boosterx.rar
- SHA256 8bd69a89ef72a2fae9da9efef0b6216307449eaf0e1bd952253c1221b7d0b889
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
boosterx/BoosterX.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
boosterx/BoosterX.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
boosterx/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
boosterx/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target boosterx.rar
- Size 32.6MB
- Sample260705-rpexracy8x
- SHA256 8bd69a89ef72a2fae9da9efef0b6216307449eaf0e1bd952253c1221b7d0b889
- MD5 d22247d10e55953156f2e45f25d1bd90
- SHA1 0afbdd247679c88354e95f800e74fe2dfff9ecad
- SHA512 ce7cf83e1be8e7762ebfe14e8329a24c57583b1fb8eaf6cc36641f956d40045c3465ca69dccc143db60e86e3becd1662e961b2ccb7875909d855563cb2b4b9ec
- SSDEEP 786432:McsXrJvUiGoZ35QYqXSnbpi8Ed6urXMohkHF1GRFFV:DsXr9/v3N4Kdi8E04MgPFV
- TLSH T17F7733B8F512128783D9FE344DB03A40ACA5FA97DE4255DC8D94E5EF44F158AF0B0AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/boosterx/Newtonsoft.Json.dll net_reactor - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/boosterx/Newtonsoft.Json.dll
File Explorer
-
boosterx.rar.rar 32.6MB
-
boosterx/BoosterX.exe.exe 33.8MB
-
boosterx/Newtonsoft.Json.dll.dll 863KB
boosterx/BoosterX.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 457650023111ecaa72ed5ac809d6b1204518f4591e3d81e62a732334026261b1
- MD5 ae55a9d5ccc27582e7f268a6ffcf1993
- SHA1 48f83543f462a543093b706d4d360e3bdab0fbea
- SHA512 3722c05708088866ffcf73981958d414dbaf05e92d36231c0b4032f8bbd6504cf28649f11cd0f4068bfcde35f671c4c44fd08639b383c9a3799c9a42678a1ac3
- SSDEEP 786432:ghQnYcixo9HEgl7Grpl964n3qFdxdmRdpCwT38y:ghWxiG9kgRG9z6ysdA
- TLSH T1E7772344EAAE9C2BE48F53BAF42209E5E774C4AC774FF38E1A0521A05D497846D076CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:df:a7:71:fd:fd:50:33:68:76:d2:cb:21:fb:e0:ad:61:c6:9a:49:0a:12:dc:b2:28:94:dc:2f:08:8a:26:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=IP Ksenofontov Iosif Yurievich,O=IP Ksenofontov Iosif Yurievich,L=Churapcha,ST=Republic of Sakha (Yakutia),C=RU,1.2.840.113549.1.9.1=#0c0f70726f40626f6f73746572782e7275
Chains
Aug 26, 2025
CN=IP Ksenofontov Iosif Yurievich,O=IP Ksenofontov Iosif Yurievich,L=Churapcha,ST=Republic of Sakha (Yakutia),C=RU,1.2.840.113549.1.9.1=#0c0f70726f40626f6f73746572782e7275
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=IP Ksenofontov Iosif Yurievich,O=IP Ksenofontov Iosif Yurievich,L=Churapcha,ST=Republic of Sakha (Yakutia),C=RU,1.2.840.113549.1.9.1=#0c0f70726f40626f6f73746572782e7275
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=IP Ksenofontov Iosif Yurievich,O=IP Ksenofontov Iosif Yurievich,L=Churapcha,ST=Republic of Sakha (Yakutia),C=RU,1.2.840.113549.1.9.1=#0c0f70726f40626f6f73746572782e7275
Serial Number
20:3e:9b:da:67:d8:be:01:52:46:6f:b7
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 5, 2024 - Aug 18, 2027
Subject
CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE
Serial Number
01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 11, 2025 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
0
Major OS version
4
Entry point
35426910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33.8MB
Virtual Size
33.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
boosterx/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6be7d7ba1d703129918c412c345f972419d5197e06e1b2fe9e0f9d39e828a8e
- MD5 ed6578e3065343cd52d42d81d0e9c8d7
- SHA1 37c8906f8a0cd08e5e23127518ff94a4bb67a2cd
- SHA512 c82bcbdf4e9a0d87d0d9ad7309ca20fe0667ffadb6546f97edc78a2c13b297c7f3aee53b9d7aac464c9b0fb51b2dd5ab73b7314f382fa12b58b9ee1d57057592
- SSDEEP 12288:F7heizQulNrZ6HRXiGtlWOsfybD6grzEOlQA+uTpkQ:F7VzQuv4HRXTXW1OlQAPV3
- TLSH T1F8157D11ABA8CE37D65E97B1559454290BF0C209F6C7FF4B684967E098933A03F0A27F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
889166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
860KB
Virtual Size
860KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ