MAS_Remake_GUI 1.0.zip
- SHA256 0f4f63adeba0cdbc7795332caf8ab5069aabb8beefa4c779d3e38fc5099e6118
Overview
overview
8Static
static
3MAS_Remake...UI.exe
windows11-ltsc_2024-x64
7MAS_Remake...on.cmd
windows11-ltsc_2024-x64
4MAS_Remake...on.cmd
windows11-ltsc_2024-x64
4MAS_Remake...us.cmd
windows11-ltsc_2024-x64
1MAS_Remake...er.cmd
windows11-ltsc_2024-x64
4MAS_Remake...on.cmd
windows11-ltsc_2024-x64
4MAS_Remake...IO.cmd
windows11-ltsc_2024-x64
4MAS_Remake...on.cmd
windows11-ltsc_2024-x64
4MAS_Remake...on.cmd
windows11-ltsc_2024-x64
4MAS_Remake...ot.cmd
windows11-ltsc_2024-x64
8Behavioral task
behavioral1
Sample
MAS_Remake_GUI 1.0/MAS_Remake_GUI.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Change_Office_Edition.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Change_Windows_Edition.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Check_Activation_Status.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Extract_OEM_Folder.cmd
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
MAS_Remake_GUI 1.0/MAS_Tools/HWID_Activation.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Ohook_Activation_AIO.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Online_KMS_Activation.cmd
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
MAS_Remake_GUI 1.0/MAS_Tools/TSforge_Activation.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
MAS_Remake_GUI 1.0/MAS_Tools/Troubleshoot.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target MAS_Remake_GUI 1.0.zip
- Size 11.4MB
- Sample260702-e46mssbx7z
- SHA256 0f4f63adeba0cdbc7795332caf8ab5069aabb8beefa4c779d3e38fc5099e6118
- MD5 70e27df580d40d19ce43aaa8663a3fe5
- SHA1 54472dda87b6a4e4206fc850589a61ded955c012
- SHA512 e545b03d5ea2b6bead9ece47a242b0debcf757df8460f9da6b6556c286a89eccb2f9d153f9d40a11e78567f70103b78114a688eb5b1f2e3a6c338b5bcaaeaadb
- SSDEEP 196608:0xpGPdbDU7k/qe3J0GSUDTkIifQARsIHbdYjlcwZcohjZyJPiwSCiXrItYA68cZm:03GPuUqQJ0dUHZNIsIH5YjlcwZcohjhy
- TLSH T1B1C63318FA6308CBB593CF80FCEAA5905CECEF170641D55CFD6780421DA32EA2E5EA55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/MAS_Remake_GUI 1.0/MAS_Remake_GUI.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MAS_Remake_GUI 1.0/MAS_Remake_GUI.exe
File Explorer
-
MAS_Remake_GUI 1.0.zip.zip 11.4MB
-
MAS_Remake_GUI 1.0/MAS_Remake_GUI.exe.exe 11.4MB
-
app.pyc2KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Change_Office_Edition.cmd.cmd .bat 56KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Change_Windows_Edition.cmd.cmd .bat 48KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Check_Activation_Status.cmd.cmd .ps1 47KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Extract_OEM_Folder.cmd.cmd .bat 24KB
-
MAS_Remake_GUI 1.0/MAS_Tools/HWID_Activation.cmd.cmd .bat 81KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Ohook_Activation_AIO.cmd.cmd .bat 164KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Online_KMS_Activation.cmd.cmd .bat 172KB
-
MAS_Remake_GUI 1.0/MAS_Tools/TSforge_Activation.cmd.cmd .bat 359KB
-
MAS_Remake_GUI 1.0/MAS_Tools/Troubleshoot.cmd.cmd .bat 58KB
MAS_Remake_GUI 1.0/MAS_Remake_GUI.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 3392719bea3457b252dab1ba80fd68c0087a596b955731b551d6e374c76cc5ea
- MD5 2a6b9a3f4f94c146047afb792d936bdb
- SHA1 9b61b4b513ff3e71f3f880cd5492cf6a194d50f0
- SHA512 c49e0de43ce6e732fb921897c1c1300ec9578d9474eb10a11f7807d4e8b0bff5014953a7dae9e11266b91a861d80bbcc5553e5aad4265a0024bfbd327ae087c1
- SSDEEP 196608:/yStJUIfBUGi50W8UAbuM0jnGCxdGjP5Ui2bjKVPy2wE4/Fe8xvEQa+wWbFvCnAX:/jfjfBU7aW87H0jnGCnGjKi2bjRo4New
- TLSH T120C63388BBD208D9E8874339D8E29666E7E0BA320364D58F5BF18C411D731E5FE79720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33145,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35222,
count=1, id=258, version=35222,
app.pyc
- SHA256 0451b6baced07c098229e602cece36986469e307c0a72871495cba4b5ace068b
- MD5 4240f467442dcedd858e09649ac4107c
- SHA1 6c6599bdcc6c1b1e731ccb02ec996f9f2cd343d9
- SHA512 a87cf348a4b3f81c251b00f8f9f223fbada107705374ebd6fde71b95921f35f37bdf0ed149416cd1dcbda47e21c72db1b9bdd2749f6d29d519d11ecefeddbed6
- TLSH T14E51C8D84498BA82EDBBD335B0A1DC5792BA69E13650A322311825B54ECF0A8CB96F14
- MD5 SHA1 SHA512 TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Change_Office_Edition.cmd
- SHA256 d4b0229ea3a7fdb124962ed4bd0516aa9f019fe38dfd6d5d4217087bc55d5d4a
- MD5 ff31b0e6055d2e621e3c4b55d5c01ddc
- SHA1 7f1d144411a564972766f371e166ce32c07466a1
- SHA512 f52a184b304795eed80e2c83c4416c3374babb025d80e259ad4e1600ca0ee5a914237bbe73d95e0a680910a40315c8cd5b2e334af32c0ad2eae8dee0a16791d4
- SSDEEP 1536:A1/Da/O2y/t/k/g/I7p/S/LuXr7/N/0/D225:A1/+/k/t/k/g/I7p/S/LuXr7/N/0/D75
- TLSH T14943F857B94360A602A732B9D5A7914EF76DC2A3C32197DC386EC088B716354B0FDB6C
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Change_Windows_Edition.cmd
- SHA256 b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc
- MD5 c9564c66946269e6d4277a407e27a40a
- SHA1 137e4729174dbd26fd21046a22c52610f2304b7e
- SHA512 6a07b2d9e713220f303e4d7d391021fb84c7c14a3f2f838f8a14c248a03a2ca02aabb6c266606394b6014be377713a6119d4e4e6911522df759e10f534acf25e
- SSDEEP 1536:4y/Da/fp21d1/BX/rA/cz0ykWk2a+Rnu341/H:4y/+/8d1/BX/rA/cz0ykHO5hH
- TLSH T1BE233C87750251A402F33275A56B828AF72EC1F3A720974C795DC0A4776B355F0BBEAC
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Check_Activation_Status.cmd
- SHA256 c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db
- MD5 27a52fac266ce18ba89ec46fb811a5b3
- SHA1 81bdc69384058a3245629295d934ecf8f5821a80
- SHA512 0f36930728aa4e8a4c6af412f2fd7ef6caeb993098ac160efb75796cb8ea2405d554c6f71e2d567a01d803aaedf5549c57feda7f9de7a780f7faeb7223744edd
- SSDEEP 384:TM51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TMO1c2o9eyPvpnga+BnJbYTf4Jxm
- TLSH T11923D905FD1B926B57C733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9589
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Extract_OEM_Folder.cmd
- SHA256 8149efb071552f848ff87429118e9ad0bb9ff7ce0aa4bb428a83fad852e6d539
- MD5 84a79cc9a3d8fe4fc15e5c4c38dfec9b
- SHA1 ccb04c232de8465796ebed6c916d57836bd73410
- SHA512 3954402b5b210a75d0a57ed7808fc655343e61b6ae08594d0f6a6375868572713a119268957ce030f0a8754b3aa00e419364f1beb26395d7f6f0a600ae12776d
- SSDEEP 384:cbJk0Z3PBFwnJcT/BFLGIk0SCHx3kbbxtUYgv1cwY:cJZfBFwnJcT/BFrk6zv1cwY
- TLSH T1AAB295D72906A06281B737BB4A37914EF72DC1A3D310FACDB49D4478B31A38DD4A91AD
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/HWID_Activation.cmd
- SHA256 d26c015cd129f5b1a84abe9b846a0eeb7ed20f2a03e38129e46efcb526b6f298
- MD5 7aaf569550c8d0e767da30e007c52033
- SHA1 67c2ecce036f9cf914719bccdc7ae5d06cdc6f77
- SHA512 ff0468f8a961feb85298a34f7f2cc3fad326e2d94010d84a70aa810b161412effb2009dfc1c72a68115d28f8237bd25742db013d5c52c61362c619aa3346388d
- SSDEEP 1536:jD/Da/u3y/DaKPPQVhEE6Zt/flC2nq7Df+lirvGHIxGrS2ciUf6s:jD/+/X/P/g3m3HIpL
- TLSH T10C832B07B50260A602B333B86E675686E31EC6A39371A35C796DC088774A74DF1FB79C
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Ohook_Activation_AIO.cmd
- SHA256 048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f
- MD5 7ce4bf0a57da78880586f2b2ca4241e1
- SHA1 cf6f2167505d20f1aed056def4323b6897085df8
- SHA512 e6b37d443099b9aed26b91b56ccaf4b24adad7566cb644bab4b15b1b04ee7f0fd54167b7eaefc29069584e7a4de4a1e96edd63e65dd01e9ec7147b03a08e4c79
- SSDEEP 3072:Rk/j/0ZU/QN5Gfew3HIpZv2xcG1MZgnnwT:RfNO3ICT5Q
- TLSH T105F32A476E42A1F602B3F379AA57958EE32DC693C330A29D396ED094774630670FE24D
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Online_KMS_Activation.cmd
- SHA256 d60586cb7ee632117205d1735a90bb7116f6b7c649541754c8aa27251370df3e
- MD5 62dd3ff0aa686180844e6ee204c56907
- SHA1 53c5437f5039362f17d33abdbbefcbea445d16d7
- SHA512 c3293d3131aea6dc8722ac12799525d3bb9efcadd16cc49c9b33763d4b8d286c9864f587ae4b5c7b243872b5ac9061f1dfddc39d25d3a2f87e7c949dc4b83ec6
- SSDEEP 3072:mJe/j/q/Y/FmUGgDM20e3HIpvGGjYcnck:mmmW3ILnck
- TLSH T15B044A47A54260E602F323BDAA569187F72EC2A34331E2AC356EC484BB5631B71F775C
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/TSforge_Activation.cmd
- SHA256 67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76
- MD5 37ff5581828b14a6f39c2e876c9adbfd
- SHA1 7c1b3513ff9bf791d4f6db1965a9256f1a07c573
- SHA512 cd8b2b4bd9c85177b293cc01dbad15354ca2753bb9e49489a90c57d83e2670ec85e627b197208939680f332de349ca3ef98f76a0eb56cfc93923dfcda2408515
- SSDEEP 3072:vz/b/5/x/x/52env0yf3/nNq/Q/8/O/3/UGs3m3HIpJZl0FcExVTGX2THiwPr8ri:FF/J3I2cEvTGmaiE0
- TLSH T149741945A913A5A705B33379DF42804AFB27C33303755369BAADC104AF7A309A2B5F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
MAS_Remake_GUI 1.0/MAS_Tools/Troubleshoot.cmd
- SHA256 a09a38473df2583c9fafc0bf17b8ed5ba98eafafb24d0316b97f7f8a9f7469ff
- MD5 b5ca3be590257bfbb68da669d3aa76b5
- SHA1 a769c27c0b1b575c549624e4687dc94f95cc0363
- SHA512 9b5e6cc9873bcc0b721c19d9e55e5dec01eb415d8879793a350c8da80579399c0dbf418410e0846932477b77dc5a8ced7be3ed0a8d72e128526e4a3d3afa2529
- SSDEEP 768:cJriBFcnNI/rBFXk6MOgXL9DlVhIQ++iW3AaPhPa01SAuXmPGnI1jzsWpjE50tnf:Au/ca/bMOgbHkQHiW3AC/te0v2G
- TLSH T13343E813B60190B182F233B9DE37964EB71EC157D324AA8C759EC158775538AE0BA3EC
- MD5 SHA1 SHA512 SSDEEP TLSH