591f4b2cff196dd424fbb99746dce4bd2a26c831
  • SSDEEP 6144:+EGAOaQ4BDWKlVjzwm8RHRaAnLwayUcj2w:OtzKl65RaUc2w
  • TLSH
    T19024B87897D65523F87EB43833AF34C1F722A0394288C653D46C8C68BEC6E69D5259BC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral27behavioral28
• • Target
    zenmap/lib/python3.14/_pyrepl/__init__.pyc
  • Size 136B
  • SHA256 bab5acb95ee4330c27c30210bbea219dca06965f54fecd07d7d01ffecf9e965a
  • MD5 b5aef5c56b06e4cd96af938ad9754e08
  • SHA1 7a48395e1f9be54f4a61405b1e7f141420749f9e
  • SHA512 8060892528a5bd425f9997c78a63ee4c0ab56997e386033cdaaa3084ee4d436cd90c6816cf5ab96969b176cbc1c251524ac7b3b79d88539d230079086244d8cc
  • TLSH
    T10BC092026562D99BE969A074A87B931E77A289DD81B881CF2A2AB4AE0DED5400CD2604
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral29behavioral30
• • Target
    zenmap/lib/python3.14/_pyrepl/pager.pyc
  • Size 11KB
  • SHA256 b553154f6972551dbf860bafff96c1814fe5bb758517315bd98277f36ca2148e
  • MD5 9a706a03ebea88d8473cb2e5c3ac063a
  • SHA1 a0fc5fb3a168e10dd635fd01064ad6020abf8a18
  • SHA512 0d5e1ea240b1838452d286a57c7ab5a15a0f9ac8c349510a1c317d9fb61f13cdd8481f8a564e3c53525d5ab07dd803441fd757f31ccc638d4081f6c00c2d8392
  • SSDEEP 192:Lg4c0L41EYtnq5glcPqDUqX2qZHAPM9zrtSAwRqDn5q98/6qLOSbVB:E4xYJqelSqIqGqZganMhq9qXqLj
  • TLSH
    T13932B7ECDA408627F9E9F9B820D3D914B732C14625059323F234ACBE2CDD3556AE162E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral31behavioral32